Event Logging System Messages Guide

Introduction

This chapter describes how events are logged and how to interpret messages. Also described are the concepts of subsystem, event number, and logging level. A large part of the ELS functionality is based on commands that use the subsystem, event number, and logging levels as parameters.

Message Presentation

The format of the message explanations in this guide is as follows:

Level:

Describes the logging level of the error message.

Short Syntax:

Shows the message that is displayed on the router console. This is a compressed form of the message.

Long Syntax:

Shows the expanded text of the message.

Description:

Explains the meaning of the error message.

Cause:

Describes possible causes of the error that caused this message.

Action:

Specifies possible action to correct the error.

Causes of Events

Events monitored by the Event Logging System (ELS) occur continuously while the router is operating. Any of the following reasons can cause them.

• System activity
• Status changes
• Service requests
• Data transmission and reception
• Data and internal errors

When an event occurs, ELS receives data from the system that identifies the source and nature of the event. Then, ELS generates a message that uses the data received as part of the message.

Interpreting a Message

This section describes how to interpret a message generated by ELS. Figure 1 shows the principal elements of a message and Message Description describes the elements.

Figure 1. Elements of a Message

Message Element

Meaning

Subsystem

Subsystem is an abbreviation for a router component such as a protocol, packet forwarder, or interface. In Figure 1, GW identifies the subsystem (gateway) through which this event occurred.

Examples of subsystems include ARP, IP, TKR, and X.25. On a router, the subsystems depend on the hardware and software configured for that router.

You can use the ELS list subsystem command to list the subsystems that are configured on your router.

Event Number

Event Number is a number that is assigned to each message within a subsystem. In Figure 1, the event number is 19 (within the GW subsystem).

The event number always appears with the subsystem abbreviation, for example, GW.019. The subsystem and event number together identify an individual event.

You can use the ELS list subsystem command to list the event within a subsystem.

Logging Level

Logging Level is a field that classifies each message by the type of event that generated it. Logging levels are as follows:

Logging Level

Type

UI - ERROR

Unusual internal errors

CI - ERROR

Common internal errors

UE - ERROR

Unusual external errors

CE - ERROR

Common external errors

ERROR

Includes all error levels above

U-INFO

Unusual Informational comment

C-INFO

Common Informational comment

INFO

Includes all comment levels above

STANDARD

Includes all error levels and all comment levels (default)

P-TRACE

Per packet trace

U-TRACE

Unusual operation packet trace message

C-TRACE

Common operation packet trace message

TRACE

Includes all trace levels above

ALL

Includes all logging levels

Message Text

Message text appears on the console screen in short form. In the sections that follow, variables such as source_address or network are replaced with actual data when the message displays on the console. These and other variables are replaced in the message text.

The variable error_code appearing in the message description (usually preceded by "rsn" or "reason") indicates the type of packet error detected. The next section describes the error and packet completion codes.

Code

Meaning

0

Packet successfully queued for output

1

Random, unidentified error

2

Packet not queued for output due to flow control reasons

3

Packet not queued because network is down

4

Packet not queued to avoid looping or bad broadcast

5

Packet not queued because destination host is down (only on networks where this can be detected)

When you send out an SNMP query, the response you get from the router is usually a 12-digit number, such as 1.3.6.1.4.1.1.1.3.4.85.31. This number refers to various information regarding your query, such as the ELS operating number (1.3.6.1.4.1.1.1.3), the object (.4), the ELS subsystem number (.85), and the event number (.31). For example, the eleventh digit, .85, is the numerical equivalent to the subsystem element X.25. The following list describes the subsystem numerical equivalents.

Subsystem	Numeric Equivalent		Subsystem	Numeric Equivalent		Subsystem	Numeric Equivalent
AAA	189		AI	110		ALLC	141
AP2	53		APPN	117		ARP	5
ATM	115		BAN	111		BBCM	134
BGP	104		BGP6	224		BR	74
BRLY	198		BRS	3		BS	172
BTP	14		CAS	212		CEME	166
COMP	113		DBG	174		DFP	171
DGW	151		DHC6	204		DHCP	146
DIAL	163		DLS	107		DLS2	175
DN	25		DNAV	43		DOUT	144
DS	208		DVM	22		ENCR	148
ENV	112		ES	216		ESC	133
ESIS	41		ETH	81		EVL	126
EZ	109		FDDI	88		FLT	2
FR	92		FSD	170		GCOM	169
GW	1		ICM6	191		ICMP	11
IKE	210		ILEC	130		ILMI	119
IP	10		IPIF	203		IPPN	100
IPSP	159		IPV6	190		IPX	35
ISDN	99		ISIS	42		ISO	40
L2	162		LAG	214		LAPD	165
LCS	135		LEC	116		LECS	124
LES	123		LES2	176		LLC	103
LNM	102		LSA	136		LSI	155
MARS	128		MCF	105		MDM	206
MFC	18		MFC6	194		MLP	145
MMC	213		MPC	137		MPOA	156
NAT	167		NBS	114		NDP6	192
NDR	142		NHRP	131		NOT	127
PCA	161		PERF	200		PKI	215
PIM	196		PIM6	197		PLCY	209
PM	149		PPP	95		Q931	164
QLLC	152		R2MP	56		RED	225
RIP	15		RIP6	195		RMM	227
RSVP	138		RTRF	207		SAAL	120
SACM	168		SCSP	140		SDLC	90
SE	157		SEC	147		SEST	158
SL	83		SNH	173		SNMP	21
SPF	17		SRLY	75		SRT	72
SRTF	205		STP	73		SVC	121
SW	226		TCP	12		TFTP	19
TKR	84		TSDK	183		TSNC	180
TSNS	199		TSRC	181		TSRS	182
TSTD	178		UDP	13		UDP6	193
V25B	108		V34	143		VCRM	139
VLAN	150		VN	60		VOIC	211
VRRP	177		WEBC	201		WEBH	202
WRS	101		XN	30		X25	85
X251	96		X252	97		X253	98
XTP	132		ZIP2	54

Error and Packet Completion Codes

The console displays the following network information: nt 1 int Eth/0 or network 1, interface Eth/0 where:

• 1 is the network number (each network on the router is numbered sequentially from zero).
• 0 is the unit number (the interfaces on each hardware type are numbered sequentially from zero).

Ethernet and Token-Ring hardware addresses appear as a long hexadecimal number, such as X'020701003e2c'.

IP (Internet Protocol) addresses are printed as four decimal bytes separated by periods, such as 18.123.0.16.

IP Version 6 (IPv6) addresses are composed of 128 bits and are displayed as 8 sets of 4 hexadecimal numbers separated by colons, such as abcd:1234:0000:1234:5555:FFEE:7777:0123.