Learn to understand Cisco error messages

This article mainly tells you in detail what prompts are provided for the Cisco router error information and what analysis is required. The following article will provide a detailed answer.

Error Message format
The format of the system error message is as follows:

% Facility-subfacility-Severity-Mnemonic: Message Text

Facility indicates the device name involved in the error message. The value can be a protocol, hardware device, or system software module.

Subfacility it is only related to the channel interface processor (CIP) card. For more information, see the relevant sections of the Cisco Document.

Severity is a number ranging from 0 to 7. The smaller the number, the higher the severity.

Mnemonic uniquely identifies the single-value code of an error message. This code can usually imply an error type.

Message Text: a brief description of the error Message, including information about the router hardware and software involved.

Below are some examples of error messages. You can refer to the system error messages section in the cco iso document to find the description of these error messages.

% DUAL-3-SIA: Route 171.155.148.192/26 stuck-in-active state in IP-EIGP 211. Cleaning up

% LANCE-3-OWNERR: Unit 0, buffer ownership error

Note that not all messages involve failures or problems. Some messages display status information. For example, the following message only indicates that the isdn bri 0 interface is connected to a specific remote data.

% ISDN-6-CONNECT: Interface BRI0 is now connected to 95551212

Traceback Report

Some error messages related to internal router errors include traceback information. This information should be added to the error description when reporting errors to Cisco TAC.

Logs of error messages and event information

According to the importance and validity of the error message, the Cisco error message can be recorded in the following locations:

& #61550; Console
& #61550; virtual terminal
& #61550; Syslog Server
& #61550; internal buffer

The logging on command outputs log messages to the preceding locations. For a Syslog server, you must use the following global configuration command to specify the IP address of the server:

Logging ip-address

By repeatedly using this command, you can create a list of servers. When managing a large network, you usually need to set up Redundant servers.

The logging buffered command is used to send log information to the internal buffer zone. The buffer must be larger than 4096 bytes. The default value varies depending on the system platform. Select the buffer size suitable for the environment. If the buffer is too small, new messages will overwrite old messages. This may cause problems. However, if the buffer size is too large, the system cache will be wasted. The no logging buffered command will disable messages from being written to the internal cache.

You can use the show logging command to display the content of the internal buffer. If you need information for a certain period of time, use NTP or manually set the clock. The specific operation is as follows:
YH-Router # clock set 11:37:00 December 2000
YH-Router # sh clock
11:37:03. 596 PST Fri Dec 11 2000

You can use the following global configuration command to view the timestamp and debugging information of a log message:
YH-Router (config) # service timestamps log datetime
YH-Router (config) # service timestamps debug datetime

The terminal monitor command displays the debugging logs on the current terminal. This command is not a configuration command. On the contrary, it can be used in command line mode when being telnet to a vrotelnet.

In most cases, you may need to display log information at a certain level. Therefore, log information is divided into eight different levels, sorted from high to low by importance as follows:
& #61550; Emergencies
& #61550; Alerts
& #61550; Critical
& #61550; Errors
& #61550; Warnings
& #61550; Communications
& #61550; Informational
& #61550; Debugging

For example, to display all logs whose severity is equal to or greater than Warning on the console, you can use the following global configuration command:
Logging console warning

Similarly, when a certain type of log information is sent to the current terminal
Logging monitor level

Or use
Logging trap level

Unlike the terminal monitor command, the logging monitor command is part of the router configuration. The previous command cannot be executed at different security levels.

Note that the system overhead changes greatly when logs are recorded to different locations. The overhead of logging to the console is large, but the overhead of logging to the virtual terminal is small. The consumption of Syslog servers is lower. The write mode with the minimum system overhead is to write logs into the internal buffer zone.

Core Dump)

To find out the cause of a router crash, we can use many commands to obtain valid information. Here, we have explained the usage of the show stacks command. The core dump is a copy of the system memory image, which can be written to the TFTP server. From this binary file, we can obtain information related to the router crash or serious misoperation, through which we can eliminate possible faults.

The following configuration command writes the core dump to the TFTP server corresponding to the IP address in the command:
Exception dump ip-address

The write core Command is usually used to save the core image when a router encounters a serious misoperation but does not crash completely.

Only servers running IOS v 9.0 or later can use the core dump. However, it should be noted that it is best to obtain support from experienced engineers or Cisco TAC when using a core dump.

Conclusion

To successfully diagnose and eliminate network faults, network engineering technicians must master two basic skills. First, you must have a clear understanding of network technologies and protocols. It is the basis for diagnosing and troubleshooting network faults. Without proper knowledge and experience, fault diagnosis and troubleshooting tools such as router diagnostic commands and Network Analyzers cannot play their roles.

The second skill that must be mastered by network engineering technicians is to apply the knowledge to the process of diagnosing and troubleshooting network faults in a organized manner. Although this article only describes some diagnostic commands, it must be emphasized that fault diagnosis and troubleshooting are a structured method. Many engineering and technical personnel think that the fault diagnosis and troubleshooting plan is not as important as the research and application technology itself. In fact, a correct plan often plays a decisive role in fault diagnosis and troubleshooting. In the process of troubleshooting, an accidental action may allow the fault to be solved smoothly, but it cannot replace the structured troubleshooting method.

Troubleshooting of network faults is a system engineering that involves defining problems, collecting facts, considering possibilities based on facts, establishing an action plan, implementing a plan, observing results, and circulating processes, this process is like the waterfall model in the software development process. Its importance is self-evident.