This document describes the Event Logging System (ELS). It also describes EVENT and how to control the way it collects and displays messages. EVENT provides a view of activity inside the router and on its networks. The information is divided into the following topics:
What is ELS?
Displaying the ELS Configuration Prompt
Displaying the ELS Monitoring Prompt
Entering and Exiting EVENT Display
Displaying ELS Through EVENT
Interpreting ELS Messages
Using ELS
Using ELS to Troubleshoot a Problem
ELS Commands
What is ELS?
Events occur continuously while the router is operating. Any of the following can cause an event:
System activity
Status changes
Service requests
Data transmission and reception
Data and internal errors
Figure 1 ELS and EVENT in the Router Software Structure

Displaying the ELS Configuration Prompt
At the ELS config> prompt, you use commands to establish a default configuration. This default configuration does not take effect until you restart the router.
To enter the ELS configuration process,
* config
Config>
The Config> prompt appears. If the prompt does not appear, press Enter again.
Config> prompt.
Config> event
ELS config>
The ELS config> prompt appears. Now you can enter ELS configuration commands.
Config> prompt. ELS config>exit
Config>
ELS config> prompt, you can do this at the ELS monitoring prompt (ELS>), without re-initializing the router. Use commands at the ELS> prompt to change the default ELS display settings temporarily. Changes made at the ELS> prompt take effect immediately. They are not stored in non-volatile configuration memory.
You can also use the commands at the ELS> prompt to view statistical information regarding ELS uses of dynamic RAM.
To enter the ELS monitoring process,* monitor
+
The + prompt appears. If the prompt does not appear, press Enter again.
+ event
ELS>
The ELS> prompt appears. Now you can type ELS monitoring commands.
+ prompt. ELS> exit
+
* prompt, type EVENT at the * prompt.The EVENT process does not display any prompt and you cannot enter any commands; it does, however, display the messages EVENT has accumulated. To exit EVENT and return to the* EVENT
* prompt, press Ctrl p.
OPCON commands at the * prompt:
divert temporarily diverts output to a different device.
flush causes EVENT to discard the messages it collects.
halt reverses the action of the divert command.
event causes EVENT to display its output.
The set logging disposition command at the Config> prompt sets the initial device to which EVENT sends its output.
Config> prompt. Specifying a default device is useful if you have a terminal set up to print.
ELS> list subsystems gw

Other examples of subsystems include ARP, IP, and ETH. On a particular router, the actual subsystems present depend on the hardware and software configured for that router. Use the list subsystems command to see a list of the subsystems on your router.
Enter the subsystem as a parameter to an ELS command when you want the command to affect the entire subsystem. For example, the ELS command display subsystem gw causes all events that occur through the GW subsystem to appear.
Event Number
Event Number is a pre-defined, unique, arbitrary number assigned to each message within a subsystem. It is not an indication of the message priority. In Figure 2, 019 is the event number within the GW subsystem. You can see a list of all the events within a subsystem by using the list subsystems command.
The event number always appears with a subsystem, separated by a period. For example: GW.019. The subsystem and event number together identify an individual event. You type them as a parameter to certain ELS commands. When you want a command to affect only the specified event, type the subsystem and event number as a parameter for the ELS command.
Look up messages in the Event Logging System Messages Guide.
Logging Level
Logging level is a pre-defined setting that classifies each message by the event that generated it. This setting appears whenever you use the list subsystems ELS monitoring command.
Table 1 lists the logging levels and types.
In Table 1, ERROR, INFO, TRACE, STANDARD, and ALL are aggregates of other logging level types. STANDARD is the recommended default.
The logging level setting affects the operation of the following commands:
display subsystem
nodisplay subsystem
trap subsystem
notrap subsystem
Including the logging level on the command line modifies the display command so that whenever an event with a logging level of either UI-ERROR or CI-ERROR occurs through subsystem ETH, the resulting message appears. You cannot specify the logging level for operations affecting groups or events.ELS>display subsystem eth error
Slf tst nt 1 int ETH/0 is the message generated by this event. Variables, such as source_address or network, are replaced with actual data when the message appears on the screen.Some ELS messages refer to the variable error_code by preceding them with rsn or reason. The error codes indicate the type of packet error the software detected. Table 2 describes the error or packet completion codes. Packet completion codes indicate the disposition of the packets that arrive at the router.
ELS displays network information as follows:
where:nt 1 int Eth/0 or network 1, interface Eth/0,
1 is the network number (Each network on the router is numbered sequentially from zero.)
0 is the unit number (The interfaces of each hardware type are numbered sequentially from zero.)
To delete a group, use the delete command.ELS>nodisplay group grouptwo
Know what you want to see before using the ELS system. Clearly define the problem or events that you want to see before using EVENT.
Enter the command nodisplay subsystem all all to turn off all ELS messages.
Turn on only those messages that relate to the problem you are experiencing.
The router cannot save these messages so that you can review them later. When this message appears, you may want to tailor the ELS output to display only the information that is important to the current task you are monitoring.xx messages flushed
where ip address is your router address and outputfilename is the file in which you want the messages to go.
* prompt, press Ctrl p.
telnet> prompt. Then, type quit to return to your UNIX prompt.
You can also capture the ELS output to a file by attaching a PC to the router's console port and starting a log file from within the terminal emulation package.
config> or ELS>, type
trap event snmp.002
Note:
If you are at the ELS config> prompt, you need to reboot.
SNMP.002 P-TRACE snt pkt to hst %I
SNMP config> prompt, type
SNMP config>add address public ip address of remote workstation
SNMP config>enable trap enterprise public
SNMP config>set community access read_trap public
Note: These commands are dynamic.
Initially, because of the rapid pace of messages scrolling across the screen, you may want to record the numbers you see and look them up in the Event Logging System Messages Guide. Once you become familiar with different types of messages that appear for a particular protocol, you can turn on and off only those messages containing the information that you require. ELS allows you to specify which messages are displayed to EVENT by setting up permanent and temporary message filters. The ELS configuration commands allow you to design a permanent message filter that goes into effect when the router is re-initialized. This filter becomes known as the default message filter. The ELS monitoring commands allow you to set up a temporary message filter that overrides the permanent filter for troubleshooting purposes. When you re-initialize the router, the software erases this temporary message filter. The monitoring commands also allow you to view statistical information related to the messages. Example:ELS> display subsystem bri all
ISDNISDN is not working.
Device Hardware CSR Vector State
LAN SCC Ethernet 81600 94 Up
WAN Basic Rate ISDN 81620 93 Disabled
* config
Config> event
ELS config> nodisplay subsystem all all
ELS config> display subsystem bri all
ELS config> exit
Config>Ctrl p
* restart
* event
ELS config> prompt.
[M] means the command is available at the ELS> prompt.
* These commands function in the same way whether used for configuring or monitoring; their effect is temporary when used for monitoring.
Add [C]
Adds an event to an existing group or creates a new group. Group names must start with a letter and are case sensitive. You cannot add an entire subsystem to a group.
Syntax: add group_name subsystem.event_number
add
group name []? MyGroup
event []? gw.019
clear
You are about to clear all ELS configuration information
Are you sure you want to do this (Yes or No):
clear event gw.019
clear group groupb
clear subsystem gw
default display event snmp.016
default trap subsystem snmp
delete Mygroup gw.019Removes an entire group. Example:
delete Mygroup all
You can use the display command to turn on all subsystem messages at all logging levels in order to display a message to EVENT whenever any event occurs in the router.
CAUTION:
Do not turn on all subsystem messages at all logging levels for extended periods of time when the router is forwarding live protocal traffic because the router spends an inordinate amount of time communicating with EVENT. You should never turn on all subsystem messages at all logging levels when you are communicating with the router via a remote terminal. It causes the router to spend most of its time communicating with the remote terminal.
display event gw.019
display group groupb
display subsystem eth
exit
list all
list groups
Group: test
GW.019
list pin
Pin: 100 events/second
list status
Subsystem: ETH
Disp levels: STANDARD
Trap levels: none
Subsystem: IP
Disp levels: STANDARD
Trap levels: none
Subsystem: RIP
Disp levels: STANDARD
Trap levels: none
Subsystem: SNMP
Disp levels: STANDARD
Trap levels: none
Event Display Trap
ISDN.021 Unset On
list subsystems summary
Name Events Description
ALL All subsystems
GW 101 Router base and network library
FLT 35 Filter Library
BRS 5 Bandwidth Reservation
ARP 22 Address Resolution Protocol
IP 91 Internet Protocol
ICMP 20 Internet Control Message Protocol
TCP 55 TCP
UDP 7 User Datagram Protocol
BTP 13 BOOTP relay agent
RIP 41 IP Routing Information Protocol
TFTP 29 TFTP Protocol
SNMP 21 Simple Network Management Protocol
DN 115 DECnet
XNS 1 Xerox Networking Systems Protocol
IPX 236 Internetwork Packet Exchange Protocol
IW 71 IPX WAN Protocol
APL 59 AppleTalk
AP2 68 AppleTalk Phase 2
ZIP2 51 Appletalk Phase 2 Zone Information Protocol
DDS 35 Apollo Domain Protocol
R2MP 38 Appletalk Phase 2 Routing Table Management Protocol
SRT 88 Source Routing Transparent Bridge
STP 32 Spanning Tree Protocol
BR 30 Bridge/Routing
ETH 47 Ethernet Handler
PPP 174 Point-to-Point
BRI 48 Basic Rate ISDN
IPPN 9 IP Protocol Net
WRR 28 WAN ReRoute
MCF 9 MAC Filtering
COMP 10 Data Compression Engines
NBS 50 NetBIOS Support Subsystem
CIRC 45 Circuit Subsystem
NAT 32 Network Address Translation
list subsystems bri
Event Level Message
BRI.021 P-TRACE Chn %d ConnID 0x%x RxD Pkt ln %d dev %s
BRI.022 U-TRACE ConnID 0x%x Rxd %s Pkt ln %d bd stt %s dev %s
BRI.023 C-TRACE ConnID 0x%x Rxd N_STAT_IN ln %d cause 0x%x:0x%x dev %s
BRI.024 UE-ERROR Start Rq bd st (0x%x) dev %s
BRI.025 C-INFO Start ok dev %s
BRI.026 C-INFO Hndlr inidev() st %s dev %s
BRI.027 C-INFO Hndlr N_START_RQ dev %s
BRI.028 C-INFO Can't N_START_RQ DCT i/o flg (0x%x:0x%x) dev %s
BRI.029 UE-ERROR Brd Crsh -- rstrng: dev %s
BRI.030 UE-ERROR Tx Frm too long (%d > %d) dev %s
BRI.031 U-INFO Cll rfsd frm %s:%s to %s:%s on dev %s
BRI.032 C-INFO Chn %d ConnID 0x%x Cll Txcmp on dev %s
BRI.033 C-INFO Chn %d ConnID 0x%x FSM st %s ev %s -> %s dev %s
list all
list active ip
Event Active Count
IP.007 D 238894
IP.022 T 2
IP.036 DT 237498
IP.059 1
IP.061 1397
IP.068 8109
IP.070 28
IP.072 3
|
D
| Enabled for logging to the local terminal |
|
T
| Enabled for remote logging via an snmp trap |
|
DT
| Both logging to a local terminal and remote logging via an snmp trap |
|
Blank
| Disabled |
event event.name
Lists the logging level, the message, and the count of the specified event.
Example: list event ip.007
Level: p-TRACE
Message: %I -> %I
Active: Count: 84182
list groups
list pin
Pin: 100 events/second
list subsystems circ
Event Level Message
CIRC.001 UE-ERROR Dv up nt %d int %s/%d
CIRC.002 UE-ERROR Dv fld slf tst nt %d int %s/%d
CIRC.003 UE-ERROR Dv dwn nt %d int %s/%d
CIRC.004 U-INFO Op ovfl nt %d int %s/%d
CIRC.005 C-INFO Dv dwn, disc pkt on nt %d int %s/%d
CIRC.006 U-INFO Int dis nt %d int %s/%d
CIRC.007 UI-ERROR IP q alloc fl nt %d int %s/%d, avl %d
CIRC.008 C-TRACE Cmd %s from %s to %s (Nt %d int %s/%d)
CIRC.009 C-TRACE Ev %s from %s to %s (Nt %d int %s/%d)
CIRC.010 UI-ERROR Service %s inst fail err '%s'
CIRC.011 UI-ERROR Alloc of buffer failed
CIRC.012 UI-ERROR No Packet Rcvr
CIRC.013 UI-ERROR Circuit err %s nt %d int %s/%d
CIRC.014 UI-ERROR Prot Stk %s open fail err '%s'
CIRC.015 UE-ERROR Dev fld mnt nt %d int %s/%d
<more>
list subsystems summary
Name Events Description
ALL All subsystems
GW 101 Router base and network library
FLT 35 Filter Library
BRS 5 Bandwidth Reservation
ARP 22 Address Resolution Protocol
IP 91 Internet Protocol
ICMP 20 Internet Control Message Protocol
TCP 55 TCP
UDP 7 User Datagram Protocol
BTP 13 BOOTP relay agent
RIP 41 IP Routing Information Protocol
TFTP 29 TFTP Protocol
SNMP 21 Simple Network Management Protocol
DN 115 DECnet
XNS 1 Xerox Networking Systems Protocol
IPX 236 Internetwork Packet Exchange Protocol
IW 71 IPX WAN Protocol
APL 59 AppleTalk
AP2 68 AppleTalk Phase 2
ZIP2 51 Appletalk Phase 2 Zone Information Protocol
DDS 35 Apollo Domain Protocol
R2MP 38 Appletalk Phase 2 Routing Table Management Protocol
SRT 88 Source Routing Transparent Bridge
STP 32 Spanning Tree Protocol
BR 30 Bridge/Routing
ETH 47 Ethernet Handler
PPP 174 Point-to-Point
BRI 48 Basic Rate ISDN
IPPN 9 IP Protocol Net
WRR 28 WAN ReRoute
MCF 9 MAC Filtering
COMP 10 Data Compression Engines
NBS 50 NetBIOS Support Subsystem
CIRC 45 Circuit Subsystem
NAT 32 Network Address Translation
list subsystems allGW.002 ALWAYS Portable CGW %s Rel %s strtd
nodisplay event gw.019
nodisplay group groupb
nodisplay subsystem isdn
notrap event gw.019
notrap group groupb
notrap subsystem eth error
remove
restore
retrieve
save
set pin 100
set timestamp timeofday
.
.
.
16:21:07 BRI.045: Status Indication: LINE_NOT_READY
16:21:06 BRI.003: ConnID 0xFF Status msg cause (0x1A:0x0) on nt 1 int PPP/0
16:23:34 BRI.043: CLIENT CONNREQ: index 0, physchan 0
16:23:34 BRI.043: CLIENT CONNREQ: proceeding index 0, physchan 65535
16:23:34 BRI.033: Chn 65536 ConnID 0xFFFF FSM st Idle ev ConnReq -> Call_Init 0
16:23:34 BRI.046: NET CONNREQ: index 0, dialing ph# [1-555-8797:]
16:23:34 BRI.032: Chn 0 ConnID 0x0 Cll Txcmp on nt 1 int PPP/0
16:23:35 BRI.015: Chn 0 FSM st Idle ev ConnReq -> Call_Init nt 1 int PPP/0
.
.
.
statistics
Subsys Vector Exist String Active Heap
GW 110 101 3346 3 36
FLT 80 35 818 0 0
BRS 10 5 201 0 0
ARP 25 22 710 0 0
IP 100 91 2482 0 0
ICMP 30 20 506 0 0
TCP 60 55 2353 0 0
UDP 10 7 201 0 0
BTP 40 13 687 0 0
RIP 45 41 1237 0 0
TFTP 35 29 769 0 0
SNMP 30 21 624 0 0
IPX 260 236 4973 0 0
IW 90 71 2624 0 0
APL 60 59 68 0 0
AP2 80 68 1733 0 0
ZIP2 60 51 1859 0 0
DDS 50 35 40 0 0
R2MP 50 38 1233 0 0
SRT 120 88 4693 0 0
STP 60 32 1590 0 0
BR 50 30 1616 0 0
ETH 60 47 1098 0 0
PPP 175 174 6072 0 0
BRI 55 48 1757 0 0
IPPN 20 9 323 0 0
WRR 40 28 1601 0 0
MCF 15 9 239 0 0
COMP 80 10 305 0 0
NBS 100 50 3025 0 0
CIRC 45 45 1626 0 0
NAT 40 32 1139 0 0
Total 2265 1716 51584 3 36
Maximum: 5306 vector, 132 subsystem
Memory: 47754/528 vector + 28408/52433 data + 36 heap = 129159
Trap [C] [M]
Selects the message to be sent to the remote SNMP workstation. Do not use this ELS feature on a router that is passing live protocol traffic as it causes the router to dedicate most of its processing time to trapping and sending ELS messages.
You can specify the logging level of the trapped messages.
Syntax: trap
trap event gw.019
trap group groupb
trap subsystem gw