We use the general term event for any type of occurrence on a switch that could generate a log message or require an action.
For example, a link going down, a user logging in, a command entered on the command line, or the software executing a debugging statement, are all events that might generate a log message. The system for saving, displaying, and filtering events is called the EMS. With EMS, you have many options about which events generate log messages, where the messages are sent, and how they are displayed.
Using EMS you can:
Send event messages to a number of logging targets (for example, syslog host and NVRAM).
Filter events per target, by:
Component, subcomponent, or specific condition (for example, BGP messages, IGMP. Snooping messages, or the IP.Forwarding.SlowPathDrop condition).
Match expression (for example, any messages containing the string “user 5”).
Matching parameters (for example, only messages with source IP addresses in the 10.1.2.0/24 subnet).
Severity level (for example, only messages of severity critical, error, or warning).
Change the format of event messages (for example, display the date as “12-May-2005” or “2005-05-12”).
Display log messages in real time and filter the messages that are displayed, both on the console and from Telnet sessions.
Display stored log messages from the memory buffer or NVRAM.
Upload event logs stored in memory buffer or NVRAM to a TFTP server.
Display counts of event occurrences, even those not included in filter.
Display debug information using a consistent configuration method.
EMS supports IPv6 as a parameter for filtering events.
ExtremeCloud IQ Agent logging defaults to in-memory, buffer-based logging instead of continuous on-disk file logging, reducing storage consumption. Buffer logs are included in show tech-support output for diagnostics. File-based logging is disabled by default and available on demand via debug CLI. After upgrading to version 33.7.1, file-based logging is off by default, but existing log files are preserved.
