Appliance Logging and Debugging

To configure remote syslog to send syslog messages to a remote syslog server:

  1. Set remote syslog server.

    Copy
    Copied!
                

    gateway (config) # logging <IP address/hostname>

  2. (Optional) Set the destination port of the remote host.

    Copy
    Copied!
                

    gateway (config) # logging <IP address/hostname> port <port>

  3. (Optional) Filter log messages according to an input regex. Run:

    Copy
    Copied!
                

    gateway (config) # logging <IP address/hostname> filter <"include"/"exclude"> <regex>

  4. Set the minimum severity of the log level to info.

    Copy
    Copied!
                

    gateway (config) # logging <IP address/hostname> trap info

  5. Override the log levels on a per-class basis.

    Copy
    Copied!
                

    gateway (config) # logging <IP address/hostname> trap override class <class name> priority <level>

A feature that provides the ability to choose the protocol to use for sending syslog messages to a remote host: UDP (default) or TCP.

logging

logging <IPv4 address/hostname>

Sends log messages to the remote host specified by its IP or hostname

The no form of the command stops sending log messages to the remote host specified by its IP or hostname.

Syntax Description

N/A

Default

N/A

Configuration Mode

config

History

8.0.0100

Role

admin

Example

gateway (config) # logging 1.1.1.1
gateway (config) # no logging 1.1.1.1

Related Commands

Notes

This command is configurable. If “configuration write” is executed, the remote host will still receive messages after reload.

logging port

logging <syslog IPv4 address/hostname> port <destination-port>
no logging <syslog IPv4 address/hostname> port

Configures remote server destination port for log messages.
The no form of the command resets the remote log port to its default value.

Syntax Description

destination-port

Range: 1-65535

Hostname

Max 64 characters

Default

514 (UDP)

Configuration Mode

config

History

8.0.0100

Example

gateway (config) # logging 10.0.0.1 port 105

Related Commands

logging <syslog IPv4 address/hostname> trap

Notes

logging trap

logging <syslog IPv4 address/hostname> [trap {<log-level> | override class <class> priority <log-level>}]
no logging <syslog IPv4 address/hostname> [trap {<log-level> | override class <class> priority <log-level>}]

Enables (by setting the syslog IPv4 address/hostname) sending logging messages, with ability to filter the logging messages according to their classes.
The no form of the command stops sending messages to the remote syslog server.

Syntax Description

syslog IPv4 address/hostname

syslog IPv4 address/hostname of the remote syslog server
Hostname is limited to 64 characters

log-level

  • none—disables the logging locally and remotely

  • 0—emerg—system is unusable (emergency)

  • 1—alert—alert notification, action must be taken immediately

  • 2—crit—critical condition

  • 3—err—error condition

  • 4—warning—warning condition

  • 5—notice—normal, but significant condition

  • 6—info—informational condition

  • 7—debug—debug level messages

class

Sets or removes a per-class override on the logging level. All classes which do not have an override set will use the global logging level set with “logging local <log level>”. Classes that do have an override will do as the override specifies. If “none” is specified for the log level, the software will not log anything from this class. Classes available:

  • mgmt-back—system management back-end

  • mgmt-core—system management core

  • mgmt-front—system management front-end

Default

Remote logging is disabled

Configuration Mode

config

History

8.0.0100

Example

gateway (config) # logging local info

Related Commands

show logging
logging local override
logging <syslog IPv4 address/hostname> port

Notes

logging debug-files

logging debug-files {delete {current | oldest} | rotation {criteria | force | max-num} | update {<number> | current} | upload <log-file> <upload URL>}
no logging debug-files rotation criteria

Configures settings for debug log files.
The "logging debug-files rotation criteria" command removes the debug rotation criteria configuration.

Syntax Description

delete {current | oldest}

Deletes certain debug-log files.

  • current—deletes the current active debug-log file

  • oldest—deletes some of the oldest debug-log files

rotation {criteria {frequency {daily | weekly | monthly} | size <size> | size-pct <percentage>} | force | max-num}

Configures automatic rotation of debug-logging files.

  • criteria—sets how the system decides when to rotate debug files

    • frequency—rotate log files on a fixed time-based schedule

    • size—rotate log files when they pass a size threshold in megabytes

    • size-pct—rotate logs when they surpass a specified percentage of disk

  • forces—forces an immediate rotation of the log files

  • max-num—specifies the maximum number of old log files to keep

update {<number> | current}

Uploads a local debug-log file to a remote host.

  • current—uploads log file “messages” to a remote host

  • number—uploads compressed log file “debug.<number>.gz” to a remote host. Range is 1-10.

upload

Uploads debug log file to a remote host

log-file

Possible values: 1-7, or current

upload URL

Supported formats: HTTP, HTTPS, FTP, TFTP, SCP and SFTP (e.g.: scp://username[:password]@hostname/path/filename)

Default

N/A

Configuration Mode

config

History

8.0.0100

Example

gateway (config) # logging debug-files delete current

Related Commands

Notes

logging fields

logging fields seconds {enable | fractional-digits <f-digit> | whole-digits <w-digit>}
no logging fields seconds {enable | fractional-digits <f-digit> | whole-digits <w-digit>}

Specifies whether to include an additional field in each log message that shows the number of seconds since the Epoch or not.
The no form of the command disallows including an additional field in each log message that shows the number of seconds since the Epoch.

Syntax Description

enable

Specifies whether to include an additional field in each log message that shows the number of seconds since the Epoch or not.

f-digit

The fractional-digits parameter controls the number of digits to the right of the decimal point. Truncation is done from the right.
Possible values are: 1, 2, 3, or 6.

w-digit

The whole-digits parameter controls the number of digits to the left of the decimal point. Truncation is done from the left. Except for the year, all of these digits are redundant with syslog's own date and time.
Possible values: 1, 6, or all.

Default

Disabled

Configuration Mode

config

History

8.0.0100

Example

gateway (config) # logging fields seconds enable
gateway (config) # logging fields seconds whole-digits 1

Related Commands

show logging

Notes

This is independent of the standard syslog date and time at the beginning of each message in the format of “July 15 18:00:00”. Aside from indicating the year at full precision, its main purpose is to provide subsecond precision.

logging files delete

logging files delete {current | oldest [<number of files>]}

Deletes the current or oldest log files.

Syntax Description

current

Deletes current log file

oldest

Deletes oldest log file

number of files

Sets the number of files to be deleted

Default

CLI commands and audit message are set to notice logging level

Configuration Mode

config

History

8.0.0100

Example

gateway (config) # logging files delete current

Related Commands

show logging
show log files

Notes

logging files rotation

logging files rotation {criteria {frequency <freq> | size <size-mb>| size-pct <size-percentage>} | force | max-number <number-of-files>}
no logging files rotation criteria

Sets the rotation criteria of the logging files.
The no form of the command removes the rotation criteria configuration.

Syntax Description

freq

Sets rotation criteria according to time. Possible options are:

  • Daily

  • Weekly

  • Monthly

size-mb

Sets rotation criteria according to size in megabytes
Range: 1-9999
Default: 20MB

size-percentage

Sets rotation criteria according to size in percentage of the partition where the logging files are kept in. The percentage given is truncated to three decimal points (thousandths of a percent).

force

Forces an immediate rotation of the log files. This does not affect the schedule of auto-rotation if it was done based on time: the next automatic rotation will still occur at the same time for which it was previously scheduled. Naturally, if the auto-rotation was based on size, this will delay it somewhat as it reduces the size of the active log file to zero.

number-of-files

The number of log files will be kept. If the number of log files ever exceeds this number (either at rotation time, or when this setting is lowered), the system will delete as many files as necessary to bring it down to this number, starting with the oldest.

Default

10 files are kept by default with rotation criteria of 5% of the log partition size

Configuration Mode

config

History

8.0.0100

Example

gateway (config) # logging files rotation criteria size-pct 6

Related Commands

show logging
show log files

Notes

logging files upload

logging files upload {current | <file-number>} <url>

Uploads a log file to a remote host.

Syntax Description

current

The current log file. The current log file will have the name “messages” if you do not specify a new name for it in the upload URL.

file-number

An archived log file. The archived log file will have the name “messages<n>.gz” (while “n” is the file number) if you do not specify a new name for it in the upload URL. The file will be compressed with gzip.

url

Uploads URL path. Supported formats: FTP, TFTP, SCP, and SFTP. For example: scp://username[:password]@hostname/path/filename.

Default

10 files are kept by default with rotation criteria of 5% of the log partition size

Configuration Mode

config

History

8.0.0100

Example

gateway (config) # logging files upload 1 scp://admin@scpserver

Related Commands

show logging
show log files

Notes

logging filter include

logging <IP address/hostname> filter include <regex>

Sends only log messages that match the input regex to a remote host specified by its IP or hostname.

Syntax Description

N/A

Default

N/A

Configuration Mode

config

History

8.0.0100

Role

admin

Example

gateway (config) # logging 1.1.1.1 filter include ERROR

Related Commands

loggin

Notes

This command is configurable. If “configuration write” is executed, the remote host will still receive filtered messages after reload.

logging filter exclude

logging <IP address/hostname> filter exclude <regex>

Sends only log messages that do not match the input regex to a remote host specified by its IP or hostname.

Syntax Description

N/A

Default

N/A

Configuration Mode

config

History

8.0.0100

Role

admin

Example

gateway (config) # logging 1.1.1.1 filter exclude ERROR

Related Commands

logging

Notes

This command is configurable. If “configuration write” is executed, the remote host will still receive filtered messages after reload.

no logging filter

no logging <IP address/hostname> filter

Sends unfiltered log messages to the configured remote host.

Syntax Description

N/A

Default

N/A

Configuration Mode

config

History

8.0.0100

Role

admin

Example

gateway (config) # no logging 1.1.1.1 filter

Related Commands

logging

Notes

This command is configurable. If “configuration write” is executed, the remote host will still receive filtered messages after reload.

logging format

logging format {standard | welf [fw-name <hostname>]}
no logging format {standard | welf [fw-name <hostname>]}

Sets the format of the logging messages.
The no form of the command resets the format to its default.

Syntax Description

standard

Standard format

welf

WebTrends Enhanced Log file (WELF) format

fw-name

Firewall name used in WELF messages

hostname

Specifies the firewall hostname that should be associated with each message logged in WELF format. If no firewall name is set, the hostname is used by default. Hostname is limited to 64 characters.

Default

standard

Configuration Mode

config

History

8.0.0100

Example

gateway (config) # logging format standard

Related Commands

show logging

Notes

logging level

logging level {cli commands <log-level> | audit mgmt <log-level>}

Sets the severity level at which CLI commands or the management audit message that the user executes are logged. This includes auditing of both configuration changes and actions.

Syntax Description

cli commands

Sets the severity level at which CLI commands which the user executes are logged.

audit mgmt

Sets the severity level at which all network management audit messages are logged.

log-level

  • none—disables the logging locally and remotely

  • 0—emerg—system is unusable (emergency)

  • 1—alert—alert notification, action must be taken immediately

  • 2—crit—critical condition

  • 3—err—error condition

  • 4—warning—warning condition

  • 5—notice—normal, but significant condition

  • 6—info—informational condition

  • 7—debug—debug level messages

Default

CLI commands and audit message are set to notice logging level

Configuration Mode

config

History

8.0.0100

Example

gateway (config) # logging level cli commands info

Related Commands

show logging

Notes

logging local override

logging local override [class <class> priority <log-level>]
no logging local override [class <class> priority <log-level>]

Enables class-specific overrides to the local log level.
The no form of the command disables all class-specific overrides to the local log level without deleting them from the configuration, but disables them so that the logging level for all classes is determined solely by the global setting.

Syntax Description

override

Enables class-specific overrides to the local log level.

class

Sets or removes a per-class override on the logging level. All classes which do not have an override set will use the global logging level set with “logging local <log level>”. Classes that do have an override will do as the override specifies. If “none” is specified for the log level, the software will not log anything from this class.

Classes available:

  • mgmt-back—system management back-end components

  • mgmt-core—system management core

  • mgmt-front—system management front-end components

log-level

  • none—disables the logging locally and remotely

  • 0—emerg—system is unusable (emergency)

  • 1—alert—alert notification, action must be taken immediately

  • 2—crit—critical condition

  • 3—err—error condition

  • 4—warning—warning condition

  • 5—notice—normal, but significant condition

  • 6—info—informational condition

  • 7—debug—debug level messages

Default

Override is disabled

Configuration Mode

config

History

8.0.0100

Example

gateway (config) # logging local override class mgmt-front priority warning

Related Commands

show logging
logging local

Notes

logging protocol

logging <IP address\hostname> protocol [tcp|udp]
no logging <IP address\hostname> protocol

Sends log messages to specified host with the chosen protocol (TCP or UDP).
The no form of the command sets the protocol for sending log messages to a remote host to the default (UDP).

Syntax Description

tcp

Sets protocol to TCP

udp

Sets protocol to UDP

Default

UDP

Configuration Mode

Configure terminal

History

8.0.0100

Role

Admin

Example

gateway (config) # logging 1.1.1.1 protocol tcp
gateway (config) # no logging 1.1.1.1 protocol


Related Commands

Notes

This command is configurable, so if “configuration write” is executed then after reboot the remote host will still receive messages with the configured protocol.

logging receive

logging receive
no logging receive

Enables receiving logging messages from a remote host.
The no form of the command disables the option of receiving logging messages from a remote host.

Syntax Description

N/A

Default

Receiving logging is disabled

Configuration Mode

config

History

8.0.0100

Example

gateway (config) # logging receive

Related Commands

show logging
logging local
logging local override

Notes

  • This does not log to the console TTY port

  • In-band management should be enabled in order to open a channel from the host to the CPU

  • If enabled, only log messages matching or exceeding the minimum severity specified with the “logging local” command will be logged, regardless of what is sent from the remote host

show log

show log [continuous | files [<file-number>]] [[not] matching <reg-exp>]

Displays the log file with optional filter criteria.

Syntax Description

continues

Displays the last few lines of the current log file and then continues to display new lines as they come in until the user hits Ctrl+C, similar to LINUX “tail” utility.

files

Displays the list of log files.

<file-number>

Displays an archived log file, where the number may range from 1 up to the number of archived log files available.

[not] matching <reg-exp>

The file is piped through a LINUX “grep” utility to only include lines either matching, or not matching, the provided regular expression.

Default

N/A

Configuration Mode

Any command mode

History

8.0.0100

Example

gateway (config) # show log matching "Executing|Action"

Jul 31 16:11:23 M2100-aj cli[26502]: [cli.NOTICE]: user : Executing command: enable
Jul 31 16:11:24 M2100-aj cli[26507]: [cli.NOTICE]: user : Executing command: enable
Jul 31 16:11:29 M2100-aj cli[26514]: [cli.NOTICE]: user : Executing command: enable
Jul 31 16:11:29 M2100-aj cli[26514]: [cli.NOTICE]: user : Executing command: show license
Jul 31 16:11:41 M2100-aj cli[26548]: [cli.NOTICE]: user : Executing command: enable
Jul 31 16:11:42 M2100-aj cli[26553]: [cli.NOTICE]: user : Executing command: enable
Jul 31 16:11:42 M2100-aj cli[26553]: [cli.NOTICE]: user : Executing command: conf termina

Related Commands

logging fields
logging files rotation
logging level
logging local
logging receive
show logging

Notes

  • When using a regular expression containing | (OR), the expression should be surrounded by quotes (“<expression>”), otherwise it is parsed as filter (PIPE) command

  • The command’s output has many of the options as the Linux “less” command. These options allow navigating the log file and perform searches. To see help for different option press “h” after running the “show log” command.

show logging

show logging

Displays the logging configurations.

Syntax Description

N/A

Default

N/A

Configuration Mode

Any command mode

History

8.0.0100

Example

gateway (config) # show logging
Local logging level                       : notice
Override for class debug-module : notice
Default remote logging level : notice
Allow receiving of messages from remote hosts: no
Number of archived log files to keep : 10
Log rotation size threshold : 19.07 megabytes
Log rotation (debug) size threshold : 19.07 megabytes
Log format : standard
Subsecond timestamp field : disabled
MAC address masking : enabled

Levels at which messages are logged:
CLI commands : notice
Audit messages: notice

Remote syslog servers:
1.1.1.1:
log level : notice
Remote port : 514
Filter [include] regex: err

  1.2.2.3:
log level : notice
Remote port: 33

Related Commands

logging fields
logging files rotation
logging level
logging local
logging receive
logging <syslog IPv4 address/hostname>

Notes

show logging port

show logging port

Displays the port logging configurations.

Syntax Description

N/A

Default

N/A

Configuration Mode

Any command mode

History

8.0.0100

Example

gateway (config) # show logging port
Local logging level: notice 
Override for class debug-module: notice
Default remote logging level: notice
Remote syslog receiver: 1.2.3.4 (log level: notice)
Remote port: 514

Related Commands

logging port

Notes

show log debug

show log debug [continuous | files | matching | not]

Displays current event debug-log file in a scrollable pager.

Syntax Description

continuous

Displays new event log messages as they arrive

files

Displays archived debug log files

matching

Displays event debug logs that match a given regular expression

not

Displays event debug logs that do not meet certain criteria

Default

N/A

Configuration Mode

Any command mode

History

8.0.0100

Example

gateway (config) # show log debug
May 26 12:17:21 gateway cli[14941]: [cli.DEBUG]: user admin: cli_parse_one_level: word=show, 70 children, 0 cmds, unavail=0
May 26 12:17:21 gateway cli[14941]: [cli.DEBUG]: user admin: cli_match_one_word: err=0 word=show unavail=0 num_cmds=2722
May 26 12:17:21 gateway cli[14941]: [cli.DEBUG]: user admin: cli_parse_one_level: word=log, 43 children, 2722 cmds, unavail=0
May 26 12:17:21 gateway cli[14941]: [cli.DEBUG]: user admin: cli_match_one_word: err=0 word=log unavail=0 num_cmds=2722
May 26 12:17:21 gateway cli[14941]: [cli.DEBUG]: user admin: cli_match_one_word: err=0 word=log unavail=0 num_cmds=2722
May 26 12:17:21 gateway cli[14941]: [cli.DEBUG]: user admin: cli_parse_one_level: word=debug, 6 children, 2722 cmds, unavail=0
May 26 12:17:21 gateway cli[14941]: [cli.DEBUG]: user admin: cli_match_one_word: err=0 word=debug unavail=0 num_cmds=2722
May 26 12:17:21 gateway cli[14941]: [cli.DEBUG]: user admin: pipe() returned read fd 9 and write fd 10 for llc_failure_pipe
May 26 12:17:21 gateway cli[14941]: [cli.DEBUG]: user admin: libevent: in lew_event_delete(0x260f150)
May 26 12:17:21 gateway cli[14941]: [cli.DEBUG]: user admin: libevent: dooming event 0x260f150

Related Commands

Notes

© Copyright 2023, NVIDIA. Last updated on May 23, 2023.