IBM Books

Event Logging System Messages Guide


Introduction

This chapter describes how events are logged and how to interpret messages. Also described are the concepts of subsystem, event number, and logging level. A large part of the ELS functionality is based on commands that use the subsystem, event number, and logging levels as parameters.


Message Presentation

The format of the message explanations in this guide is as follows:

Level:
Describes the logging level of the error message.

Short Syntax:
Shows the message that is displayed on the router console. This is a compressed form of the message.

Long Syntax:
Shows the expanded text of the message.

Description:
Explains the meaning of the error message.

Cause:
Describes possible causes of the error that caused this message.

Action:
Specifies possible action to correct the error.

Causes of Events

Events monitored by the Event Logging System (ELS) occur continuously while the router is operating. Any of the following reasons can cause them.

When an event occurs, ELS receives data from the system that identifies the source and nature of the event. Then, ELS generates a message that uses the data received as part of the message.


Interpreting a Message

This section describes how to interpret a message generated by ELS. Figure 1 shows the principal elements of a message and Message Description describes the elements.

Figure 1. Elements of a Message


elements of a message

Message Element
Meaning

Subsystem
Subsystem is an abbreviation for a router component such as a protocol, packet forwarder, or interface. In Figure 1, GW identifies the subsystem (gateway) through which this event occurred.

Examples of subsystems include ARP, IP, TKR, and X.25. On a router, the subsystems depend on the hardware and software configured for that router.

You can use the ELS list subsystem command to list the subsystems that are configured on your router.

Event Number
Event Number is a number that is assigned to each message within a subsystem. In Figure 1, the event number is 19 (within the GW subsystem).

The event number always appears with the subsystem abbreviation, for example, GW.019. The subsystem and event number together identify an individual event.

You can use the ELS list subsystem command to list the event within a subsystem.

Logging Level
Logging Level is a field that classifies each message by the type of event that generated it. Logging levels are as follows:

Logging Level
Type

UI - ERROR
Unusual internal errors

CI - ERROR
Common internal errors

UE - ERROR
Unusual external errors

CE - ERROR
Common external errors

ERROR
Includes all error levels above

U-INFO
Unusual Informational comment

C-INFO
Common Informational comment

INFO
Includes all comment levels above

STANDARD
Includes all error levels and all comment levels (default)

P-TRACE
Per packet trace

U-TRACE
Unusual operation packet trace message

C-TRACE
Common operation packet trace message

TRACE
Includes all trace levels above

ALL
Includes all logging levels

Message Text
Message text appears on the console screen in short form. In the sections that follow, variables such as source_address or network are replaced with actual data when the message displays on the console. These and other variables are replaced in the message text.

The variable error_code appearing in the message description (usually preceded by "rsn" or "reason") indicates the type of packet error detected. The next section describes the error and packet completion codes.

Code
Meaning

0
Packet successfully queued for output

1
Random, unidentified error

2
Packet not queued for output due to flow control reasons

3
Packet not queued because network is down

4
Packet not queued to avoid looping or bad broadcast

5
Packet not queued because destination host is down (only on networks where this can be detected)

When you send out an SNMP query, the response you get from the router is usually a 12-digit number, such as 1.3.6.1.4.1.1.1.3.4.85.31. This number refers to various information regarding your query, such as the ELS operating number (1.3.6.1.4.1.1.1.3), the object (.4), the ELS subsystem number (.85), and the event number (.31). For example, the eleventh digit, .85, is the numerical equivalent to the subsystem element X.25. The following list describes the subsystem numerical equivalents.
Subsystem Numeric Equivalent
Subsystem Numeric Equivalent
Subsystem Numeric Equivalent
AAA 189
AI 110
ALLC 141
AP2 53
APPN 117
ARP 5
ATM 115
BAN 111
BBCM 134
BGP 104
BR 74
BRLY 198
BRS 3
BS 172
BTP 14
CAS 212
CEME 166
CMGR 222
COMP 113
DBG 174
DFP 171
DGW 151
DHC6 204
DHCP 146
DIAL 163
DLS 107
DLS2 175
DN 25
DNAV 43
DOUT 144
DS 208
DVM 22
ENCR 148
ENV 112
ES 216
ESC 133
ESIS 41
ETH 81
EVL 126
EZ 109
FDDI 88
FLT 2
FR 92
FSD 170
GCOM 169
GKI 223
GW 1
H225 221
H245 220
H323 219
ICM6 191
ICMP 11
IKE 210
ILEC 130
ILMI 119
IP 10
IPIF 203
IPPN 100
IPSP 159
IPV6 190
IPX 35
ISDN 99
ISIS 42
ISO 40
L2 162
LAG 214
LAPD 165
LCS 135
LEC 116
LECS 124
LES 123
LES2 176
LLC 103
LNM 102
LSA 136
LSI 155
MARS 128
MCF 105
MDM 206
MFC 18
MFC6 194
MLP 145
MMC 213
MPC 137
MPOA 156
NAT 167
NBS 114
NDP6 192
NDR 142
NHRP 131
NOT 127
PCA 161
PERF 200
PKI 215
PIM 196
PIM6 197
PLCY 209
PM 149
PPP 95
Q931 164
QLLC 152
R2MP 56
RIP 15
RIP6 195
RSVP 138
RTP 218
RTRF 207
SAAL 120
SACM 168
SCSP 140
SDLC 90
SE 157
SEC 147
SEST 158
SL 83
SNH 173
SNMP 21
SPF 17
SRLY 75
SRT 72
SRTF 205
STP 73
SVC 121
TCP 12
TFTP 19
TKR 84
TSDK 183
TSNC 180
TSNS 199
TSRC 181
TSRS 182
TSTD 178
UDP 13
UDP6 193
V25B 108
V34 143
VCRM 139
VLAN 150
VN 60
VOIC 211
VOIP 217
VRRP 177
WEBC 201
WEBH 202
WRS 101
XN 30
X25 85
X251 96
X252 97
X253 98
XTP 132
ZIP2 54



Error and Packet Completion Codes

The console displays the following network information: nt 1 int Eth/0 or network 1, interface Eth/0 where:

Ethernet and Token-Ring hardware addresses appear as a long hexadecimal number, such as X'020701003e2c'.

IP (Internet Protocol) addresses are printed as four decimal bytes separated by periods, such as 18.123.0.16.

IP Version 6 (IPv6) addresses are composed of 128 bits and are displayed as 8 sets of 4 hexadecimal numbers separated by colons, such as abcd:1234:0000:1234:5555:FFEE:7777:0123.


[ Top of Page | Previous Page | Next Page | Table of Contents ]