Configure What Just Happened (WJH) Using CLI

By Default, NVIDIA® WHAT JUST HAPPENED® is enabled. If it is disabled, use the following command to enable it:

Copy
Copied!
            

switch (config) # what-just-happened <all | acl | forwarding | layer-1 | buffer> enable

Warning

In Spectrum systems, in order to enable buffer drop monitoring, one interface must be enabled as a recirculation port. For more information see Ethernet Interface Commands section.

To disable WJH via CLI use the “no” form of the command:

Copy
Copied!
            

switch (config) # no what-just-happened <all | acl | forwarding | layer-1 | buffer> enable

To display the WJH buffer of dropped packets use the "show what-just-happened" with/without options (detailed in the commands section).

Warning

Dropped packet events' display may have a delay of to up to 30 seconds due to a predefined hardware polling interval.

To manually clear WJH buffer use the following command:

Copy
Copied!
            

switch (config) # clear what-just-happened <all | acl | forwarding | layer-1 | buffer>

To display the WJH aggregation record, use the "show what-just-happened aggregated" with options (detailed in the commands section).

Warning

Note that due to hardware polling timing issues, it may be possible to observe dropped packet events that occurred shortly before the clear command was executed.

To automatically generate a WJH PCAP file as a result of discards, the following configuration is required. The value of <sec> determines how often the system checks whether a pcap should be generated. For example, if you enter a value of 300, up to 5 minutes may elapse between the discarding of packets and the creation of the pcap file.

Copy
Copied!
            

switch (config) # what-just-happened auto-export all enable switch (config) # logging events what-just-happened-packets enable switch (config) # logging events what-just-happened-packets interval <sec>

To see what pcap files have been generated, issue the following command:

Copy
Copied!
            

switch (config) # show files tcpdump wjh_auto_export_all_2020_05_18_09_36_12.pcap

Warning

WJH Wireshark dissector enables Wireshark users to analyze WJH pcap files. It displays the packets' added metadata. You may log into the WebUI and click the "Download Wireshark Plugin" button in the Status →What Just Happened page in order to download the Wireshark plugin file. After downloading the file, place it in the Wireshark application in Windows under %APPDATA%\Wireshark\plugins.

Warning

Wireshark dissector was tested on version 2.6.3.

what-just-happened

what-just-happened <all | acl | forwarding | layer-1 | buffer> [all-severities | notice | warning | error] enable
no what-just-happened <all | acl | forwarding | layer-1 | buffer> [all-severities | notice | warning | error] enable

Enables showing dropped packet information.
The no form of the command disables showing dropped packet information.

Syntax Description

all

Drop group containing all packets dropped

acl

Access-list drops

forwarding

Drop group containing L2, L3, port and tunnel related drops

layer-1

Drop group containing layer-1 event

buffer

Buffer overflow drops

all-severities

Configure drop with any severity
Default: all-severities enabled

notice

Configure drop with notice severity

warning

Configure drop with warning severity

error

Configure drop with error severity

Default

Enabled

Configuration Mode

config

History

3.7.1000

3.7.1100

Updated Example and Default

3.8.1000

Updated Syntax and Example

3.8.2000

Added ACL option

3.9.0300

Added layer-1 option

3.9.0500

Added buffer drop option

3.9.1000

Updated note

3.9.2000

Updated example and notes, adding support for WJH event suppression by the severity for each drop group.

Example

switch (config) # what-just-happened forwarding notice enable

Related Commands

show what-just-happened status
interface ethernet recirculation

Notes

  • In Spectrum systems, in order to enable buffer drop monitoring, one interface must be enabled as a recirculation port. In Spectrum-2 systems, it is sufficient to configure what-just-happened buffer enable. In both cases, the enabling configuration reduces by 1 the number of monitor sessions that can be configured. It will fail if the maximum number of monitor sessions are already configured.

  • Layer-1 drop group do not support severities

  • Disabling and enabling the WJH or any drop group will not affect the severity configuration

what-just-happened auto-export

what-just-happened auto-export <all | acl | forwarding | buffer> enable
no what-just-happened auto-export <all | acl | forwarding | buffer> enable

Enables auto-generated pcap files.
The no form of the command disables the auto-generation of pcap files.

Syntax Description

all

Drop group containing all packets dropped

acl

Access-list drops

forwarding

Drop group containing L2, L3, port and tunnel related drops

buffer

Buffer overflow drops

Default

Enabled

Configuration Mode

configure terminal

History

3.8.1000

3.8.2000

Added ACL option

3.9.0500

Added buffer drop option

Example

switch (config) # what-just-happened auto-export forwarding enable

Related Commands

what-just-happened enable

Notes

If auto-export is disabled for acl, forwarding or buffer, dropped packets in those groups do not count towards the threshold for generating a pcap, as defined in the 'logging events what-just-happened-packets' commands.

clear what-just-happened

clear what-just-happened <all | acl | forwarding | layer-1 | buffer>

Flushes data from cache DB.

Syntax Description

all

Drop group containing all packets dropped

acl

Access-list drops

forwarding

Drop group containing L2, L3, port and tunnel related drops

layer-1

Drop group containing layer-1 event

buffer

Buffer overflow drops

Default

N/A

Configuration Mode

config

History

3.7.1000

3.8.1000

Updated Syntax and Example

3.8.2000

Added ACL option

3.9.0300

Added layer-1 option

3.9.0500

Added buffer drop option

Example

switch (config) # clear what-just-happened forwarding

Related Commands

Notes

Clear WJH intends to clear all the events already seen by the user, but will not clear events in the hardware that were not yet read by WJH-lib. As such, it is possible that WJH events observed after using the clear command, actually entered before clearing the command but that were not yet shown to the user.

clear what-just-happened pcap-files

clear what-just-happened pcap-files [all | user | auto-export]

Deletes what-just-happened pcap files.

Syntax Description

all

All PCAP files

auto-export

PCAP files with wjh_auto_export prefix

user

PCAP files with wjh_user prefix

Default

all pcap files

Configuration Mode

config

History

3.8.2000

Role

Admin

Example

switch (config) # clear what-just-happened pcap-files user

Related Commands

file tcpdump delete

Notes

  • All—all pcap files.

  • User—pcap files with wjh_user prefix.

  • Auto—exportpcap files with wjh_auto_export prefix.

snmp-server notify event what-just-happened

snmp-server notify event what-just-happened [interval <interval>] [max-traps <max-traps>]
no snmp-server notify event what-just-happened [interval <interval>] [max-traps <max-traps>]

Enables sending SNMP traps for what-just-happened last events, sets the interval in which traps will be issued, and limits the maximum number of issued traps per interval.
The no form of the command disables sending SNMP traps for what-just-happened last events.

Syntax Description

interval

The interval in which traps will be issued.
Default: 60 seconds
Max: 300 seconds
Min: 30 seconds

max-traps

The maximum number of issued traps per interval.
Default: 50 events
Max: 100 events
Min: 5 events

Default

Disabled

Configuration Mode

config

History

3.9.2000

Example

switch (config) # snmp-server notify event what-just-happened interval 30 max-traps 100

Related Commands

show snmp events what-just-happened

Notes

  • In case SNMP traps for what-just-happened are enabled while using the CLI, a notification will appear informing that SNMP is running in parallel and of the what-just-happened buffer clearing

  • this command is only relevant for "aggregated" What-Just-Happened events

show what-just-happened

show what-just-happened [all | acl | forwarding | buffer | layer-1 | max-packets <1-1024 per group/1-4096 for all> | export <file-name> | no-metadata]

Displays dropped packets information.

Syntax Description

acl

Access-list drops

forwarding

Drop group containing L2, L3, port and tunnel related drops

buffer

Buffer overflow drops

layer-1

Drop group containing layer 1 event

max-packets

Limit number of packets to dump: <1-1024> for forwarding/acl/buffer/layer-1, <1-4096> for all

Default: 1024 per group, 4096 for all

export

Create a pcap file

file name

Optional file-name for pcap file
Default: wjh_user_[group]_[date].pcap

no-metadata

Do not add metadata to the pcap file (applicable only with 'export' attribute set)

Default

N/A

Configuration Mode

Any command mode

History

3.7.0000

3.7.1100

Updated syntax and example

3.8.1000

Updated syntax, default, and example

3.8.2000

New ACL example

3.8.2100

Update example

3.9.0300

Updated example

3.9.0500

Added layer-1 and buffer drops. PCAP file will not be created by default and updated example

3.9.0900

Updated ACL example

3.9.2000

Updated example of show what-just-happened buffer

Example

switch (config) # show what-just-happened 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
# Timestamp sPort dPort VLAN sMAC dMAC EthType Src IP:Port Dst IP:Port IP Proto Drop Group Severity Drop Reason - Recommended Action
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
1 2020/03/31 16:19:51.075 Eth1/3 N/A 12 ba:1b:25:11:22:31 24:8a:07:ca:cd:c8 IPv4 10.10.10.0:6857 10.10.20.1:767 TCP Forwarding Warning Blackhole route - Validate routing table for this
(phonebook) destination IP
...

Example (acl)

switch (config) # show-what-just-happened acl
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
# Timestamp sPort dPort VLAN sMAC dMAC EthType Src IP:Port Dst IP:Port IP Proto Drop Group Severity Drop Reason - Recommended Action
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
1 2020/05/07 12:25:02.600 Eth1/3 N/A N/A ba:1b:25:0a:0a:0b ba:1b:25:0B:0f:01 LPBK N/A:N/A N/A:N/A N/A Access-list Notice user-access-list - Validate ACL configuration

Rules Info
------------------------------------------------------------------------------------------------------------------
# Table Name Rule
------------------------------------------------------------------------------------------------------------------
1 user-access-list seq-number 11 deny ba:1b:25:0a:0a:0b mask ff:ff:ff:ff:ff:ff any

Exception list:
Buffer group is enabled but not operational. Please configure port recirculation.

Example (acl export)

switch (config) # show what-just-happened acl export
Pcap file path : /vtmp/wjh-pcaps/wjh_user_acl_2020_02_20_11_05_55.pcap
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
# Timestamp sPort dPort VLAN sMAC dMAC EthType Src IP:Port Dst IP:Port IP Proto Drop Group Severity Drop Reason - Recommended Action
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
1 2020/02/20 11:03:17.465 Eth1/3 N/A N/A ba:1b:25:0a:0a:0a ba:1b:25:0b:0b:0b LPBK N/A:N/A N/A:N/A N/A Access-list Notice mac-acl - Validate ACL configuration

Example (Layer-1)

switch (config) # show what-just-happened layer-1
----------------------------------------------------------------------------------------------------------------------------------------------------------------------
# Timestamp sPort dPort VLAN sMAC dMAC EthType Src IP:Port Dst IP:Port IP Proto Drop Group Severity Drop Reason - Recommended Action
----------------------------------------------------------------------------------------------------------------------------------------------------------------------
1 2020/03/16 12:10:58.728 Eth1/15 N/A  N/A   N/A  N/A  N/A      N/A:N/A      N/A:N/A      N/A       Layer-1    Warning   General L1 event - Check layer 1 aggregated
information

show what-just-happened all export

show (config) # show what-just-happened all export wjh_example
Pcap file path : /vtmp/wjh-pcaps/wjh_ example _all_2020_01_26_10_44_55.pcap
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 
# Timestamp sPort dPort VLAN sMAC dMAC EthType Src IP:Port Dst IP:Port IP Proto Drop Group Severity Drop Reason - Recommended Action
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
1 2020/01/26 10:44:29.810 Eth1/1 N/A 10 ba:1b:25:11:22:31 24:8a:07:ca:cd:c8 IPv4 10.10.10.0:54401 10.10.20.1:80 (http) TCP ACL Info Openflow Table 1 - Check Openflow Rule
2 2020/01/26 11:44:29.810 Eth1/2 N/A 20 ee:2b:85:61:22:31 11:2e:ff:ca:cd:d3 IPv4 20.20.20.0:10001 10.10.20.1:80 (http) TCP ACL Info mac-acl - Check ACL Rule
Rules Info
----------------------------------------------------------------------
# Table Name Rule
----------------------------------------------------------------------
1 Openflow Table 1 ip,ip_dst=10.10.20.1/32,priority=77
2 mac-acl seq-number 10 deny ee:2b:85:61:22:31 mask ff:ff:ff:ff:ff:ff any

show what-just-happened buffer

switch (config) # show what-just-happened buffer
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
# Timestamp sPort dPort VLAN sMAC dMAC EthType Src IP:Port Dst IP:Port IP Proto Drop Group Severity Drop Reason - Recommended Action
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
1 2020/10/05 12:23:12.464 Eth1/4 Eth1/2 N/A 98:03:9b:82:bF:7a b8:59:9f:a6:69:88 IPv4 10.1.2.2:50876 10.1.1.2:2221 (null) Buffer Notice Port TC Congestion Threshold Crossed - Monitor
(rockwell-csp1) network congesti
2 2020/10/05 12:23:12.459 Eth1/4 Eth1/2 N/A 98:03:9b:82:bF:7a b8:59:9f:a6:69:88 IPv4 10.1.2.2:50876 10.1.1.2:2221 (null) Buffer Notice Port TC Congestion Threshold Crossed - Monitor
(rockwell-csp1) network congestion
3 2020/10/05 12:23:12.448 Eth1/4 Eth1/2 N/A 98:03:9b:82:bF:7a b8:59:9f:a6:69:88 IPv4 10.1.2.2:50876 10.1.1.2:2221 (null) Buffer Notice Port TC Congestion Threshold Crossed - Monitor
(rockwell-csp1) network congestion
Buffer Info:
-----------------------------------------------------------------------------------------------------------
# TC Id TC Usage [KB] Latency [nanoseconds] TC Watermark [KB] Latency Watermark [nanoseconds]
-----------------------------------------------------------------------------------------------------------
1 1 2896 N/A N/A N/A
2 1 2960 N/A N/A N/A
3 1 2920 N/A N/A N/A

Related Commands

show what-just-happened status

Notes

  • By default, pcap file will not be created, if "export" is not specified. Pcap file names will be “wjh_user_[date].pcap” if no user-defined name is entered, and “[user defined name]_[date].pcap” if provided

  • In Spectrum systems, in order to see buffer drops, one interface must be configured as a recirculation port

  • "max-num" and "last-read" are reserved and cannot be used as filenames

  • For display of ACL drops, lines indexes in "Rules Info" table match the indexes in the main table

  • To display buffer drops, lines indexes in "Buffer Info" table should match the indexes in the main table

show what-just-happened aggregated

show what-just-happened aggregated <acl | forwarding | buffer | layer-1> <max-num | last-read>

Displays aggregation record.

Syntax Description

max-num

Maximum number of aggregated record displayed.

last-read

Get aggregated record in last show command

forwarding

Display aggregated record on layer-2/port/layer-3/tunneling related reasons. Max-num is 192.

acl

Display aggregated record on access list related reasons. Max-num is 64.

buffer

Max: 64

layer-1

Display aggregated record on layer-1 related reasons. Max-num is 256.

Default

N/A

Configuration Mode

Any command mode

History

3.9.0300

3.9.0500

Added support for ACL, forwarding, and buffer drops

3.9.0900

Updated ACL example

3.9.1000

In "show-what-just-happened aggregated acl" added support for description of ACL OpenFlow drops

3.9.2000

Updated example of show what-just-happened aggregated buffer

Example (Layer-1)

switch (config) # show what-just-happened aggregated layer-1
Sample Window : 2020/03/19 05:12:54.086 - 2020/03/19 05:47:43.426
---------------------------------------------------------------------------------------------------
Port State Down Reason - Recommended Action State Change Symbol Error FCS Error
---------------------------------------------------------------------------------------------------
Eth1/4 Down Port admin down - Validate port 1 0 0
configuration

Example (acl)

switch (config) # sh what-just-happened aggregated acl 
Sample Window : 2020/05/11 10:25:09.953 - 2020/05/11 10:55:11.921
--------------------------------------------------------------------------------------------------------------------------------------------------------------------
# sPort VLAN sMAC dMAC EthType Src IP:Port Dst IP:Port IP Proto Count Severity Drop Reason - Recommended Action
--------------------------------------------------------------------------------------------------------------------------------------------------------------------
1 Eth1/2 N/A ba:1b:25:0a:0a:0a ba:1b:25:0b:0b:0b LPBK N/A:N/A N/A:N/A N/A 2 Notice mac-acl - Validate ACL configuration

Rules Info
------------------------------------------------------------------------------------------------------------------
# Table Name Rule
------------------------------------------------------------------------------------------------------------------
1 mac-acl seq-number 10 deny ba:1b:25:0a:0a:0a mask ff:ff:ff:ff:ff:ff any

Example (forwarding)

switch (config) # show what-just-happened aggregated forwarding
Sample Window : 2020/03/16 12:10:29.226 - 2020/03/17 02:33:06.337
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------
# sPort VLAN sMAC dMAC EthType Src IP:Port Dst IP:Port IP Proto Count Severity Drop Reason - Recommended Action
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------
1 Eth1/2 N/A 24:8a:07:97:32:e2 33:33:00:00:00:16 IPv6 [fe80::268a:7ff:fe97:32e2]:N/A [ff02::16]:N/A N/A 2 Notice Ingress spanning tree filter- Expected behavior

Example (buffer)

switch (config) # show what-just-happened aggregated buffer last-read

Sample Window : 2020/10/05 12:36:49.369 - 2020/10/05 12:38:13.605
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
# sPort VLAN sMAC dMAC EthType Src IP:Port Dst IP:Port IP Proto Count Severity Drop Reason - Recommended Action
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
1 Eth1/4 N/A 98:03:9b:82:bF:7a b8:59:9f:a6:69:88 IPv4 10.1.2.2:50888 10.1.1.2:2221 TCP 6330 Notice Port TC Congestion Threshold Crossed - Monitor network
(rockwell-csp1) congestion
Buffer Info:
-----------------------------------------------------------------------------------------------------------
# TC Id TC Usage [KB] Latency [nanoseconds] TC Watermark [KB] Latency Watermark [nanoseconds]
-----------------------------------------------------------------------------------------------------------
1 N/A N/A N/A 371 N/A

Related Commands

Notes

  • For display of ACL drops, lines indexes in "Rules Info" table match the indexes in the main table

  • To display buffer drops, lines indexes in "Buffer Info" table should match the indexes in the main table

show what-just-happened status

Show general what-just-happened status

Enables and disables what-just-happened drop-groups status.

Syntax Description

N/A

Default

N/A

Configuration Mode

Any command mode

History

3.8.2000

3.9.0600

Added operational status

3.9.1300

Updated output

3.9.2000

Updated example, adding "Enabled Severities" and "Operational status" fields

Role

Admin

Example

switch (config) # show what-just-happened status
What-just-happened is enable

Severities:
N: Notice
W: Warning
E: Error

------------------------------------------------------------------------------------
Drop group Admin status Enabled Severities Operational status Auto-export status
------------------------------------------------------------------------------------
Forwarding Enable W, E Enable Enable
Access-list Enable All Enable Enable
Buffer Enable N Enable Enable
Layer-1 Enable All Enable N/A

Related Commands

Notes

show snmp events what-just-happened

show snmp events what-just-happened

Displays what-just-happened SNMP configuration and status.

Syntax Description

N/A

Default

N/A

Configuration Mode

Any command mode

History

3.9.2000

Example

switch (config) # show snmp events what-just-happened

Event : Periodic SNMP traps reporting what-just-happened aggregated data
Trap enabled : Yes
Polling interval (sec) : 30
Maximum traps per interval: 100

switch (config) # show snmp events what-just-happened

Event : Periodic SNMP traps reporting what-just-happened aggregated data
Trap enabled : No
Polling interval (sec) : N/A
Maximum traps per interval: N/A

Related Commands

snmp-server notify event what-just-happened

Notes

switchmode exceptions sip-equals-dip

switchmode exceptions sip-equals-dip
no switchmode exceptions sip-equals-dip

Cancels the discard on this trap.
The no form of the command returns the action to discard for this trap.

Syntax Description

N/A

Default

Disabled

Configuration Mode

Config

History

3.9.0900

Example

switch (config) # switchmode exceptions sip-equals-dip

Related Commands

show switchmode exceptions

Notes

show switchmode exceptions

show switchmode exceptions

Shows the current state of the exceptions

Syntax Description

N/A

Default

N/A

Configuration Mode

Config

History

3.9.0900

Example

switch (config) # show switchmode exceptions
Src & Dest IP equal action: Forward

Related Commands

switchmode exceptions sip-equals-dip

Notes

© Copyright 2023, NVIDIA. Last updated on Sep 8, 2023.