WEBVTT 1 00:00.000 --> 00:04.920 Logging is very important as we might imagine to troubleshooting issues as well 2 00:04.920 --> 00:05.000 . 3 00:05.000 --> 00:10.200 And so for example, when we want to see the log, we can use the show log 4 00:10.200 --> 00:12.000 command or show logging. 5 00:12.000 --> 00:16.650 And it's going to give us a list of all of the system messages as well as any 6 00:16.650 --> 00:18.000 debug that we have been running. 7 00:18.000 --> 00:21.580 But it also depends a little bit again on that level that we talked about 8 00:21.580 --> 00:25.000 earlier, as far as what severity level are we tracking. 9 00:25.000 --> 00:29.650 In order to understand that we do need to start by having a conversation about 10 00:29.650 --> 00:33.600 the severity levels of the different log messages that can show up from a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 10 00:29.650 --> 00:33.600 the severity levels of the different log messages that can show up from a 11 00:33.600 --> 00:34.000 system. 12 00:34.000 --> 00:39.780 Because some messages that enter into the log are absolutely urgent, emergency 13 00:39.780 --> 00:42.000 level, and others are not. 14 00:42.000 --> 00:45.530 And so we have eight different levels starting with seven and working their way 15 00:45.530 --> 00:46.000 down. 16 00:46.000 --> 00:53.000 Seven, six, five, four, three, two, one, and zero. That's a two and a zero. 17 00:53.000 --> 00:53.000 There we go. 18 00:53.000 --> 00:59.230 So at the top here is debugging. So if I'm going to create a debug message or 19 00:59.230 --> 01:04.000 just enter a command into enable a particular type of debugging, all of the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 19 00:59.230 --> 01:04.000 just enter a command into enable a particular type of debugging, all of the 20 01:04.000 --> 01:07.410 messages that show up tied to that will be marked with a severity level of 21 01:07.410 --> 01:08.000 seven. 22 01:08.000 --> 01:13.080 Six is informational, which is, as the name implies, just sort of something 23 01:13.080 --> 01:17.370 that doesn't really indicate a problem. It's just there so we know what 24 01:17.370 --> 01:18.000 happened. 25 01:18.000 --> 01:24.000 From here, we get into fairly arbitrary listings of criticality levels, such as 26 01:24.000 --> 01:27.000 notifications and four is warnings. 27 01:27.000 --> 01:32.670 But we can tell that the level of criticality or how critical something is is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 27 01:27.000 --> 01:32.670 But we can tell that the level of criticality or how critical something is is 28 01:32.670 --> 01:35.000 getting a little bit worse. 29 01:35.000 --> 01:38.520 So up to us, whether we think maybe error should have been four or warnings, 30 01:38.520 --> 01:42.970 three doesn't really matter, our job is simply to memorize the difference of a 31 01:42.970 --> 01:44.000 very levels. 32 01:44.000 --> 01:48.210 And I would highly recommend memorizing all of these. Two is going to be 33 01:48.210 --> 01:53.690 critical. One is going to be an alert, which to me feels like not nearly as 34 01:53.690 --> 01:57.000 critical as critical, but, you know, is what it is zero. 35 01:57.000 --> 02:03.000 However, this is an emergency level message. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 35 01:57.000 --> 02:03.000 However, this is an emergency level message. 36 02:03.000 --> 02:08.210 So we mentioned SNMP earlier, we might want to trigger traps on certain levels. 37 02:08.210 --> 02:14.560 But the way that this works from a Cisco perspective is we get to set the level 38 02:14.560 --> 02:16.000 for our logging. 39 02:16.000 --> 02:21.580 And that's going to apply to everything that is included, the level that we set 40 02:21.580 --> 02:26.000 , plus everything more critical, meaning lower values. 41 02:26.000 --> 02:31.720 So if I set the level of logging here at warnings, it's also going to include WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 41 02:26.000 --> 02:31.720 So if I set the level of logging here at warnings, it's also going to include 42 02:31.720 --> 02:37.580 all of these. If I set it at as high as debugging, well, then it's going to 43 02:37.580 --> 02:39.000 show me all of them. 44 02:39.000 --> 02:44.180 And so on and so forth. If I set it to critical, then it's going to only give 45 02:44.180 --> 02:46.000 me two ones and zeros. 46 02:46.000 --> 02:51.540 So that is how super parity levels work and why we have a numerical order to 47 02:51.540 --> 02:55.390 them is because when I set a particular logging level, it's going to grab that 48 02:55.390 --> 02:59.090 level and everything that's considered to be more critical than the level that 49 02:59.090 --> 03:00.000 I specified. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 49 02:59.090 --> 03:00.000 I specified. 50 03:00.000 --> 03:07.740 Now, how exactly does logging happen? Well, we've got different logging 51 03:07.740 --> 03:10.000 locations that we need to be concerned with. 52 03:10.000 --> 03:15.640 So let's say something happens, we get an informational message, we need to 53 03:15.640 --> 03:19.000 decide where it is that that's going to go. 54 03:19.000 --> 03:24.000 And so there's several different places. First of all, we have the console. 55 03:24.000 --> 03:27.750 If somebody has plugged into the console, then they want to possibly get that 56 03:27.750 --> 03:29.000 message right away. 57 03:29.000 --> 03:37.770 Very likely that's going to be the case. We also have the terminal or otherwise WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 57 03:29.000 --> 03:37.770 Very likely that's going to be the case. We also have the terminal or otherwise 58 03:37.770 --> 03:41.000 known as the monitor. 59 03:41.000 --> 03:45.300 So remember that terminal monitor command, if I have terminal monitor on, then 60 03:45.300 --> 03:49.000 I will see the message there, assuming that the message lands there. 61 03:49.000 --> 03:55.300 And lastly, we have the buffer. So the buffer is what I see when I do my show 62 03:55.300 --> 03:56.000 log. 63 03:56.000 --> 04:01.140 The buffer has so much space and eventually the buffer will expire. So this is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 63 03:56.000 --> 04:01.140 The buffer has so much space and eventually the buffer will expire. So this is 64 04:01.140 --> 04:03.000 space dependent. 65 04:03.000 --> 04:07.000 And if I do start to run out of space, old messages will be exhausted. 66 04:07.000 --> 04:11.010 And maybe that's a problem. Maybe it's not, but we should be aware of the fact 67 04:11.010 --> 04:14.000 that I might go to a device that had a problem three days ago. 68 04:14.000 --> 04:18.180 And because of the space in the buffer and the sheer number of log messages it 69 04:18.180 --> 04:23.000 's getting, we've already lost the log messages that occurred three days ago. 70 04:23.000 --> 04:30.000 Now each one of these locations in the CLI, we get to set the level of logging. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 70 04:23.000 --> 04:30.000 Now each one of these locations in the CLI, we get to set the level of logging. 71 04:30.000 --> 04:35.610 So console, for example, is going to be set to debugging because we want to see 72 04:35.610 --> 04:38.000 every message at the console. 73 04:38.000 --> 04:43.110 But then I can also set a level at the terminal. I can set a level for the 74 04:43.110 --> 04:44.000 buffer. 75 04:44.000 --> 04:48.770 And I control this. So for example, if I wanted it at the monitor to be 76 04:48.770 --> 04:53.680 informational and I don't want to necessarily see the debuggs, well at that 77 04:53.680 --> 04:58.000 point I will only get everything again, informational and below. 78 04:58.000 --> 05:02.660 But keep in mind, if I then activate a debug, well the debugging levels aren't WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 78 04:58.000 --> 05:02.660 But keep in mind, if I then activate a debug, well the debugging levels aren't 79 05:02.660 --> 05:05.000 part of the level that I specified. 80 05:05.000 --> 05:09.420 I specified informational, which is six and below. And debugging comes in at 81 05:09.420 --> 05:12.000 seven, which doesn't fit that criteria. 82 05:12.000 --> 05:16.010 So that is where we have to be careful about it. We might be frustrated. Like, 83 05:16.010 --> 05:18.000 why am I not getting these debug messages? 84 05:18.000 --> 05:21.710 Why are they not showing up in the buffer? Maybe the buffer is set to a warning 85 05:21.710 --> 05:23.000 level to save on space. 86 05:23.000 --> 05:27.560 So we don't want all of the lower, well I should say higher numbered, but the 87 05:27.560 --> 05:32.430 lower criticality alerting, I just want to see everything that's warning or WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 87 05:27.560 --> 05:32.430 lower criticality alerting, I just want to see everything that's warning or 88 05:32.430 --> 05:33.000 worse. 89 05:33.000 --> 05:37.770 And so depending on how I configure this, we can see that we will filter out 90 05:37.770 --> 05:45.000 some messages, but we will record a lot of, or pretty much all of the rest. 91 05:45.000 --> 05:50.320 And as is the case in a lot of other networks or corporate networks, we can 92 05:50.320 --> 05:55.000 also log not just to these three, but also a syslog server. 93 05:55.000 --> 06:00.030 Is this log server would be a device that exists out on the network somewhere, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 93 05:55.000 --> 06:00.030 Is this log server would be a device that exists out on the network somewhere, 94 06:00.030 --> 06:02.000 potentially in the cloud? 95 06:02.000 --> 06:09.000 It just is a device that is offloading the logging from the local device. 96 06:09.000 --> 06:14.400 So remember, our buffer is limited. We have space concerns on a device. It will 97 06:14.400 --> 06:17.000 run out. It will cycle out old messages. 98 06:17.000 --> 06:23.690 Well, syslog server, well, everything has a, you know, a limit. Eventually, 99 06:23.690 --> 06:29.620 there is less of a limit on the amount of logs that are kept depending on our 100 06:29.620 --> 06:32.000 settings and depending on the storage space and so on and so forth. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 100 06:29.620 --> 06:32.000 settings and depending on the storage space and so on and so forth. 101 06:32.000 --> 06:36.060 So I'll say no limit with air quotes, because we know eventually you will run 102 06:36.060 --> 06:41.250 out of space. But the idea here is that now the device, which was pushing to 103 06:41.250 --> 06:46.300 these three different locations, all of these messages, it's also going to push 104 06:46.300 --> 06:49.000 to a syslog server if we have that configured. 105 06:49.000 --> 06:53.830 So the way we configure this is with some basic commands, specifically logging, 106 06:53.830 --> 06:59.230 and then I include the IP address. And that will start to send messages to the 107 06:59.230 --> 07:02.000 IP address of the syslog server. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 107 06:59.230 --> 07:02.000 IP address of the syslog server. 108 07:02.000 --> 07:06.040 I can also specify a source interface. So just like with our pings and our 109 07:06.040 --> 07:12.290 trace routes, I could specify a source that way we know that a particular log 110 07:12.290 --> 07:16.000 message came from a particular device. 111 07:16.000 --> 07:19.200 So maybe I use a loopback address or something like that. So it's always 112 07:19.200 --> 07:24.320 consistent. And then I can also set the level. And I use that using this trap 113 07:24.320 --> 07:28.270 word again. So the trap showed up with SNMP here has a slightly different 114 07:28.270 --> 07:29.000 meaning. 115 07:29.000 --> 07:33.340 It's simply allowing me to specify the level. So I could again specify WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 115 07:29.000 --> 07:33.340 It's simply allowing me to specify the level. So I could again specify 116 07:33.340 --> 07:37.880 debugging or if I don't want to send debug to the syslog server, maybe I'd send 117 07:37.880 --> 07:43.000 informational messages, which would send everything other than debugging. 118 07:43.000 --> 07:48.320 So let's flip over to a iOS XC device here, router three in the lab, and do a 119 07:48.320 --> 07:52.000 show logging just to kind of see some of this in action. 120 07:52.000 --> 07:56.700 So at the top of show logging, we actually see the level of logging for console 121 07:56.700 --> 08:01.300 . So this console set to warnings actually kind of flipped. Usually the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 121 07:56.700 --> 08:01.300 . So this console set to warnings actually kind of flipped. Usually the 122 08:01.300 --> 08:02.000 debugging is set to console. 123 08:02.000 --> 08:05.280 This is what we get for going into a lab device, because who knows what I've 124 08:05.280 --> 08:08.780 done on this before. But we do see the console set to warnings while monitor is 125 08:08.780 --> 08:12.850 set to debugging and the buffer is set to debugging, meaning that debug will 126 08:12.850 --> 08:17.000 actually show up in the buffer, but they won't show up on the console kind of 127 08:17.000 --> 08:17.000 funny. 128 08:17.000 --> 08:21.290 So as I space down, we're going to see all of the different log messages. Now 129 08:21.290 --> 08:25.510 there's a format to these. First of all, we might see sequences, sequence 130 08:25.510 --> 08:28.630 numbers and timestamps. I don't have those enabled. I'll demonstrate those in a 131 08:28.630 --> 08:29.000 moment. 132 08:29.000 --> 08:33.240 From there, we see this percentage sign, which indicates what we call the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 132 08:29.000 --> 08:33.240 From there, we see this percentage sign, which indicates what we call the 133 08:33.240 --> 08:38.170 facility, the facility or SYS in this case is supposed to tell us a little bit 134 08:38.170 --> 08:43.000 about what's happening. Log messages that are tied to each other will commonly 135 08:43.000 --> 08:43.000 have the same facility. 136 08:43.000 --> 08:47.200 Next up, we see the level of severity. So a five represents notification. A six 137 08:47.200 --> 08:51.210 represents informational, but that's right there in the middle surrounded by 138 08:51.210 --> 08:52.000 the dashes. 139 08:52.000 --> 08:57.560 And then on the other side of this, we get a message called a mnemonic. The mn 140 08:57.560 --> 09:00.870 emonic is supposed to give us a little bit more human readable, like information WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 140 08:57.560 --> 09:00.870 emonic is supposed to give us a little bit more human readable, like information 141 09:00.870 --> 09:08.000 . For example, we saw with this facility, SYS, we have one type of log message 142 09:08.000 --> 09:11.000 here, which, oh, funny enough, this looks like when I was messing with the logs 143 09:11.000 --> 09:11.000 . 144 09:11.000 --> 09:15.940 So we did a log configuration change, change the buffer logging to debugging, 145 09:15.940 --> 09:21.710 for example. And then with SYS, we here, we also see a different type of mn 146 09:21.710 --> 09:23.000 emonic config. 147 09:23.000 --> 09:28.190 I, there, which tells us, hey, the console configured things. And so from there 148 09:28.190 --> 09:31.000 , we can see lots of different log messages. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 148 09:28.190 --> 09:31.000 , we can see lots of different log messages. 149 09:31.000 --> 09:37.100 Link state up and down would be a severity level of three. You know, we can 150 09:37.100 --> 09:41.650 tend to take a look and see what qualifies with what a neighbor adjacency and O 151 09:41.650 --> 09:44.000 SPF is a five and so on and so forth. 152 09:44.000 --> 09:50.000 So from here, I could enable timestamps. So I can do service timestamps. 153 09:50.000 --> 09:54.600 Question mark. And then I can decide if I want to let's apply this to log 154 09:54.600 --> 09:56.000 messages rather. 155 09:56.000 --> 10:00.000 And then I can decide whether it's uptime that I want to specify or date time. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 155 09:56.000 --> 10:00.000 And then I can decide whether it's uptime that I want to specify or date time. 156 10:00.000 --> 10:04.860 So if I say date time, and then I exit the next log message we see, which is 157 10:04.860 --> 10:06.000 going to show up. 158 10:06.000 --> 10:11.480 I don't think because of the level, because this is a console connection. So if 159 10:11.480 --> 10:15.000 I do a, let's just, let's change the logging level actually. 160 10:15.000 --> 10:20.000 So if I say logging question mark, we see our different options here. 161 10:20.000 --> 10:24.470 So I'm going to change the console logging level. And then I can specify again, 162 10:24.470 --> 10:29.000 these names we talked about debugging or critical or just the number itself. 163 10:29.000 --> 10:34.000 So I'm just going to go back to debugging console, logging console seven. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 163 10:29.000 --> 10:34.000 So I'm just going to go back to debugging console, logging console seven. 164 10:34.000 --> 10:38.430 Exit. And now we should start to see debug messages again. If I do that show 165 10:38.430 --> 10:42.000 log, now we see that the console logging is set to debugging. 166 10:42.000 --> 10:46.960 So that's how we change the different log levels. So now, well, actually, let's 167 10:46.960 --> 10:49.000 take a look here at this message. 168 10:49.000 --> 10:53.200 We do see that there's a date and time now associated with this log message. So 169 10:53.200 --> 10:57.530 before it just started with the facility. Now we see that there's a date and 170 10:57.530 --> 10:58.000 time. 171 10:58.000 --> 11:05.000 Or if I wanted to as well, I could do service sequence numbers. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 171 10:58.000 --> 11:05.000 Or if I wanted to as well, I could do service sequence numbers. 172 11:05.000 --> 11:08.360 And now we're going to get a sequence number that increments with every log 173 11:08.360 --> 11:14.000 message. So I do another config T and an exit. Next one should be 151. There we 174 11:14.000 --> 11:14.000 go. 175 11:14.000 --> 11:17.990 So we've got a sequence number now. We've got a date time. I could do uptime. 176 11:17.990 --> 11:23.000 It might say, hey, at one year and one year and two days or something like that 177 11:23.000 --> 11:23.000 . 178 11:23.000 --> 11:27.510 But again, we just specified date time here. But these are some of the options 179 11:27.510 --> 11:30.000 that we have the ability to change the logging level. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 179 11:27.510 --> 11:30.000 that we have the ability to change the logging level. 180 11:30.000 --> 11:34.520 And don't forget the ability to configure a syslog server to offload our logs 181 11:34.520 --> 11:38.890 so that we don't lose them for any particular reason just by storing them on 182 11:38.890 --> 11:40.000 the devices.