This section provides information on the RASLog message format.
The following example shows the format of a RASLog message.
<Timestamp>, [<Event ID>], <Sequence Number>, <Flags>,<Severity>,<Switch name>, <Event-specific information>
The following example shows the sample messages from the log.
[...] 2023/04/27-02:48:30, [SEC-3022], 7,, INFO, SLX9740-80C, Event: logout, Status: success, Info: Successful logout by user [admin]. 2023/04/27-02:48:40, [SEC-1206], 8,, INFO, SLX9740-80C, Login information: User [admin via telnet] Last Successful Login Time : Sat Apr 27 02:32:59 2023. 2023/04/27-02:48:40, [SEC-1203], 9,, INFO, SLX9740-80C, Login information: User [admin] Login successful via TELNET/SSH/RSH. IP Addr: 134.141.245.254. 2023/04/27-03:15:52, [SEC-3022], 10,, INFO, SLX9740-80C, Event: logout, Status: success, Info: Successful logout by user [admin]. [...]
The following table describes the fields in the error message.
| Variable name | Description |
|---|---|
| Timestamp |
The system time (UTC) when the message was generated on the switch. The RASLog subsystem supports an internationalized time stamp format that is based on the “LOCAL” setting. |
| Event ID |
The Event ID, which is the message module and number. These values uniquely identify each message in SLX-OS and reference the cause and actions recommended in this document. Note that not all message numbers are used; the numeric message sequence can contain gaps. |
| Sequence Number |
The error message position in the log. When a new message is added to the log, this number is incremented by 1. The message sequence number starts at 1 after a firmware download operation and increases to a value of as much as 2,147,483,647 (0x7ffffff). The sequence number continues to increase after the message log wraps around; that is, the oldest message in the log is deleted when a new message is added. The message sequence numbering is not split for the system and DCE message logs. The sequence number can be reset to 1 by using the clear logging raslog command. However, the sequence number is not reset if you clear a particular message type, for example, DCE. The sequence number is persistent across power cycles and switch reboots. |
| Flags |
For most messages, a space character (null value) indicating that the message is neither a DCE or FFDC message. Messages may contain the following values: • DCE: Indicates a message generated by the protocol-based modules. • FFDC: Indicates that additional first failure data capture information has also been generated for this event. |
| Severity |
The severity level of the message, which can be one of the following: • CRITICAL • ERROR • WARNING • INFO |
| Switch name |
The defined switch name or chassis name of the switch. This value is truncated if it exceeds 16 characters. |
|
Event-specific information |
A text string explaining the error encountered and providing the parameters supplied by the software at run time. |
Compared to LOG error messages, messages flagged as AUDIT provide additional user and system-related information of interest for post-event auditing and problem determination.
The following example shows the format of the AUDIT event message.
<Sequence Number> AUDIT, <Timestamp>, [<Event ID>], <Severity>, <Event Class>, <User ID>/<Role>/<IP address>/<Interface>/<app name>, <Reserved field for future expansion>, <Switch name>, <Event-specific information>
The following is a sample AUDIT event message.
730 AUDIT, 2024/04/27-03:15:52 (GMT), [SEC-3022], INFO, SECURITY, admin/admin/134.141.245.254/telnet/CLI,, SLX9740-80C, Event: logout, Status: success, Info: Successful logout by user [admin].
The following table describes the fields in the AUDIT event message.
| Variable name | Description |
|---|---|
| Sequence Number | The error message position in the log. |
| AUDIT | An AUDIT message. |
| Timestamp |
The system time (UTC) when the message was generated on the switch. The RASLog subsystem supports an internationalized time stamp format that is based on the “LOCAL” setting. |
| Event ID |
The Event ID, which is the message module and number. These values uniquely identify each message in the SLX-OS and reference the cause and actions recommended in this document. Note that not all message numbers are used; the numeric message sequence can contain gaps. |
| Severity |
The severity level of the message, which can be one of the following: • CRITICAL • ERROR • WARNING • INFO |
| Event Class |
The event class, which can be one of the following: • DCMCFG • FIRMWARE • SECURITY |
| User ID | The user ID. |
| Role | The role of the user. |
| IP Address | The IP address. |
| Interface | The interface being used. |
| Application Name | The application name being used on the interface. |
|
Reserved field for future expansion |
This field is reserved for future use and contains a space character (null value). |
| Switch name |
The defined switch name or chassis name of the switch. This value is truncated if it is over 16 characters. |
|
Event-specific information |
A text string explaining the error encountered and providing the parameters supplied by the software at runtime. |