Using the Event Management System/Logging
We use the general term event for any type of occurrence
on a switch that could generate a log message or require an action.
For example, a link going down, a user logging in, a command entered on
the command line, or the software executing a debugging statement, are all events that
might generate a log message. The system for saving, displaying, and filtering events is
called the Event Management System (EMS). With EMS, you have many options about which
events generate log messages, where the messages are sent, and how they are
displayed.
Using EMS you can:
- Send event messages to a number of logging targets (for example,
syslog host and NVRAM).
- Filter events per target, by:
- Component, subcomponent, or specific condition (for example,
BGP messages, IGMP.Snooping messages, or the IP.Forwarding.SlowPathDrop
condition)
- Match expression (for example, any messages containing the
string “user5”)
- Matching parameters (for example, only messages with source
IP addresses in the 10.1.2.0/24 subnet)
- Severity level (for example, only messages of severity
critical, error, or warning)
- Change the format of event messages (for example, display the
date as “12-May-2005” or “2005-05-12”).
- Display log messages in real time and filter the messages that
are displayed, both on the console and from Telnet sessions.
- Display stored log messages from the memory buffer or
NVRAM.
- Upload event logs stored in memory buffer or NVRAM to a TFTP
server.
- Display counts of event occurrences, even those not included in
filter.
- Display debug information using a consistent configuration
method.
EMS supports IPv6 as a parameter for filtering events.