Using the Event Management System/Logging
We use the general term event for any
type of occurrence on a switch that could generate a log message or require an
For example, a link going down, a user logging in, a command entered on
the command line, or the software executing a debugging statement, are all events that
might generate a log message. The system for saving, displaying, and filtering events is
called the EMS. With EMS, you have many options about which events generate log
messages, where the messages are sent, and how they are displayed.
Using EMS you can:
- Send event messages to a number of logging targets (for example,
syslog host and NVRAM).
- Filter events per target, by:
- Component, subcomponent, or specific condition (for example,
IGMP. Snooping messages, or
the IP.Forwarding.SlowPathDrop condition).
- Match expression (for example, any messages containing the
string “user 5”).
- Matching parameters (for example, only messages with source
IP addresses in the 10.1.2.0/24 subnet).
- Severity level (for example, only messages of severity
critical, error, or warning).
- Change the format of event messages (for example, display the
date as “12-May-2005” or “2005-05-12”).
- Display log messages in real time and filter the messages that
are displayed, both on the console and from Telnet sessions.
- Display stored log messages from the memory buffer or
- Upload event logs stored in memory buffer or NVRAM to a TFTP
- Display counts of event occurrences, even those not included in
- Display debug information using a consistent configuration
EMS supports IPv6 as a parameter for filtering events.