Appendix A Using Syslog

Transcription

1 Appendix A Using Syslog This appendix describes how to display Syslog messages and how to configure the Syslog facility, and lists the Syslog messages that an HP Routing Switch can display during standard operation. NOTE: This appendix does not list Syslog messages that can be displayed when a debug option is enabled. For information about Syslog messages that are displayed by a debug option, see the Diagnostics Guide. Overview An HP device s software can write syslog messages to provide information at the following severity levels: Emergencies Alerts Critical Errors Warnings s Debugging The device writes the messages to a local buffer. In software release earlier than , the local buffer can hold up to 100 entries. Beginning with software release , the buffer can hold up to 1000 entries. You also can specify the IP address or host name of up to six Syslog servers. When you specify a Syslog server, the HP device writes the messages both to the system log and to the Syslog server. Using a Syslog server ensures that the messages remain available even after a system reload. The HP device s local Syslog buffer is cleared during a system reload or reboot, but the Syslog messages sent to the Syslog server remain on the server. The Syslog service on a Syslog server receives logging messages from applications on the local host or from devices such as a Routing Switch. Syslog adds a time stamp to each received message and directs messages to a log file. Most Unix workstations come with Syslog configured. Some third party vendor products also provide Syslog running on NT. Syslog uses UDP port 514 and each Syslog message thus is sent with destination port 514. Each Syslog message is one line with Syslog message format. The message is embedded in the text portion of the Syslog A - 1

2 Installation and Basic Configuration Guide format. There are several subfields in the format. Keywords are used to identify each subfield, and commas are delimiters. The subfield order is insensitive except that the text subfield should be the last field in the message. All the subfields are optional. Displaying Syslog Messages To display the Syslog messages in the device s local buffer, enter the following command at any level of the CLI: HP9300> show logging Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns) Buffer logging: level ACDMEINW, 3 messages logged level code: A=alert C=critical D=debugging M=emergency E=error I=informational N=notification W=warning Static Log Buffer: Dec 15 19:04:14:A:Fan 1, fan on right connector, failed Dynamic Log Buffer (50 entries): Dec 15 18:46:17:I:Interface ethernet 1/4, state up Dec 15 18:45:21:I:Bridge topology change, vlan 4095, interface 4, changed state to forwarding Dec 15 18:45:15:I:Warm start For information about the Syslog configuration information, time stamps, and dynamic and static buffers, see Displaying the Syslog Configuration on page A-3. Enabling Real-Time Display of Syslog Messages By default, to view Syslog messages generated by an HP device, you need to display the Syslog buffer or the log on a Syslog server used by the HP You can enable real-time display of Syslog messages on the management console. When you enable this feature, the software displays a Syslog message on the management console when the message is generated. When you enable the feature, the software displays Syslog messages on the serial console when they occur. However, to enable display of real-time Syslog messages in Telnet or SSH sessions, you also must enable display within the individual sessions. USING THE CLI To enable real-time display of Syslog messages, enter the following command at the global CONFIG level of the CLI: HP9300(config)# logging console Syntax: [no] logging console This command enables the real-time display of Syslog messages on the serial console. You can enter this command from the serial console or a Telnet or SSH session. To also enable the real-time display for a Telnet or SSH session, enter the following command from the Privileged EXEC level of the session: telnet@hp9300# terminal monitor Syslog trace was turned ON Syntax: terminal monitor Notice that the CLI displays a message to indicate the status change for the feature. To disable the feature in the management session, enter the terminal monitor command again. The command toggles the feature on and off. telnet@hp9300# terminal monitor A - 2

3 Using Syslog Syslog trace was turned OFF Here is an example of how the Syslog messages are displayed: terminal monitor Syslog trace was turned ON SYSLOG: <9>HP9300, Power supply 2, power supply on left connector, failed SYSLOG: <14>HP9300, Interface ethernet 1/6, state down SYSLOG: <14>HP9300, Interface ethernet 1/2, state up Configuring the Syslog Service The procedures in this section describe how to perform the following Syslog configuration tasks: Specify a Syslog server. You can configure the HP device to use up to six Syslog servers. (Use of a Syslog server is optional. The system can hold up to 100 Syslog messages in an internal buffer.) Change the level of messages the system logs. Change the number of messages the local Syslog buffer can hold. Display the Syslog configuration. Clear the local Syslog buffer. Logging is enabled by default, with the following settings: Messages of all severity levels (Emergencies Debugging) are logged. By default, up to 50 messages are retained in the local Syslog buffer. This can be changed. No Syslog server is specified. Displaying the Syslog Configuration To display the Syslog parameters currently in effect on an HP device, enter the following command from any level of the CLI: HP9300> show logging Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns) Buffer logging: level ACDMEINW, 3 messages logged level code: A=alert C=critical D=debugging M=emergency E=error I=informational N=notification W=warning Static Log Buffer: Dec 15 19:04:14:A:Fan 1, fan on right connector, failed Dynamic Log Buffer (50 entries): Dec 15 18:46:17:I:Interface ethernet 1/4, state up Dec 15 18:45:21:I:Bridge topology change, vlan 4095, interface 4, changed state to forwarding Dec 15 18:45:15:I:Warm start Syntax: show logging A - 3

4 Installation and Basic Configuration Guide The Syslog display shows the following configuration information, in the rows above the log entries themselves. Table A.1: CLI Display of Syslog Buffer Configuration This Field... Syslog logging messages dropped flushes overruns level messages logged level code Displays... The state (enabled or disabled) of the Syslog buffer. The number of Syslog messages dropped due to user-configured filters. By default, the software logs messages for all Syslog levels. You can disable individual Syslog levels, in which case the software filters out messages at those levels. See Disabling Logging of a Message Level on page A-10. Each time the software filters out a Syslog message, this counter is incremented. The number of times the Syslog buffer has been cleared by the clear logging command or equivalent Web management interface option. See Clearing the Syslog Messages from the Local Buffer on page A 12. The number of times the dynamic log buffer has filled up and been cleared to hold new entries. For example, if the buffer is set for 100 entries, the 101st entry causes an overrun. After that, the 201st entry causes a second overrun. The message levels that are enabled. Each letter represents a message type and is identified by the key (level code) below the value. If you disable logging of a message level, the code for that level is not listed. The total number of messages that have been logged since the software was loaded. The message levels represented by the one-letter codes. Static and Dynamic Buffers The software provides two separate buffers: Static logs power supply failures, fan failures, and temperature warning or shutdown messages Dynamic logs all other message types In the static log, new messages replace older ones, so only the most recent message is displayed. For example, only the most recent temperature warning message will be present in the log. If multiple temperature warning messages are sent to the log, the latest one replaces the previous one. The static buffer is not configurable. The message types that appear in the static buffer do not appear in the dynamic buffer. The dynamic buffer contains up to the maximum number of messages configured for the buffer (50 by default), then begins removing the oldest messages (at the bottom of the log) to make room for new ones. A - 4

5 Using Syslog The static and dynamic buffers are both displayed when you display the log. HP9300(config)# show logging Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns) Buffer logging: level ACDMEINW, 3 messages logged level code: A=alert C=critical D=debugging M=emergency E=error I=informational N=notification W=warning Static Log Buffer: Dec 15 19:04:14:A:Fan 1, fan on right connector, failed Dec 15 19:00:14:A:Fan 2, fan on left connector, failed Dynamic Log Buffer (50 entries): Dec 15 18:46:17:I:Interface ethernet 1/4, state up Dec 15 18:45:21:I:Bridge topology change, vlan 4095, interface 4, changed state to forwarding Dec 15 18:45:15:I:Warm start Notice that the static buffer contains two separate messages for fan failures. Each message of each type has its own buffer. Thus, if you replace fan 1 but for some reason that fan also fails, the software replaces the first message about the failure of fan 1 with the newer message. The software does not overwrite the message for fan 2, unless the software sends a newer message for fan 2. When you clear log entries, you can selectively clear the static or dynamic buffer, or you can clear both. For example, to clear only the dynamic buffer, enter the following command at the Privileged EXEC level: HP9300# clear logging dynamic-buffer Syntax: clear logging [dynamic-buffer static-buffer] You can specify dynamic-buffer to clear the dynamic buffer or static-buffer to clear the static buffer. If you do not specify a buffer, both buffers are cleared. Time Stamps The contents of the time stamp differ depending on whether you have set the time and date on the onboard system clock. If you have set the time and date on the onboard system clock, the date and time are shown in the following format: mm dd hh:mm:ss where: mm abbreviation for the name of the month dd day hh hours mm minutes ss seconds For example, Oct 15 17:38:03 means October 15 at 5:38 PM and 3 seconds. If you have not set the time and date on the onboard system clock, the time stamp shows the amount of time that has passed since the device was booted, in the following format: <num>d<num>h<num>m<num>s where: A - 5

6 Installation and Basic Configuration Guide <num>d day <num>h hours <num>m minutes <num>s seconds For example, 188d1h01m00s means the device had been running for 188 days, 11 hours, one minute, and zero seconds when the Syslog entry with this time stamp was generated. Example of Syslog Messages on a Device Whose Onboard Clock Is Set The example shows the format of messages on a device whose onboard system clock has been set. Each time stamp shows the month, the day, and the time of the system clock when the message was generated. For example, the system time when the most recent message (the one at the top) was generated was October 15 at 5:38 PM and 3 seconds. HP9300(config)# show log Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns) Buffer logging: level ACDMEINW, 38 messages logged level code: A=alert C=critical D=debugging M=emergency E=error I=informational N=notification W=warning Static Log Buffer: Dec 15 19:04:14:A:Fan 1, fan on right connector, failed Dec 15 19:00:14:A:Fan 2, fan on left connector, failed Dynamic Log Buffer (50 entries): Oct 15 17:38:03:warning:list 101 denied tcp (0)(Ethernet 4/ a1f.77ed) -> (http), 1 event(s) Oct 15 07:03:30:warning:list 101 denied tcp (0)(Ethernet 4/ a1f.77ed) -> (http), 1 event(s) Oct 15 06:58:30:warning:list 101 denied tcp (0)(Ethernet 4/ a1f.77ed) -> (http), 1 event(s) Example of Syslog Messages on a Device Whose Onboard Clock Is Not Set The example shows the format of messages on a device whose onboard system clock is not set. Each time stamp shows the amount of time the device had been running when the message was generated. For example, A - 6

7 Using Syslog the most recent message, at the top of the list of messages, was generated when the device had been running for 21 days, seven hours, two minutes, and 40 seconds. HP9300(config)# show log Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns) Buffer logging: level ACDMEINW, 38 messages logged level code: A=alert C=critical D=debugging M=emergency E=error I=informational N=notification W=warning Static Log Buffer: Dynamic Log Buffer (50 entries): 21d07h02m40s:warning:list 101 denied tcp (0)(Ethernet 4/ a1f.77ed) -> (http), 1 event(s) 19d07h03m30s:warning:list 101 denied tcp (0)(Ethernet 4/ a1f.77ed) -> (http), 1 event(s) 17d06h58m30s:warning:list 101 denied tcp (0)(Ethernet 4/ a1f.77ed) -> (http), 1 event(s) Displaying and Configuring Syslog Buffer Parameters Using the Web Management Interface To configure Syslog parameters using the Web management interface, use the following procedure: 1. Log on to the device using a valid user name and password for read-write access. The System configuration panel is displayed. 2. Select Management from the System configuration sheet to display the Management panel. 3. Select the System Log link to display the following panel. 4. Select Disable or Enable next to Logging to disable or enable the Syslog service on the The service is enabled by default. 5. Optionally change the number of entries the local Syslog buffer can hold. The buffer size can be from The default is 50. A - 7

8 Installation and Basic Configuration Guide NOTE: A change in the buffer size takes effect only after you restart the system. The buffer size does not affect how many entries the device can log on a Syslog server. The number of entries the device can log on the server depends on the server s configuration. 6. Select the messages facility. The default is User. For a list of values, display the pulldown menu. 7. Select the message levels you want the device to log. All the levels are logged by default. 8. Click Apply to save the changes to the device s running-config file. 9. Select the Save link at the bottom of the dialog. Select Yes when prompted to save the configuration change to the startup-config file on the device s flash memory. 10. To view a list of the Syslog servers that have been defined, click the Show Log Server link under the Apply and Reset buttons to display the Log Server panel. Figure 15 List of Log Servers The list shows the IP Addresses and UDP Ports of the Syslog Servers. 11. To delete an entry, click on the Delete button for that entry. 12. Select the Save link at the bottom of the dialog. Select Yes when prompted to save the configuration change to the startup-config file on the device s flash memory. 13. To add a Syslog server, click on the Add Log Server link under the dialog to display the System Log Server panel. Figure 16 System Log Server Panel 14. Enter the IP address of the new Syslog server, if you want the device to log messages on the Syslog server as well as in the local buffer. 15. Enter the UDP port on the server that will be used for logging messages. A - 8

9 Using Syslog 16. Click on the Add button to add the server to the list. You can add up to six Syslog servers. 17. When you have finished, select the Save link at the bottom of the dialog. Select Yes when prompted to save the configuration change to the startup-config file on the device s flash memory. Disabling or Re-Enabling Syslog Syslog is enabled by default. To disable or re-enable it, use one of the following methods. USING THE CLI To disable it, enter the following command at the global CONFIG level: HP9300(config)# no logging on Syntax: [no] logging on [<udp-port>] The <udp-port> parameter specifies the application port used for the Syslog facility. The default is 514. To re-enable logging, enter the following command: HP9300(config)# logging on This command enables local Syslog logging with the following defaults: Messages of all severity levels (Emergencies Debugging) are logged. Up to 50 messages are retained in the local Syslog buffer. No Syslog server is specified. Specifying a Syslog Server To specify a Syslog server, use one of the following methods. USING THE CLI Enter a command such as the following: HP9300(config)# logging Syntax: logging <ip-addr> <server-name> USING THE WEB MANAGEMENT INTERFACE See the section Displaying and Configuring Syslog Buffer Parameters Using the Web Management Interface on page A-7. NOTE: You can specify a server name only if you have already configured the DNS Resolver feature. See the Configuring IP chapter in the Advanced Configuration and Management Guide. Specifying an Additional Syslog Server USING THE CLI To specify an additional Syslog server, enter the logging <ip-addr> command again, as in the following example. You can specify up to six Syslog servers. HP9300(config)# logging Syntax: logging <ip-addr> <server-name> USING THE WEB MANAGEMENT INTERFACE See the section Displaying and Configuring Syslog Buffer Parameters Using the Web Management Interface on page A-7. A - 9

10 Installation and Basic Configuration Guide Disabling Logging of a Message Level To change the message level, disable logging of specific message levels. You must disable the message levels on an individual basis. USING THE CLI For example, to disable logging of debugging and informational messages, enter the following commands: HP9300(config)# no logging buffered debugging HP9300(config)# no logging buffered informational Syntax: [no] logging buffered <level> <num-entries> The <level> parameter can have one of the following values: alerts critical debugging emergencies errors informational notifications warnings The commands in the example above change the log level to notification messages or higher. The software will not log informational or debugging messages. The changed message level also applies to the Syslog servers. USING THE WEB MANAGEMENT INTERFACE See the section Displaying and Configuring Syslog Buffer Parameters Using the Web Management Interface on page A-7. Changing the Number of Entries the Local Buffer Can Hold You also can use the logging buffered command to change the number of entries the local Syslog buffer can store. For example: HP9300(config)# logging buffered 100 The default number of messages is 50. The value can be from The change takes effect immediately and does not require you to reload the software. USING THE WEB MANAGEMENT INTERFACE See the section Displaying and Configuring Syslog Buffer Parameters Using the Web Management Interface on page A-7. NOTE: If you decrease the size of the buffer, the software clears the buffer before placing the change into effect. If you increase the size of the buffer, the software does not clear existing entries. Changing the Log Facility The Syslog daemon on the Syslog server uses a facility to determine where to log the messages from the HP The default facility for messages the HP device sends to the Syslog server is user. You can change the facility using the following command. NOTE: You can specify only one facility. If you configure the HP device to use two Syslog servers, the device uses the same facility on both servers. A - 10

11 Using Syslog HP9300(config)# logging facility local0 Syntax: logging facility <facility-name> The <facility-name> can be one of the following: kern kernel messages user random user-level messages mail mail system daemon system daemons auth security/authorization messages syslog messages generated internally by Syslog lpr line printer subsystem news netnews subsystem uucp uucp subsystem sys9 cron/at subsystem sys10 reserved for system use sys11 reserved for system use sys12 reserved for system use sys13 reserved for system use sys14 reserved for system use cron cron/at subsystem local0 reserved for local use local1 reserved for local use local2 reserved for local use local3 reserved for local use local4 reserved for local use local5 reserved for local use local6 reserved for local use local7 reserved for local use USING THE WEB MANAGEMENT INTERFACE See the section Displaying and Configuring Syslog Buffer Parameters Using the Web Management Interface on page A-7. Displaying the Interface Name in Syslog Messages By default, an interface s slot number (if applicable) and port number are displayed when you display Syslog messages. If you want to display the name of the interface instead of its number, enter the following command: HP9300(config)# ip show-portname This command is applied globally to all interfaces on Routing Switches. Syntax: [no] Ip show-portname When you display the messages in the Syslog, you see the interface name under the Dynamic Log Buffer section. The actual interface number is appended to the interface name. For example, if the interface name is "lab" and its port number is "2", you see "lab2" displayed as in the example below: A - 11

12 Installation and Basic Configuration Guide HP9300# show logging Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns) Buffer logging: level ACDMEINW, 3 messages logged level code: A=alert C=critical D=debugging M=emergency E=error I=informational N=notification W=warning Static Log Buffer: Dec 15 19:04:14:A:Fan 1, fan on right connector, failed Dynamic Log Buffer (50 entries): Dec 15 18:46:17:I:Interface ethernet Lab2, state up Dec 15 18:45:15:I:Warm start Clearing the Syslog Messages from the Local Buffer To clear the Syslog messages stored in the HP device s local buffer, use one of the following methods: USING THE CLI HP9300# clear logging Syntax: clear logging USING THE WEB MANAGEMENT INTERFACE To clear Syslog messages using the Web management interface, use the following procedure: 1. Log on to the device using a valid user name and password for read-write access. The System configuration panel is displayed. 2. Click on the plus sign next to Command in the tree view to display the command options. 3. Select the Clear link to display the Clear panel. 4. Click on the checkbox next to System Logging to place a checkmark in the box. 5. Click Apply to clear the log. Syslog Messages Table A.2 lists all of the Syslog messages. The messages are listed by message level, in the following order: Emergencies (none) Alerts Critical (none) Errors Warnings s A - 12

13 Using Syslog Debugging Table A.2: HP Syslog Messages Alert Power supply <num>, <location>, failed A power supply has failed. The <num> is the power supply number. The <location> describes where the failed power supply is in the chassis. The location can be one of the following: In 4-slot Chassis devices: left side power supply right side power supply In 8-slot Chassis devices: bottom power supply middle bottom power supply middle top power supply top power supply In 15-slot Chassis devices: Alert Fan <num>, <location>, failed A fan has failed. left side power supply second from left power supply second from right power supply right side power supply The <num> is the power supply number. The <location> describes where the failed power supply is in the chassis. The location can be one of the following: In 4-slot Chassis devices: left side panel, back fan left side panel, front fan rear/back panel, left fan rear/back panel, right fan In 8-slot and 15-slot Chassis devices: rear/back panel, top fan rear/back panel, bottom fan top panel, fan A - 13

14 Installation and Basic Configuration Guide Alert Alert Alert Management module at slot <slot-num> state changed from <module-state> to <module-state>. Temperature <degrees> C degrees, warning level <warn-degrees> C degrees, shutdown level <shutdown-degrees> C degrees <num-modules> modules and 1 power supply, need more power supply!! Indicates a state change in a management module. The <slot-num> indicates the chassis slot containing the module. The <module-state> can be one of the following: active standby crashed coming-up Indicates an overtemperature condition on the active module. The <degrees> value indicates the temperature of the module. The <warn-degrees> value is the warning threshold temperature configured for the module. The <shutdown-degrees> value is the shutdown temperature configured for the module. Indicates that the chassis needs more power supplies to run the modules in the chassis. The <num-modules> parameter indicates the number of modules in the chassis. Alert OSPF Memory Overflow OSPF has run out of memory. Alert OSPF LSA Overflow, LSA Type = <lsa-type> Indicates an LSA database overflow. The <lsa-type> parameter indicates the type of LSA that experienced the overflow condition. The LSA type is one of the following: 1 Router 2 Network 3 Summary 4 Summary 5 External Error No of prefixes received from BGP peer <ipaddr> exceeds maximum prefixlimit...shutdown The Routing Switch has received more than the specified maximum number of prefixes from the neighbor, and the Routing Switch is therefore shutting down its BGP4 session with the neighbor. A - 14

15 Using Syslog Warning Locked address violation at interface e<portnum>, address <mac-address> Indicates that a port on which you have configured a lock-address filter received a packet that was dropped because the packet s source MAC address did not match an address learned by the port before the lock took effect. The e<portnum> is the port number. The <mac-address> is the MAC address that was denied by the address lock. Assuming that you configured the port to learn only the addresses that have valid access to the port, this message indicates a security violation. Warning NTP server <ip-addr> failed to respond Indicates that a Simple Network Time Protocol (SNTP) server did not respond to the device s query for the current time. The <ip-addr> indicates the IP address of the SNTP server. Warning Warning Dup IP <ip-addr> detected, sent from MAC <mac-addr> interface <portnum> mac filter group denied packets on port <portnum> src macaddr <mac-addr>, <num> packets Indicates that the HP device received a packet from another device on the network with an IP address that is also configured on the HP The <ip-addr> is the duplicate IP address. The <mac-addr> is the MAC address of the device with the duplicate IP address. The <portnum> is the HP port that received the packet with the duplicate IP address. The address is the packet s source IP address. Indicates that a Layer 2 MAC filter group configured on a port has denied packets. The <portnum> is the port on which the packets were denied. The <mac-addr> is the source MAC address of the denied packets. The <num> indicates how many packets matching the values above were dropped during the five-minute interval represented by the log entry. A - 15

16 Installation and Basic Configuration Guide Warning Warning list <acl-num> denied <ip-proto> <src ip-addr> (<src-tcp/udp-port>) (Ethernet <portnum> <mac-addr>) -> <dst ip-addr> (<dst-tcp/udp-port>), 1 event(s) rip filter list <list-num> <direction> V1 V2 denied <ip-addr>, <num> packets Indicates that an Access Control List (ACL) denied (dropped) packets. The <acl-num> indicates the ACL number. Numbers 1 99 indicate standard ACLs. Numbers indicate extended ACLs. The <ip-proto> indicates the IP protocol of the denied packets. The <src ip-addr> is the source IP address of the denied packets. The <src-tcp/udp-port> is the source TCP or UDP port, if applicable, of the denied packets. The <portnum> indicates the port number on which the packet was denied. The <mac-addr> indicates the source MAC address of the denied packets. The <dst ip-addr> indicates the destination IP address of the denied packets. The <dst-tcp/udp-port> indicates the destination TCP or UDP port number, if applicable, of the denied packets. Indicates that a RIP route filter denied (dropped) packets. The <list-num> is the ID of the filter list. The <direction> indicates whether the filter was applied to incoming packets or outgoing packets. The value can be one of the following: in out The V1 or V2 value specifies the RIP version (RIPv1 or RIPv2). The <ip-addr> indicates the network number in the denied updates. The <num> indicates how many packets matching the values above were dropped during the five-minute interval represented by the log entry. A - 16

17 Using Syslog Warning No of prefixes received from BGP peer <ipaddr> exceeds warning limit <num> The Routing Switch has received more than the allowed percentage of prefixes from the neighbor. The <ip-addr> is the IP address of the neighbor. The <num> is the number of prefixes that matches the percentage you specified. For example, if you specified a threshold of 100 prefixes and 75 percent as the warning threshold, this message is generated if the Routing Switch receives a 76th prefix from the neighbor. Module was inserted to slot <slot-num> Indicates that a module was inserted into a chassis slot. The <slot-num> is the number of the chassis slot into which the module was inserted. Module was removed from slot <slot-num> Indicates that a module was removed from a chassis slot. The <slot-num> is the number of the chassis slot from which the module was removed. ACL insufficient L4 cam resource, using flow based ACL instead OSPF interface state changed, rid <router id>, intf addr <ip-addr>, state <ospf-state> The port does not have a large enough CAM partition for the ACLs. To re-partition the CAM, see the Changing CAM Partitions chapter in the Diagnostics Guide. Indicates that the state of an OSPF interface has changed. The <router id> is the router ID of the HP The <ip-addr> is the interface s IP address. The <ospf-state> indicates the state to which the interface has changed and can be one of the following: down loopback waiting point-to-point designated router backup designated router other designated router A - 17

18 Installation and Basic Configuration Guide OSPF virtual intf state changed, rid <router id>, area <area id>, nbr <ip-addr>, state <ospf-state> OSPF nbr state changed, rid <router id>, nbr addr <ip-addr>, nbr rid <nbr-router-id>, state <ospf-state> Indicates that the state of an OSPF virtual routing interface has changed. The <router id> is the router ID of the router the interface is on. The <area id> is the area the interface is in. The <ip-addr> is the IP address of the OSPF neighbor. The <ospf-state> indicates the state to which the interface has changed and can be one of the following: down loopback waiting point-to-point designated router backup designated router other designated router Indicates that the state of an OSPF neighbor has changed. The <router id> is the router ID of the HP The <ip-addr> is the IP address of the neighbor. The <nbr-router-id> is the router ID of the neighbor. The <ospf-state> indicates the state to which the interface has changed and can be one of the following: down attempt initializing 2-way exchange start exchange loading full A - 18

19 Using Syslog OSPF virtual nbr state changed, Indicates that the state of an OSPF virtual rid <router-id>, nbr addr <ip-addr>, neighbor has changed. nbr rid <nbr-router-id>, state <ospf-state> The <router-id> is the router ID of the HP The <ip-addr> is the IP address of the neighbor. The <nbr-router-id> is the router ID of the neighbor. The <ospf-state> indicates the state to which the interface has changed and can be one of the following: down attempt initializing 2-way exchange start exchange loading full A - 19

20 Installation and Basic Configuration Guide OSPF intf config error, rid <router-id>, Indicates that an OSPF interface intf addr <ip-addr>, configuration error has occurred. pkt src addr <src-ip-addr>, The <router-id> is the router ID of the HP error type <error-type>, pkt type <pkt-type> The <ip-addr> is the IP address of the interface on the HP The <src-ip-addr> is the IP address of the interface from which the HP device received the error packet. The <error-type> can be one of the following: bad version area mismatch NBMA neighbor virtual neighbor authentication type mismatch authentication failure network mask mismatch hello interval mismatch dead interval mismatch option mismatch The <packet-type> can be one of the following: hello database description link state request link state update link state ack A - 20

21 Using Syslog OSPF virtual intf config error, Indicates that an OSPF virtual routing rid <router-id>, intf addr <ip-addr>, interface configuration error has occurred. pkt src addr <src-ip-addr>, The <router-id> is the router ID of the HP error type <error-type>, pkt type <pkt-type> The <ip-addr> is the IP address of the interface on the HP The <src-ip-addr> is the IP address of the interface from which the HP device received the error packet. The <error-type> can be one of the following: bad version area mismatch NBMA neighbor virtual neighbor authentication type mismatch authentication failure network mask mismatch hello interval mismatch dead interval mismatch option mismatch The <packet-type> can be one of the following: hello database description link state request link state update link state ack A - 21

22 Installation and Basic Configuration Guide OSPF intf authen failure, rid <router-id>, Indicates that an OSPF interface intf addr <ip-addr>, authentication failure has occurred. pkt src addr <src-ip-addr>, The <router-id> is the router ID of the HP error type <error-type>, pkt type <pkt-type> The <ip-addr> is the IP address of the interface on the HP The <src-ip-addr> is the IP address of the interface from which the HP device received the authentication failure. The <error-type> can be one of the following: bad version area mismatch NBMA neighbor virtual neighbor authentication type mismatch authentication failure network mask mismatch hello interval mismatch dead interval mismatch option mismatch The <packet-type> can be one of the following: hello database description link state request link state update link state ack A - 22

23 Using Syslog OSPF virtual intf authen failure, Indicates that an OSPF virtual routing rid <router-id>, intf addr <ip-addr>, interface authentication failure has occurred. pkt src addr <src-ip-addr>, The <router-id> is the router ID of the HP error type <error-type>, pkt type <pkt-type> The <ip-addr> is the IP address of the interface on the HP The <src-ip-addr> is the IP address of the interface from which the HP device received the authentication failure. The <error-type> can be one of the following: bad version area mismatch NBMA neighbor virtual neighbor authentication type mismatch authentication failure network mask mismatch hello interval mismatch dead interval mismatch option mismatch The <packet-type> can be one of the following: hello database description link state request link state update link state ack A - 23

24 Installation and Basic Configuration Guide OSPF intf rcvd bad pkt, rid <router id>, intf addr <ip-addr>, pkt src addr <src ip-addr>, pkt type <pkt-type> OSPF virtual intf rcvd bad pkt, rid <router id>, intf addr <ip-addr>, pkt src addr <src ip-addr>, pkt type <pkt-type> Indicates that an OSPF interface received a bad packet. The <router id> is the router ID of the HP The <ip-addr> is the IP address of the interface on the HP The <src ip-addr> is the IP address of the interface from which the HP device received the authentication failure. The <packet-type> can be one of the following: hello database description link state request link state update link state ack Indicates that an OSPF interface received a bad packet. The <router id> is the router ID of the HP The <ip-addr> is the IP address of the interface on the HP The <src ip-addr> is the IP address of the interface from which the HP device received the authentication failure. The <packet-type> can be one of the following: hello database description link state request link state update link state ack A - 24

25 Using Syslog OSPF intf retransmit, rid <router-id>, An OSPF interface on the HP device has intf addr <ip-addr>, nbr rid <nbr-router-id>, retransmitted a Link State Advertisement pkt type is <pkt-type>, LSA type <lsa-type>, (LSA). LSA id <lsa-id>, LSA rid <lsa-router-id> The <router-id> is the router ID of the HP The <ip-addr> is the IP address of the interface on the HP The <nbr-router-id> is the router ID of the neighbor router. The <packet-type> can be one of the following: hello database description link state request link state update link state ack The <lsa-type> is the type of LSA. The <lsa-id> is the LSA ID. The <lsa-router-id> is the LSA router ID. A - 25

26 Installation and Basic Configuration Guide OSPF virtual intf retransmit, rid <router id>, intf addr <ip-addr>, nbr rid <nbr-router-id>, pkt type is <pkt-type>, LSA type <lsa-type>, LSA id <lsa id>, LSA rid <lsa-router-id> OSPF originate LSA, rid <router id>, area <area id>, LSA type <lsa-type>, LSA id <lsa id>, LSA router id <lsa-router-id> OSPF max age LSA, rid <router id>, area <area id>, LSA type <lsa-type>, LSA id <lsa id>, LSA rid <lsa-router-id> An OSPF interface on the HP device has retransmitted a Link State Advertisement (LSA). The <router id> is the router ID of the HP The <ip-addr> is the IP address of the interface on the HP The <nbr-router-id> is the router ID of the neighbor router. The <packet-type> can be one of the following: hello database description link state request link state update link state ack The <lsa-type> is the type of LSA. The <lsa-id> is the LSA ID. The <lsa-router-id> is the LSA router ID. An OSPF interface has originated an LSA. The <router id> is the router ID of the HP The <area id> is the OSPF area. The <lsa-type> is the type of LSA. The <lsa-id> is the LSA ID. The <lsa-router-id> is the LSA router ID. An LSA has reached its maximum age. The <router id> is the router ID of the HP The <area id> is the OSPF area. The <lsa-type> is the type of LSA. The <lsa-id> is the LSA ID. The <lsa-router-id> is the LSA router ID. A - 26

27 Using Syslog OSPF LSDB overflow, rid <router id>, limit <num> OSPF LSDB approaching overflow, rid <router id>, limit <num> OSPF intf rcvd bad pkt: Bad Checksum, rid <ip-addr>, intf addr <ip-addr>, pkt size <num>, checksum <num>, pkt src addr <ipaddr>, pkt type <type> OSPF intf rcvd bad pkt: Bad Packet type, rid <ip-addr>, intf addr <ip-addr>, pkt size <num>, checksum <num>, pkt src addr <ipaddr>, pkt type <type> OSPF intf rcvd bad pkt: Unable to find associated neighbor, rid <ip-addr>, intf addr <ip-addr>, pkt size <num>, checksum <num>, pkt src addr <ip-addr>, pkt type <type> A Link State Database Overflow (LSDB) condition has occurred. The <router id> is the router ID of the HP The <num> is the number of LSAs. The software is close to an LSDB condition. The <router id> is the router ID of the HP The <num> is the number of LSAs. The device received an OSPF packet that had an invalid checksum. The rid <ip-addr> is HP device s router ID. The intf addr <ip-addr> is the IP address of the HP interface that received the packet. The pkt size <num> is the number of bytes in the packet. The checksum <num> is the checksum value for the packet. The pkt src addr <ip-addr> is the IP address of the neighbor that sent the packet. The pkt type <type> is the OSPF packet type and can be one of the following: hello database description link state request link state update link state acknowledgement (indicates an invalid packet type) The device received an OSPF packet with an invalid type. The parameters are the same as for the Bad Checksum message. The pkt type <type> value is unknown, indicating that the packet type is invalid. The neighbor IP address in the packet is not on the HP device s list of OSPF neighbors. The parameters are the same as for the Bad Checksum message. A - 27

28 Installation and Basic Configuration Guide OSPF intf rcvd bad pkt: Invalid packet size, rid <ip-addr>, intf addr <ip-addr>, pkt size <num>, checksum <num>, pkt src addr <ipaddr>, pkt type <type> VRRP intf state changed, intf <portnum>, vrid <virtual-router-id>, state <vrrp-state> The device received an OSPF packet with an invalid packet size. The parameters are the same as for the Bad Checksum message. A state change has occurred in a Virtual Router Redundancy Protocol (VRRP) interface. The <portnum> is the port. The <virtual-router-id> is the virtual router ID (VRID) configured on the interface. The <vrrp-state> can be one of the following: init master backup BGP Peer <ip-addr> UP (ESTABLISHED) Indicates that a BGP4 neighbor has come up. The <ip-addr> is the IP address of the neighbor s BGP4 interface with the HP BGP Peer <ip-addr> DOWN (IDLE) Indicates that a BGP4 neighbor has gone down. The <ip-addr> is the IP address of the neighbor s BGP4 interface with the HP Local ICMP exceeds <burst-max> burst packets, stopping for <lockup> seconds!! Local TCP exceeds <burst-max> burst packets, stopping for <lockup> seconds!! The number of ICMP packets exceeds the <burst-max> threshold set by the ip icmp burst command. The HP device may be the victim of a Denial of Service (DoS) attack. All ICMP packets will be dropped for the number of seconds specified by the <lockup> value. When the lockup period expires, the packet counter is reset and measurement is restarted. The number of TCP SYN packets exceeds the <burst-max> threshold set by the ip tcp burst command. The HP device may be the victim of a TCP SYN DoS attack. All TCP SYN packets will be dropped for the number of seconds specified by the <lockup> value. When the lockup period expires, the packet counter is reset and measurement is restarted. A - 28

29 Using Syslog Transit ICMP in interface <portnum> exceeds <num> burst packets, stopping for <num> seconds!! Local TCP exceeds <num> burst packets, stopping for <num> seconds!! Transit TCP in interface <portnum> exceeds <num> burst packets, stopping for <num> seconds!! DOT1X issues software but not physical port up indication of Port <portnum> to other software applications DOT1X issues software but not physical port down indication of Port <portnum> to other software applications Threshold parameters for ICMP transit (through) traffic have been configured on an interface, and the maximum burst size for ICMP packets on the interface has been exceeded. The <portnum> is the port number. The first <num> is the maximum burst size (maximum number of packets allowed). The second <num> is the number of seconds during which additional ICMP packets will be blocked on the interface. Note: This message can occur in response to an attempted Smurf attack. Threshold parameters for local TCP traffic on the device have been configured, and the maximum burst size for TCP packets has been exceeded. The first <num> is the maximum burst size (maximum number of packets allowed). The second <num> is the number of seconds during which additional TCP packets will be blocked on the Note: This message can occur in response to an attempted TCP SYN attack. Threshold parameters for TCP transit (through) traffic have been configured on an interface, and the maximum burst size for TCP packets on the interface has been exceeded. The <portnum> is the port number. The first <num> is the maximum burst size (maximum number of packets allowed). The second <num> is the number of seconds during which additional TCP packets will be blocked on the interface. Note: This message can occur in response to an attempted TCP SYN attack. The device has indicated that the specified port has been authenticated, but the actual port may not be active. The device has indicated that the specified is no longer authorized, but the actual port may still be active. Cold start The device has been powered on. A - 29

30 Installation and Basic Configuration Guide Warm start The system software (flash code) has been reloaded. <user-name> login to USER EXEC mode A user has logged into the USER EXEC mode of the CLI. The <user-name> is the user name. <user-name> logout from USER EXEC mode A user has logged out of the USER EXEC mode of the CLI. The <user-name> is the user name. <user-name> login to PRIVILEGED mode A user has logged into the Privileged EXEC mode of the CLI. The <user-name> is the user name. <user-name> logout from PRIVILEGED mode A user has logged out of Privileged EXEC mode of the CLI. The <user-name> is the user name. SNMP Auth. failure, intruder IP: <ip-addr> A user has tried to open a management session with the device using an invalid SNMP community string. Interface <portnum>, state up A port has come up. The <ip-addr> is the IP address of the host that sent the invalid community string. The <portnum> is the port number. Interface <portnum>, state down A port has gone down. The <portnum> is the port number. Interface <portnum>, line protocol up The line protocol on a port has come up. The <portnum> is the port number. Interface <portnum>, line protocol down The line protocol on a port has gone down. The <portnum> is the port number. Trunk group (<ports>) created by 802.3ad link-aggregation module. Bridge root changed, vlan <vlan id>, new root ID <string>, root interface <portnum> 802.3ad link aggregation is configured on the device, and the feature has dynamically created a trunk group (aggregate link). The <ports> is a list of the ports that were aggregated to make the trunk group. A Spanning Tree Protocol (STP) topology change has occurred. The <vlan id> is the ID of the VLAN in which the STP topology change occurred. The <root id> is the STP bridge root ID. The <portnum> is the number of the port connected to the new root bridge. A - 30

31 Using Syslog Bridge is new root, vlan <vlan id>, root ID <root id> Bridge topology change, vlan <vlan id>, interface <portnum>, changed state to <stp-state> startup-config was changed or startup-config was changed by <user-name> vlan <vlan id> interface <portnum> Bridge TC Event (DOT1wTransition) vlan <vlan id> interface <portnum> STP state -> <state> (DOT1wTransition) vlan <vlan id> New RootPort <portnum> (RootSelection) vlan <vlan id> New RootBridge <macaddress> RootPort <portnum> (BpduRcvd) vlan <vlan id> Bridge is RootBridge <macaddress> (MgmtPriChg) vlan <vlan id> Bridge is RootBridge <macaddress> (MsgAgeExpiry) A Spanning Tree Protocol (STP) topology change has occurred, resulting in the HP device becoming the root bridge. The <vlan id> is the ID of the VLAN in which the STP topology change occurred. The <root id> is the STP bridge root ID. A Spanning Tree Protocol (STP) topology change has occurred on a port. The <vlan id> is the ID of the VLAN in which the STP topology change occurred. The <portnum> is the port number. The <stp-state> is the new STP state and can be one of the following: disabled blocking listening learning forwarding A configuration change was saved to the startup-config file. The <user-name> is the user s ID, if they entered a user ID to log in W recognized a topology change event in the bridge. The topology change event is the forwarding action that started on a nonedge Designated port or Root port W changed the state of a port to a new state: forwarding, learning, blocking. If the port changes to blocking, the bridge port is in discarding state W changed the port s role to Root port, using the root selection computation W selected a new root bridge as a result of the BPDUs received on a bridge port W changed the current bridge to be the root bridge of the given topology due to administrative change in bridge priority. The message age expired on the Root port so 802.1W changed the current bridge to be the root bridge of the topology. A - 31

32 Installation and Basic Configuration Guide DOT1X: Port <portnum>, AuthControlledPortStatus change: authorized DOT1X: Port <portnum>, AuthControlledPortStatus change: unauthorized DOT1X: Port <portnum> currently used vlanid changes to <vlan id> due to dot1x RADIUS vlan assignment The status of the interface s controlled port has changed from unauthorized to authorized. The status of the interface s controlled port has changed from authorized to unauthorized. A user has completed 802.1X authentication. The profile received from the RADIUS server specifies a VLAN ID for the user. The port to which the user is connected has been moved to the VLAN indicated by <vlan id>. DOT1X: Port <portnum> currently used vlanid is set back to port default vlan id <vlan id> The user connected to <portnum> has disconnected, causing the port to be moved back into its default VLAN, <vlan id>. Debug BGP4: Not enough memory available to run BGP4 The device could not start the BGP4 routing protocol because there is not enough memory available. Debug DOT1X: Not enough memory There is not enough system memory for 802.1X authentication to take place. Contact HP Technical Support. A - 32