Using the Event Management System/Logging

We use the general term event for any type of occurrence on a switch that could generate a log message or require an action.

For example, a link going down, a user logging in, a command entered on the command line, or the software executing a debugging statement, are all events that might generate a log message. The system for saving, displaying, and filtering events is called the EMS. With EMS, you have many options about which events generate log messages, where the messages are sent, and how they are displayed.

Using EMS you can:

Send event messages to a number of logging targets (for example, syslog host and NVRAM).
Filter events per target, by:
- Component, subcomponent, or specific condition (for example, BGP (Border Gateway Protocol) messages, IGMP (Internet Group Management Protocol). Snooping messages, or the IP.Forwarding.SlowPathDrop condition).
- Match expression (for example, any messages containing the string “user 5”).
- Matching parameters (for example, only messages with source IP addresses in the 10.1.2.0/24 subnet).
- Severity level (for example, only messages of severity critical, error, or warning).
Change the format of event messages (for example, display the date as “12-May-2005” or “2005-05-12”).
Display log messages in real time and filter the messages that are displayed, both on the console and from Telnet sessions.
Display stored log messages from the memory buffer or NVRAM.
Upload event logs stored in memory buffer or NVRAM to a TFTP server.
Display counts of event occurrences, even those not included in filter.
Display debug information using a consistent configuration method.