Using the Event Management System/Logging
We use the general term event for any
type of occurrence on a switch that could generate a log message or require an
action.
For example, a link going down, a user logging in, a command entered on
the command line, or the software executing a debugging statement, are all events that
might generate a log message. The system for saving, displaying, and filtering events is
called the . With EMS, you have many options about which
events generate log messages, where the messages are sent, and how they are
displayed.
Using EMS you can:
- Send event messages to a number of logging targets (for example,
syslog host and NVRAM).
- Filter events per target, by:
- Component, subcomponent, or specific condition (for example,
BGP (Border Gateway Protocol) messages,
IGMP (Internet Group Management Protocol).Snooping messages, or the
IP.Forwarding.SlowPathDrop condition)
- Match expression (for example, any messages containing the
string “user5”)
- Matching parameters (for example, only messages with source
IP addresses in the 10.1.2.0/24 subnet)
- Severity level (for example, only messages of severity
critical, error, or warning)
- Change the format of event messages (for example, display the
date as “12-May-2005” or “2005-05-12”).
- Display log messages in real time and filter the messages that
are displayed, both on the console and from Telnet sessions.
- Display stored log messages from the memory buffer or
NVRAM.
- Upload event logs stored in memory buffer or NVRAM to a TFTP
server.
- Display counts of event occurrences, even those not included in
filter.
- Display debug information using a consistent configuration
method.
EMS supports IPv6 as a parameter for filtering events.