How it Works
Cisco
Loading...
XR 1200 series
Command Reference Manual
432 pgs4.58 Mb0
Table of contents
Loading...

Cisco XR 1200 series Command Reference Manual

Download

Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1

Americas Headquarters
Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883
Text Part Number: OL-24735-01
THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating system. All rights reserved. Copyright©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULARPURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: http://
www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
©
2014 Cisco Systems, Inc. All rights reserved.

CONTENTS

Preface
CHAPTER 1
Preface xi
Changes to This Document xi
Obtaining Documentation and Submitting a Service Request xi
Alarm Management and Logging Correlation Commands 1
alarm 3
all-alarms 4
all-of-router 5
clear logging correlator delete 6
clear logging events delete 7
clear logging events reset 11
context-correlation 13
logging correlator apply rule 15
logging correlator apply ruleset 18
logging correlator buffer-size 20
logging correlator rule 22
logging correlator ruleset 25
logging events buffer-size 27
logging events display-location 29
logging events level 31
logging events threshold 33
logging suppress apply rule 35
logging suppress rule 37
nonrootcause 39
reissue-nonbistate 41
reparent 43
rootcause 45
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 iii
Contents
show logging correlator buffer 47
show logging correlator info 50
show logging correlator rule 52
show logging correlator ruleset 55
show logging events buffer 57
show logging events info 62
show logging suppress rule 64
show snmp correlator buffer 66
show snmp correlator info 68
show snmp correlator rule 69
show snmp correlator ruleset 70
source 71
timeout 72
CHAPTER 2
timeout-rootcause 74
Embedded Event Manager Commands 77
event manager directory user 78
event manager environment 80
event manager policy 82
event manager refresh-time 85
event manager run 86
event manager scheduler suspend 88
show event manager directory user 90
show event manager environment 92
show event manager metric hardware 94
show event manager metric process 96
show event manager policy available 100
show event manager policy registered 102
show event manager refresh-time 105
show event manager statistics-table 107
CHAPTER 3
IP Service Level Agreement Commands 111
access-list 115
action (IP SLA) 117
ageout 119
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
iv OL-24735-01
Contents
buckets (history) 121
buckets (statistics hourly) 123
buckets (statistics interval) 125
control disable 126
datasize request 128
destination address (IP SLA) 130
destination port 132
distribution count 134
distribution interval 136
exp 138
filter 140
force explicit-null 142
frequency (IP SLA) 144
history 146
interval 148
ipsla 150
key-chain 152
life 154
lives 156
low-memory 158
lsp selector ipv4 160
lsr-path 162
maximum hops 164
maximum paths (IP SLA) 166
monitor 168
mpls discovery vpn 170
mpls lsp-monitor 172
operation 174
output interface 175
output nexthop 177
packet count 179
packet interval 181
path discover 183
path discover echo 184
path discover path 186
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 v
Contents
path discover scan 188
path discover session 190
react 192
react lpd 195
reaction monitor 197
reaction operation 199
reaction trigger 201
responder 203
recurring 204
reply dscp 205
reply mode 207
scan delete-factor 209
scan interval 211
schedule monitor 213
schedule operation 215
schedule period 217
show ipsla application 219
show ipsla history 221
show ipsla mpls discovery vpn 224
show ipsla mpls lsp-monitor lpd 226
show ipsla mpls lsp-monitor scan-queue 228
show ipsla mpls lsp-monitor summary 230
show ipsla responder statistics ports 233
show ipsla statistics 235
show ipsla statistics aggregated 238
show ipsla statistics enhanced aggregated 247
source address 250
source port 252
start-time 253
statistics 256
tag (IP SLA) 259
target ipv4 261
target pseudowire 263
target traffic-eng 265
threshold 267
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
vi OL-24735-01
Contents
threshold type average 269
threshold type consecutive 271
threshold type immediate 273
threshold type xofy 275
timeout (IP SLA) 277
tos 279
ttl 281
type icmp echo 283
type icmp path-echo 284
type icmp path-jitter 285
type mpls lsp ping 286
type mpls lsp trace 288
CHAPTER 4
type udp echo 290
type udp jitter 291
type udp ipv4 address 292
verify-data 294
vrf (IP SLA) 295
vrf (IP SLA MPLS LSP monitor) 297
Logging Services Commands 299
archive-length 301
archive-size 302
clear logging 303
device 305
file-size 306
frequency (logging) 307
logging 308
logging archive 310
logging buffered 312
logging console 314
logging console disable 316
logging events link-status 317
logging events link-status (interface) 319
logging facility 322
logging history 325
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 vii
Contents
logging history size 327
logging hostnameprefix 329
logging localfilesize 331
logging monitor 332
logging source-interface 334
logging suppress deprecated 336
logging suppress duplicates 337
logging trap 339
service timestamps 341
severity 343
show logging 344
show logging history 348
terminal monitor 350
CHAPTER 5
CHAPTER 6
Onboard Failure Logging Commands 353
clear logging onboard 354
hw-module logging onboard 356
show logging onboard 358
Performance Management Commands 361
monitor controller fabric 362
monitor controller sonet 364
monitor interface 366
performance-mgmt apply monitor 371
performance-mgmt apply statistics 374
performance-mgmt apply thresholds 377
performance-mgmt regular-expression 380
performance-mgmt resources dump local 381
performance-mgmt resources memory 382
performance-mgmt resources tftp-server 384
performance-mgmt statistics 386
performance-mgmt thresholds 389
show performance-mgmt bgp 400
show performance-mgmt interface 402
show performance-mgmt mpls 405
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
viii OL-24735-01
Contents
show performance-mgmt node 407
show performance-mgmt ospf 409
show running performance-mgmt 411
CHAPTER 7
Statistics Service Commands 413
clear counters 414
load-interval 416
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 ix
Contents
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
x OL-24735-01

Preface

The Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router preface contains these sections:
Changes to This Document, page xi
•
Obtaining Documentation and Submitting a Service Request, page xi
•

Changes to This Document

Table 1 lists the technical changes made to this document since it was first printed.
Table 1: Changes to This Document
Change SummaryDateRevision
Initial release of this document.April 2011OL-24735-01

Obtaining Documentation and Submitting a Service Request

For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a service request, and gathering additional information, see What's New in Cisco Product Documentation, at: http://
www.cisco.com/c/en/us/td/docs/general/whatsnew/whatsnew.html.
Subscribe to What's New in Cisco Product Documentation, which lists all new and revised Cisco technical documentation, as an RSS feed and deliver content directly to your desktop using a reader application. The RSS feeds are a free service.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 xi
Obtaining Documentation and Submitting a Service Request
Preface
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
xii OL-24735-01

Alarm Management and Logging Correlation Commands

This module describes the commands used to manage alarms and configure logging correlation rules for system monitoring on the router.
For detailed information about alarm management and logging correlation concepts, configuration tasks, and examples, see the Implementing and Monitoring Alarms and Logging Correlation module in the Cisco IOS XR System Monitoring Configuration Guide for the Cisco XR 12000 Series Router.
For system logging commands, see the Logging Services Commands module.
For system logging concepts, see the Implementing Logging Services module in the Cisco IOS XR System Monitoring Configuration Guide for the Cisco XR 12000 Series Router.
alarm, page 3
•
all-alarms, page 4
•
all-of-router, page 5
•
clear logging correlator delete, page 6
•
clear logging events delete, page 7
•
clear logging events reset, page 11
•
context-correlation, page 13
•
logging correlator apply rule, page 15
•
logging correlator apply ruleset, page 18
•
logging correlator buffer-size, page 20
•
logging correlator rule, page 22
•
logging correlator ruleset, page 25
•
logging events buffer-size, page 27
•
logging events display-location, page 29
•
logging events level, page 31
•
logging events threshold, page 33
•
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 1
logging suppress apply rule, page 35
•
logging suppress rule, page 37
•
nonrootcause, page 39
•
reissue-nonbistate, page 41
•
reparent, page 43
•
rootcause, page 45
•
show logging correlator buffer, page 47
•
show logging correlator info, page 50
•
show logging correlator rule, page 52
•
show logging correlator ruleset, page 55
•
show logging events buffer, page 57
•
show logging events info, page 62
•
Alarm Management and Logging Correlation Commands
show logging suppress rule, page 64
•
show snmp correlator buffer, page 66
•
show snmp correlator info, page 68
•
show snmp correlator rule, page 69
•
show snmp correlator ruleset, page 70
•
source, page 71
•
timeout, page 72
•
timeout-rootcause, page 74
•
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
2 OL-24735-01
Alarm Management and Logging Correlation Commands

alarm

To specify a type of alarm to be suppressed by a logging suppression rule, use the alarm command in logging suppression rule configuration mode.
alarm msg-category group-name msg-code
alarm
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
Task ID
msg-category
group-name
msg-code
No alarm types are configured by default.
Logging suppression rule configuration
Message category of the root message.
Group name of the root message.
Message code of the root message.
ModificationRelease
This command was introduced.Release 3.8.0
OperationsTask ID
read, writelogging
Examples
This example shows how to configure the logging suppression rule “commit” to suppress alarms whose root message are “MBGL”, with group name “commit” and message code “succeeded”:
RP/0/0/CPU0:router(config)# logging suppress rule commit RP/0/0/CPU0:router(config-suppr-rule)# alarm MBGL COMMIT SUCCEEDED
Related Commands
DescriptionCommand
Creates a logging suppression rule.logging suppress rule, on page 37
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 3

all-alarms

all-alarms
Alarm Management and Logging Correlation Commands
To configure a logging suppression rule to suppress all types of alarms, use the all-alarms command in logging suppression rule configuration mode.
all-alarms
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
Task ID
Examples
This command has no keywords or arguments.
No alarm types are configured by default.
Logging suppression rule configuration
ModificationRelease
This command was introduced.Release 3.8.0
OperationsTask ID
read, writelogging
This example shows how to configure the logging suppression rule commit to suppress all alarms:
RP/0/0/CPU0:router(config)# logging suppress rule commit RP/0/0/CPU0:router(config-suppr-rule)# all-alarms
Related Commands
DescriptionCommand
Creates a logging suppression rule.logging suppress rule, on page 37
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
4 OL-24735-01
Alarm Management and Logging Correlation Commands

all-of-router

To apply a logging suppression rule to alarms originating from all locations on the router, use the all-of-router command in logging suppression apply rule configuration mode.
all-of-router
all-of-router
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
Task ID
Examples
This command has no keywords or arguments.
No scope is configured by default.
Logging suppression apply rule configuration
ModificationRelease
This command was introduced.Release 3.8.0
OperationsTask ID
executelogging
This example shows how to apply the logging suppression rule “commit” to all locations on the router:
RP/0/0/CPU0:router(config)# logging suppress apply rule commit RP/0/0/CPU0:router(config-suppr-apply-rule)# all-of-router
Related Commands
DescriptionCommand
Applies and activates a logging suppression rule.logging suppress apply rule, on page 35
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 5

clear logging correlator delete

clear logging correlator delete
To delete all messages or messages specified by a correlation ID from the logging correlator buffer, use the
clear logging correlator delete command in EXEC mode.
clear logging correlator delete {all-in-buffer| correlation-id}
Alarm Management and Logging Correlation Commands
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
Clears all messages in the logging correlator buffer.all-in-buffer
correlation-id
No messages are automatically deleted unless buffer capacity is reached.
EXEC
Use the show logging correlator buffer, on page 47 command to confirm that records have been cleared.
Use the logging correlator buffer-size, on page 20 command to configure the capacity of the logging correlator buffer.
Correlation event record ID. Up to 14 correlation IDs can be specified, separated by a space. Range is 0 to 4294967294.
ModificationRelease
This command was introduced.Release 3.2
Task ID
Examples
Related Commands
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
6 OL-24735-01
This example shows how to clear all records from the logging correlator buffer:
RP/0/0/CPU0:router# clear logging correlator delete all-in-buffer
OperationsTask ID
executelogging
DescriptionCommand
Displays messages in the logging correlator buffer.show logging correlator buffer, on page 47
Alarm Management and Logging Correlation Commands

clear logging events delete

To delete messages from the logging events buffer, use the clear logging events delete command in EXEC mode.
clear logging events delete
clear logging events delete
Syntax Description
category name
context name
event-hi-limit event-id
event-lo-limit event-id
first event-count
group message-group
last event-count
location node-id
Deletes only events at the administrative level.admin-level-only
Deletes all event IDs from the logging events buffer.all-in-buffer
Deletes bi-state alarms in the SET state.bistate-alarms-set
Deletes events from a specified category.
Deletes events from a specified context.
Deletes events with an event ID equal to or lower than the event ID specified with the event-id argument. Range is 0 to 4294967294.
Deletes events with an event ID equal to or higher than the event ID specified with the event-id argument. Range is 0 to 4294967294.
Deletes events, beginning with the first event in the logging events buffer. For the event-count argument, enter the number of events to be deleted.
Deletes events from a specified message group.
Deletes events, beginning with the last event in the logging events buffer. For the event-count argument, enter the number of events to be deleted.
Deletes messages from the logging events buffer for the specified location. The node-id argument is entered in the rack/slot/module notation.
message message-code
severity-hi-limit
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 7
Deletes events with the specified message code.
Deletes events with a severity level equal to or lower than the severity level specified with the severity argument.
clear logging events delete
Alarm Management and Logging Correlation Commands
severity
severity-lo-limit
timestamp-hi-limit
Severity level. Valid values are:
alerts
•
critical
•
emergencies
•
errors
•
informational
•
notifications
•
warnings
•
Note
Settings for the severity levels and their respective system conditions are listed under the “Usage Guidelines” section for the logging events level command. Events of lower severity level represent events of higher importance.
Deletes events with a severity level equal to or higher than the severity level specified with the severity argument.
Deletes events with a time stamp equal to or lower than the specified time stamp.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
8 OL-24735-01
Alarm Management and Logging Correlation Commands
clear logging events delete
hh : mm : ss [month] [day] [year]
Time stamp for the timestamp-hi-limit or timestamp-lo-limit keyword. The month, day, and year arguments default to the current month, day, and year, if not specified.
Ranges for the hh : mm : ss month day year arguments are as follows:
• hh :—Hours. Range is 00 to 23. You must insert a colon after the hh
argument.
• mm :—Minutes. Range is 00 to 59. You must insert a colon after the mm
argument.
• ss—Seconds. Range is 00 to 59.
• month—(Optional) The month of the year. The values for the month
argument are:
january
◦
february
◦
march
◦
april
◦
may
◦
june
◦
july
◦
Command Default
Command Modes
august
◦
september
◦
october
◦
november
◦
december
◦
• day—(Optional) Day of the month. Range is 01 to 31.
◦ year—(Optional) Year. Enter the last two digits of the year (for
example, 04 for 2004). Range is 01 to 37.
timestamp-lo-limit
Deletes events with a time stamp equal to or higher than the specified time stamp.
No messages are automatically deleted unless buffer capacity is reached.
EXEC
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 9
clear logging events delete
Alarm Management and Logging Correlation Commands
Command History
Usage Guidelines
Task ID
Examples
ModificationRelease
This command was introduced.Release 3.2
This command is used to delete messages from the logging events buffer that match the keywords and arguments that you specify. The description is matched if all of the conditions are met.
Use the show logging events buffer, on page 57 command to verify that events have been cleared from the logging events buffer.
Use the logging events buffer-size, on page 27 command to configure the capacity of the logging events buffer.
OperationsTask ID
executelogging
This example shows how to delete all messages from the logging events buffer:
RP/0/0/CPU0:router# clear logging events delete all-in-buffer
Related Commands
DescriptionCommand
Resets bi-state alarms.clear logging events reset, on page 11
Displays messages in the logging events buffer.show logging events buffer, on page 57
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
10 OL-24735-01
Alarm Management and Logging Correlation Commands

clear logging events reset

To reset bi-state alarms, use the clear logging events reset command in EXEC mode.
clear logging events reset {all-in-buffer| event-id}
clear logging events reset
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
Resets all bi-state alarm messages in the event logging buffer.all-in-buffer
event-id
None
EXEC
This command clears bi-state alarms messages from the logging events buffer. Bi-state alarms are generated by state changes associated with system hardware, such as a change of interface state from active to inactive, or the online insertion and removal (OIR) of a Modular Service Card (MSC), or a change in component temperature.
Use the show logging events buffer, on page 57 command to display messages in the logging events buffer.
Event ID. Resets the bi-state alarm for an event or events. Up to 32 event IDs can be specified, separated by a space. Range is 0 to 4294967294.
ModificationRelease
This command was introduced.Release 3.2
Task ID
Examples
OL-24735-01 11
This example shows how to reset all bi-alarms in the logging events buffer:
RP/0/0/CPU0:router# clear logging events reset all-in-buffer
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OperationsTask ID
executelogging
clear logging events reset
Alarm Management and Logging Correlation Commands
Related Commands
clear logging events delete, on page 7
DescriptionCommand
Deletes all bi-state alarm messages, or messages specified by correlation ID, from the logging events buffer.
Displays messages in the logging events buffer.show logging events buffer, on page 57
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
12 OL-24735-01
Alarm Management and Logging Correlation Commands

context-correlation

To enable context-specific correlation, use the context-correlation command in either stateful or nonstateful correlation rule configuration mode. To disable correlation on context, use the no form of this command.
context-correlation
no context-correlation
context-correlation
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
This command has no keywords or arguments.
Correlation on context is not enabled.
Stateful correlation rule configuration
Nonstateful correlation rule configuration
ModificationRelease
This command was introduced.Release 3.6.0
This command enables context-specific correlation for each of the contexts in which a given rule is applied. For example, if the rule is applied to two contexts (context1 and context2), messages that have context “context1” are correlated separately from those messages with context “context2”.
Use the show logging correlator rule, on page 52 command to show the current setting for the context-correlation flag.
Task ID
OperationsTask ID
read, writelogging
Examples
Related Commands
This example shows how to enable correlation on context for a stateful correlation rule:
RP/0/0/CPU0:router(config)# logging correlator rule stateful_rule type stateful RP/0/0/CPU0:router(config-corr-rule-st)# context-correlation
DescriptionCommand
Defines the rules for correlating messages.logging correlator rule, on page 22
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 13
context-correlation
Alarm Management and Logging Correlation Commands
DescriptionCommand
show logging correlator rule, on page 52
Displays one or more predefined logging correlator rules.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
14 OL-24735-01
Alarm Management and Logging Correlation Commands

logging correlator apply rule

To apply and activate a correlation rule and enter correlation apply rule configuration mode, use the logging correlator apply rule command in global configuration mode. To deactivate a correlation rule, use the no
form of this command.
logging correlator apply rule correlation-rule [all-of-router| context name| location node-id]
no logging correlator apply rule correlation-rule [all-of-router| context name| location node-id]
logging correlator apply rule
Syntax Description
Command Default
Command Modes
Command History
correlation-rule
context name
location node-id
No correlation rules are applied.
Global configuration
Name of the correlation rule to be applied.
(Optional) Applies the correlation rule to the entire router.all-of-router
(Optional) Applies the correlation rule to the specified context. Unlimited number of contexts. The name string is limited to 32 characters.
(Optional) Applies the correlation rule to the specified node. The node-id argument is entered in the rack/slot/module notation. Unlimited number of locations.
ModificationRelease
This command was introduced.Release 3.6.0
Usage Guidelines
OL-24735-01 15
The logging correlator apply rule command is used to either add or remove apply settings for a given rule. These settings then determine which messages are correlated for the affected rules.
If the rule is applied to all-of-router, then correlation occurs for only those messages that match the configured cause values for the rule to be correlated, regardless of the context or location setting of that message.
If a rule is applied to a specific set of contexts or locations, then correlation occurs for only those messages that match both the configured cause values for the rule and at least one of those contexts or locations.
Use the show logging correlator rule, on page 52 command to show the current apply settings for a given rule.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
logging correlator apply rule
When a rule is applied (or if a rule set that contains this rule is applied), then the rule definition cannot be
Tip
modified through the configuration until the rule or rule set is once again unapplied.
It is possible to configure apply settings at the same time for both a rule and zero or more rule sets that
Tip
contain the rule. In this case, the apply settings for the rule are the union of all the apply configurations.
The logging correlator apply rule command allows you to enter submode (config-corr-apply-rule) to apply and activate rules:
RP/0/0/CPU0:router(config)# logging correlator apply rule stateful1 RP/0/0/CPU0:router(config-corr-apply-rule)#?
all-of-router Apply the rule to all of the router clear Clear the uncommitted configuration clear Clear the configuration commit Commit the configuration changes to running context Apply rule to specified context describe Describe a command without taking real actions do Run an exec command exit Exit from this submode location Apply rule to specified location no Negate a command or set its defaults pwd Commands used to reach current submode root Exit to the global configuration mode show Show contents of configuration
RP/0/0/CPU0:router(config-corr-apply-rule)#
While in the submode, you can negate keyword options:
Alarm Management and Logging Correlation Commands
Task ID
Examples
Related Commands
RP/0/0/CPU0:router(config-corr-apply-rule)# no all-of-router RP/0/0/CPU0:router(config-corr-apply-rule)# no context RP/0/0/CPU0:router(config-corr-apply-rule)# no location
OperationsTask ID
read, writelogging
This example shows how to apply a predefined correlator rule to a location:
RP/0/0/CPU0:router(config)# logging correlator apply rule rule1 RP/0/0/CPU0:router(config-corr-apply-rule)# location 0/2/CPU0
DescriptionCommand
Defines the rules for correlating messages.logging correlator rule, on page 22
show logging correlator rule, on page 52
Displays one or more predefined logging correlator rules.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
16 OL-24735-01
Alarm Management and Logging Correlation Commands
logging correlator apply rule
DescriptionCommand
show logging correlator ruleset, on page 55
Displays one or more predefined logging correlator rule sets.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 17

logging correlator apply ruleset

logging correlator apply ruleset
To apply and activate a correlation rule set and enter correlation apply rule set configuration mode, use the logging correlator apply ruleset command in global configuration mode. To deactivate a correlation rule set, use the no form of this command.
logging correlator apply ruleset correlation-ruleset [all-of-router| context name| location node-id]
no logging correlator apply ruleset correlation-ruleset [all-of-router| context name| location node-id]
Alarm Management and Logging Correlation Commands
Syntax Description
Command Default
Command Modes
Command History
correlation-ruleset
context name
location node-id
No correlation rule sets are applied.
Global configuration
Name of the correlation rule set to be applied.
(Optional) Applies the correlation rule set to the entire router.all-of-router
(Optional) Applies the correlation rule set to the specified context. Unlimited number of contexts. The name string is limited to 32 characters.
(Optional) Applies the correlation rule to the specified node. The node-id argument is entered in the rack/slot/module notation. Unlimited number of locations.
ModificationRelease
This command was introduced.Release 3.6.0
Usage Guidelines
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
18 OL-24735-01
The logging correlator apply ruleset command is used to either add or remove apply settings for a given rule set. These settings then determine which messages are correlated for the affected rules.
If the rule set is applied to all-of-router, then correlation occurs for only those messages that match the configured cause values for the rule to be correlated, regardless of the context or location setting of that message.
If a rule set is applied to a specific set of contexts or locations, then correlation occurs for only those messages that match both the configured cause values for the rule and at least one of those contexts or locations.
Use the show logging correlator ruleset, on page 55 command to show the current apply settings for a given rule set.
Alarm Management and Logging Correlation Commands
When a rule is applied (or if a rule set that contains this rule is applied), then the rule definition cannot be
Tip
modified through the configuration until the rule or rule set is once again unapplied.
It is possible to configure apply settings at the same time for both a rule and zero or more rule sets that
Tip
contain the rule. In this case, the apply settings for the rule are the union of all the apply configurations.
The logging correlator apply ruleset command allows you to enter the submode (config-corr-apply-ruleset) to apply and activate rule sets:
RP/0/0/CPU0:router(config)# logging correlator apply ruleset ruleset1 RP/0/0/CPU0:router(config-corr-apply-ruleset)#?
all-of-router Apply the rule to all of the router clear Clear the uncommitted configuration clear Clear the configuration commit Commit the configuration changes to running context Apply rule to specified context describe Describe a command without taking real actions do Run an exec command exit Exit from this submode location Apply rule to specified location no Negate a command or set its defaults pwd Commands used to reach current submode root Exit to the global configuration mode show Show contents of configuration
RP/0/0/CPU0:router(config-corr-apply-ruleset)#
While in the submode, you can negate keyword options:
logging correlator apply ruleset
Task ID
Examples
Related Commands
RP/0/0/CPU0:router(config-corr-apply-ruleset)# no all-of-router RP/0/0/CPU0:router(config-corr-apply-ruleset)# no context RP/0/0/CPU0:router(config-corr-apply-ruleset)# no location
OperationsTask ID
read, writelogging
This example shows how to apply a predefined correlator rule set to the entire router:
RP/0/0/CPU0:router(config)# logging correlator apply ruleset ruleset1 RP/0/0/CPU0:router(config-corr-apply-rule)# all-of-router
DescriptionCommand
show logging correlator ruleset, on page 55
Displays one or more predefined logging correlator rule sets.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 19

logging correlator buffer-size

logging correlator buffer-size
To configure the logging correlator buffer size, use the logging correlator buffer-size command in global configuration mode. To return the buffer size to its default setting, use the no form of this command.
logging correlator buffer-size bytes
no logging correlator buffer-size bytes
Alarm Management and Logging Correlation Commands
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
bytes
bytes: 81920 bytes
Global configuration
The logging correlator buffer-size command configures the size of the correlation buffer. This buffer holds all the correlation records as well as the associated correlated messages. When the size of this buffer is exceeded, older correlations in the buffer are replaced with the newer incoming correlations. The criteria that are used to recycle these buffers are:
First, remove the oldest nonstateful correlation records from the buffer.
•
Then, if there are no more nonstateful correlations present; remove the oldest stateful correlation records.
•
The size, in bytes, of the logging correlator buffer. Range is 1024 to 52428800 bytes.
ModificationRelease
This command was introduced.Release 3.2
Use the show logging correlator info, on page 50 command to confirm the size of the buffer and the percentage of buffer space that is currently used. The show logging events buffer, on page 57 all-in-buffer command can be used to show the details of the buffer contents.
Task ID
Examples
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
20 OL-24735-01
This example shows how to set the logging correlator buffer size to 90000 bytes:
RP/0/0/CPU0:router(config)# logging correlator buffer-size 90000
OperationsTask ID
read, writelogging
Alarm Management and Logging Correlation Commands
logging correlator buffer-size
Related Commands
show logging correlator info, on page 50
DescriptionCommand
Displays the logging correlator buffer size and the percentage of the buffer occupied by correlated messages.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 21

logging correlator rule

logging correlator rule
To define the rules for correlating messages, use the logging correlator rule command in global configuration mode. To delete the correlation rule, use the no form of this command.
logging correlator rule correlation-rule type {stateful| nonstateful}
no logging correlator rule correlation-rule
Alarm Management and Logging Correlation Commands
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
correlation-rule
Name of the correlation rule to be applied.
Specifies the type of rule.type
Enters stateful correlation rule configuration mode.stateful
Enters nonstateful correlation rule configuration mode.nonstateful
No rules are defined.
Global configuration
ModificationRelease
This command was introduced.Release 3.6.0
The logging correlator rule command defines the correlation rules used by the correlator to store messages in the logging correlator buffer. A rule must, at a minimum, consist of three elements: a root-cause message, one or more non-root-cause messages, and a timeout.
When the root-cause message, or a non-root-cause message is received, the timer is started. Any non-root-cause messages are temporarily held, while the root-cause is sent to syslog. If, after the timer has expired, the root-cause and at least one non-root-cause message was received, a correlation is created and stored in the correlation buffer.
A rule can be of type stateful or nonstateful. Stateful rules allow non-root-cause messages to be sent from the correlation buffer if the bi-state root-cause alarm clears at a later time. Nonstateful rules result in correlations that are fixed and immutable after the correlation occurs.
Below are the rule parameters that are available while in stateful correlation rule configuration mode:
RP/0/0/CPU0:router(config-corr-rule-st)# ?
context-correlation Specify enable correlation on context nonrootcause nonrootcause alarm reissue-nonbistate Specify reissue of non-bistate alarms on parent clear
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
22 OL-24735-01
Alarm Management and Logging Correlation Commands
reparent Specify reparent of alarm on parent clear rootcause Specify root cause alarm: Category/Group/Code combos timeout Specify timeout timeout-rootcause Specify timeout for root-cause
RP/0/0/CPU0:router(config-corr-rule-st)#
Below are the rule parameters that are available while in nonstateful correlation rule configuration mode:
RP/0/0/CPU0:router(config-corr-rule-nonst)# ?
context-correlation Specify enable correlation on context nonrootcause nonrootcause alarm rootcause Specify root cause alarm: Category/Group/Code combos timeout Specify timeout timeout-rootcause Specify timeout for root-cause
RP/0/0/CPU0:router(config-corr-rule-nonst)#
logging correlator rule
Task ID
Examples
Note
Note
A rule cannot be deleted or modified while it is applied, so the no logging correlator apply command must be used to unapply the rule before it can be changed.
The name of the correlation rule must be unique across all rule types and is limited to a maximum length of 32 characters.
Use the show logging correlator buffer, on page 47 to display messages stored in the logging correlator buffer.
Use the show logging correlator rule, on page 52 command to verify correlation rule settings.
OperationsTask ID
read, writelogging
This example shows how to enter stateful correlation rule configuration mode to specify a collection duration period time for correlator messages sent to the logging events buffer:
RP/0/0/CPU0:router(config)# logging correlator rule state_rule type stateful RP/0/0/CPU0:router(config-corr-rule-st)# timeout 50000
Related Commands
DescriptionCommand
Applies and activates correlation rules.logging correlator apply rule, on page 15
nonrootcause, on page 39
Enters non-root-cause configuration mode and specifies a non-root-cause alarm.
reissue-nonbistate, on page 41
Reissues non-bistate alarm messages (events) from the correlator log after its root-cause alarm clears.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 23
logging correlator rule
Alarm Management and Logging Correlation Commands
DescriptionCommand
reparent, on page 43
show logging correlator rule, on page 52
timeout, on page 72
timeout-rootcause, on page 74
Reparents non-root-cause messages to the next highest active root-cause in a hierarchical correlation when their immediate parent clears.
Specifies a root-cause message alarm.rootcause, on page 45
Displays messages in the logging correlator buffer.show logging correlator buffer, on page 47
Displays one or more predefined logging correlator rules.
Specifies the collection period duration time for the logging correlator rule message.
Specifies an optional parameter for an applied correlation rule.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
24 OL-24735-01
Alarm Management and Logging Correlation Commands

logging correlator ruleset

To enter correlation rule set configuration mode and define a correlation rule set, use the logging correlator ruleset command in global configuration mode. To delete the correlation rule set, use the no form of this
command.
logging correlator ruleset correlation-ruleset rulename correlation-rulename
no logging correlator ruleset correlation-ruleset
logging correlator ruleset
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
correlation-ruleset
Name of the correlation rule set to be applied.
Specifies the correlation rule name.rulename
correlation-rulename
Name of the correlation rule name to be applied.
No rule sets are defined.
Global configuration
ModificationRelease
This command was introduced.Release 3.6.0
The logging correlator ruleset command defines a specific correlation rule set. A rule set name must be unique and is limited to a maximum length of 32 characters.
To apply a logging correlator rule set, use the logging correlator apply ruleset, on page 18 command.
Examples
Related Commands
This example shows how to specify a logging correlator rule set:
RP/0/0/CPU0:router(config)# logging correlator ruleset ruleset_1 RP/0/0/CPU0:router(config-corr-ruleset)# rulename state_rule RP/0/0/CPU0:router(config-corr-ruleset)# rulename state_rule2
DescriptionCommand
logging correlator apply ruleset, on page 18
Applies and activates a correlation rule set and enters correlation apply rule set configuration mode.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 25
logging correlator ruleset
Alarm Management and Logging Correlation Commands
DescriptionCommand
Displays messages in the logging correlator buffer.show logging correlator buffer, on page 47
Displays defined correlation rule set names.show logging correlator ruleset, on page 55
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
26 OL-24735-01
Alarm Management and Logging Correlation Commands

logging events buffer-size

To configure the size of the logging events buffer, use the logging events buffer-size command in global configuration mode. To restore the buffer size to the default value, use the no form of this command.
logging events buffer-size bytes
no logging events buffer-size bytes
logging events buffer-size
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
Note
bytes
bytes: 43200
Global configuration
The logging events buffer automatically adjusts to a multiple of the record size that is lower than or equal to the value configured for the bytes argument.
Use the show logging events info, on page 62 command to confirm the size of the logging events buffer.
The size, in bytes, of the logging events buffer. Range is 1024 to 1024000 bytes. The default is 43200 bytes.
ModificationRelease
This command was introduced.Release 3.2
Task ID
Examples
OL-24735-01 27
This example shows how to increase the logging events buffer size to 50000 bytes:
RP/0/0/CPU0:router(config)# logging events buffer-size 50000
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OperationsTask ID
read, writelogging
logging events buffer-size
Alarm Management and Logging Correlation Commands
Related Commands
logging events threshold, on page 33
show logging correlator info, on page 50
show logging events info, on page 62
DescriptionCommand
Specifies a severity level for logging alarm messages.logging events level, on page 31
Specifies the event logging buffer capacity threshold that, when surpassed, will generate an alarm.
Displays information about the size of the logging correlator buffer and available capacity.
Displays messages in the logging events buffer.show logging events buffer, on page 57
Displays configuration and operational messages about the logging events buffer.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
28 OL-24735-01
Alarm Management and Logging Correlation Commands

logging events display-location

To enable the alarm source location display field for bistate alarms in the output of the show logging and show logging events buffer command, use the logging events display-location command in global
configuration mode.
logging events display-location
no logging events display-location
logging events display-location
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
This command has no keywords or arguments.
The alarm source location display field in show logging output is not enabled.
Global configuration
ModificationRelease
This command was introduced.Release 3.8.0
The output of the show logging command for bistate alarms has been enhanced. Previously, the alarm source field in the output displayed the location of the process that logged the alarm. Use the logging events display-location command to configure the output of the show logging command to include an additional source field that displays the actual source of the alarm. The alarm source is displayed in a format that is consistent with alarm source identification in other platforms and equipment. The new alarm source display field aids accurate identification and isolation of the source of a fault.
By default, the output of the show logging command does not include the new alarm source identification field. If you enable the alarm source location display field in the show logging output, the same naming conventions are also used to display hardware locations in the show diag and show inventory command output.
Customer OSS tools may rely on the default output to parse and interpret the alarm output.Note
Task ID
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 29
OperationsTask ID
read, writelogging
logging events display-location
Alarm Management and Logging Correlation Commands
Examples
This example shows the show logging command output for bistate alarms before and after enabling the alarm source location display field:
RP/0/0/CPU0:router# show logging | inc Interface
Wed Aug 13 01:30:58.461 UTC LC/0/2/CPU0:Aug 12 01:20:54.073 : ifmgr[159]: %PKT_INFRA-LINK-5-CHANGED : Interface GigabitEthernet0/2/0/0, changed state to Administratively Down LC/0/2/CPU0:Aug 12 01:20:59.450 : ifmgr[159]: %PKT_INFRA-LINK-3-UPDOWN : Interface GigabitEthernet0/2/0/0, changed state to Down LC/0/2/CPU0:Aug 12 01:20:59.451 : ifmgr[159]: %PKT_INFRA-LINEPROTO-5-UPDOWN : Line protocol
on Interface GigabitEthernet0/2/0/0, changed state to Down RP/0/5/CPU0:Aug 12 01:22:11.496 : ifmgr[202]: %PKT_INFRA-LINK-5-CHANGED : Interface MgmtEth0/5/CPU0/0, changed state to Administratively Down RP/0/5/CPU0:Aug 12 01:23:23.842 : ifmgr[202]: %PKT_INFRA-LINK-3-UPDOWN : Interface MgmtEth0/5/CPU0/0, changed state to Down RP/0/5/CPU0:Aug 12 01:23:23.843 : ifmgr[202]: %PKT_INFRA-LINEPROTO-5-UPDOWN : Line protocol
on Interface MgmtEth0/5/CPU0/0, changed state to Down RP/0/5/CPU0:Aug 12 01:23:23.850 : ifmgr[202]: %PKT_INFRA-LINK-3-UPDOWN : Interface MgmtEth0/5/CPU0/0, changed state to Up RP/0/5/CPU0:Aug 12 01:23:23.856 : ifmgr[202]: %PKT_INFRA-LINEPROTO-5-UPDOWN : Line protocol
on Interface MgmtEth0/5/CPU0/0, changed state to Up
RP/0/0/CPU0:router# config Wed Aug 13 01:31:32.517 UTC
RP/0/0/CPU0:router(config)# logging events display-location
RP/0/0/CPU0:router(config)# commit
RP/0/0/CPU0:router(config)# exit
RP/0/0/CPU0:router# show logging | inc Interface
Related Commands
Wed Aug 13 01:31:48.141 UTC LC/0/2/CPU0:Aug 12 01:20:54.073 : ifmgr[159]: %PKT_INFRA-LINK-5-CHANGED : Interface GigabitEthernet0/2/0/0, changed state to Administratively Down LC/0/2/CPU0:Aug 12 01:20:59.450 : ifmgr[159]: %PKT_INFRA-LINK-3-UPDOWN : interface GigabitEthernet0/2/0/0: Interface GigabitEthernet0/2/0/0, changed state to Down LC/0/2/CPU0:Aug 12 01:20:59.451 : ifmgr[159]: %PKT_INFRA-LINEPROTO-5-UPDOWN : interface GigabitEthernet0/2/0/0: Line protocol on Interface GigabitEthernet0/2/0/0, changed state to Down RP/0/5/CPU0:Aug 12 01:22:11.496 : ifmgr[202]: %PKT_INFRA-LINK-5-CHANGED : Interface MgmtEth0/5/CPU0/0, changed state to Administratively Down RP/0/5/CPU0:Aug 12 01:23:23.842 : ifmgr[202]: %PKT_INFRA-LINK-3-UPDOWN : interface MgmtEth0/5/CPU0/0: Interface MgmtEth0/5/CPU0/0, changed state to Down RP/0/5/CPU0:Aug 12 01:23:23.843 : ifmgr[202]: %PKT_INFRA-LINEPROTO-5-UPDOWN : interface MgmtEth0/5/CPU0/0: Line protocol on Interface MgmtEth0/5/CPU0/0, changed state to Down RP/0/5/CPU0:Aug 12 01:23:23.850 : ifmgr[202]: %PKT_INFRA-LINK-3-UPDOWN : interface MgmtEth0/5/CPU0/0: Interface MgmtEth0/5/CPU0/0, changed state to Up RP/0/5/CPU0:Aug 12 01:23:23.856 : ifmgr[202]: %PKT_INFRA-LINEPROTO-5-UPDOWN : interface MgmtEth0/5/CPU0/0: Line protocol on Interface MgmtEth0/5/CPU0/0, changed state to Up
DescriptionCommand
Displays messages in the logging events buffer.show logging events buffer, on page 57
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
30 OL-24735-01
Alarm Management and Logging Correlation Commands

logging events level

To specify a severity level for logging alarm messages, use the logging events level command in global configuration mode. To return to the default value, use the no form of this command.
logging events level severity
no logging events level
logging events level
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
severity
All severity levels (from 0 to 6) are logged.
Global configuration
This command specifies the event severity necessary for alarm messages to be logged. Severity levels can be specified by the severity level description (for example, warnings). When a severity level is specified, events of equal or lower severity level are also written to the logging events buffer.
Severity level of events to be logged in the logging events buffer, including events of a higher severity level (numerically lower). Table 2: Alarm Severity Levels for Event
Logging, on page 31lists severity levels and their respective system conditions.
ModificationRelease
This command was introduced.Release 3.2
Events of lower severity level represent events of higher importance.Note
This table lists the system severity levels and their corresponding numeric values, and describes the corresponding system condition.
Table 2: Alarm Severity Levels for Event Logging
Logged System MessagesNumeric ValueSeverity Level Keyword
System is unusable.0emergencies
1alerts
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 31
Critical system condition exists requiring immediate action.
Critical system condition exists.2critical
logging events level
Alarm Management and Logging Correlation Commands
Logged System MessagesNumeric ValueSeverity Level Keyword
Noncritical errors.3errors
Warning conditions.4warnings
Task ID
Examples
Related Commands
5notifications
Notifications of changes to system configuration.
6informational
Information about changes to system state.
OperationsTask ID
read, writelogging
This example shows how to set the severity level for notification to warnings (level 4):
RP/0/0/CPU0:router(config)# logging events level warnings
DescriptionCommand
Specifies the logging events buffer size.logging events buffer-size, on page 27
logging events threshold, on page 33
Specifies the logging events buffer capacity threshold that, when surpassed, will generate an alarm.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
32 OL-24735-01
Alarm Management and Logging Correlation Commands

logging events threshold

To specify the logging events buffer threshold that, when surpassed, generates an alarm, use the logging events threshold command in global configuration mode. To return to the default value, use the no form of
this command.
logging events threshold percent
no logging events threshold
logging events threshold
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
percent
percent: 80 percent
Global configuration
This command can be configured to generate an alarm when 10 percent or more of the event buffer capacity is available.
The logging events buffer is circular; that is, when full it overwrites the oldest messages in the buffer. Once the logging events buffer reaches full capacity, the next threshold alarm is generated when the number of overwritten events surpasses the percentage of buffer capacity allocated to messages.
Use the show logging events info, on page 62 command to display the current threshold setting.
Minimum percentage of buffer capacity that must be allocated to messages before an alarm is generated. Range is 10 to 100. The default is 80 percent.
ModificationRelease
This command was introduced.Release 3.2
Task ID
Examples
OL-24735-01 33
This example shows how to configure the threshold setting to 95 percent of buffer capacity:
RP/0/0/CPU0:router(config)# logging events threshold 95
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OperationsTask ID
read, writelogging
logging events threshold
Alarm Management and Logging Correlation Commands
Related Commands
show logging events info, on page 62
DescriptionCommand
Specifies the logging correlator buffer size.logging events buffer-size, on page 27
Specifies a severity level for logging alarm messages.logging events level, on page 31
Displays configuration and operational messages about the logging events buffer.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
34 OL-24735-01
Alarm Management and Logging Correlation Commands

logging suppress apply rule

To apply and activate a logging suppression rule, use the logging suppress apply rule command in global configuration mode. To deactivate a logging suppression rule, use the no form of this command.
logging suppress apply rule rule-name [all-of-router| source location node-id]
no logging suppress apply rule rule-name [all-of-router| source location node-id]
logging suppress apply rule
Syntax Description
Command Default
Command Modes
Command History
rule-name
all-of-router
Name of the logging suppression rule to activate.
(Optional) Applies the specified logging suppression rule to alarms originating from all locations on the router.
source location node-id
(Optional) Applies the specified logging suppression rule to alarms originating from the specified node. The node-id argument is entered in the rack/slot/module notation.
No logging suppression rules are applied.
Global configuration
ModificationRelease
This command was introduced.Release 3.8.0
Usage Guidelines
Task ID
OperationsTask ID
read, writelogging
Examples
OL-24735-01 35
This example shows how to apply a predefined logging suppression rule to the entire router:
RP/0/0/CPU0:router(config)#logging suppress apply rule infobistate RP/0/0/CPU0:router(config-suppr-apply-rule)# all-of-router
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
logging suppress apply rule
Alarm Management and Logging Correlation Commands
Related Commands
all-of-router, on page 5
source, on page 71
DescriptionCommand
Applies a logging suppression rule to suppress alarms originating from all sources on the router.
Applies a logging suppression rule to alarms originating from a specific node on the router.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
36 OL-24735-01
Alarm Management and Logging Correlation Commands

logging suppress rule

To create a logging suppression rule and enter the configuration mode for the rule, use the logging suppress rule command in the global configuration mode. To remove a logging suppression rule, use the no form of
this command.
logging suppress rule rule-name [alarm msg-category group-name msg-code| all-alarms]
no logging suppress rule rule-name
logging suppress rule
Syntax Description
Command Default
Command Modes
Command History
rule-name
alarm
msg-category
group-name
msg-code
all-alarms
No logging suppression rules exist by default.
Global configuration
Name of the rule.
(Optional) Specifies a type of alarm to be suppressed by the logging suppression rule.
Message category of the root message.
Group name of the root message.
Message code of the root message.
(Optional) Specifies that the logging suppression rule suppresses all types of alarms.
ModificationRelease
This command was introduced.Release 3.8.0
Usage Guidelines
Task ID
OL-24735-01 37
If you use the logging suppress rule command without specifying a non-root-cause alarm, you can do so afterwards, by entering the alarm keyword at the prompt.
OperationsTask ID
read, writelogging
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
logging suppress rule
Alarm Management and Logging Correlation Commands
Examples
Related Commands
This example shows how to create a logging suppression rule called infobistate:
RP/0/0/CPU0:router(config)# logging suppress rule infobistate RP/0/0/CPU0:router(config-suppr-rule)#
DescriptionCommand
alarm, on page 3
Specifies a type of alarm to be suppressed by a logging suppression rule.
all-alarms, on page 4
Configures a logging suppression rule to suppress all types of alarms.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
38 OL-24735-01
Alarm Management and Logging Correlation Commands

nonrootcause

To enter the non-root-cause configuration mode and specify a non-root-cause alarm, use the nonrootcause command in stateful or nonstateful correlation rule configuration modes.
nonrootcause alarm msg-category group-name msg-code
no nonrootcause
nonrootcause
Syntax Description
Command Default
Command Modes
Command History
Non-root-cause alarm.alarm
msg-category
group-name
msg-code
Non-root-cause configuration mode and alarm are not specified.
Stateful correlation rule configuration
Nonstateful correlation rule configuration
(Optional) Message category assigned to the message. Unlimited messages (identified by message category, group, and code) can be specified, separated by a space.
(Optional) Message group assigned to the message. Unlimited messages (identified by message category, group, and code) can be specified, separated by a space.
(Optional) Message code assigned to the message. Unlimited messages (identified by message category, group, and code) can be specified, separated by a space.
ModificationRelease
This command was introduced.Release 3.6.0
Usage Guidelines
Task ID
OL-24735-01 39
This command is used to enter the non-root-cause configuration mode to configure one or more non-root-cause alarms associated with a particular correlation rule.
Use the show logging events info, on page 62 command to display the current threshold setting.
If you use the nonrootcause command without specifying a non-root-cause alarm, you can do so afterwards, by entering the alarm keyword at the prompt.
OperationsTask ID
read, writelogging
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
nonrootcause
Alarm Management and Logging Correlation Commands
Examples
Related Commands
This example shows how to enter non-root-cause configuration mode and display the commands that are available under this mode:
RP/0/0/CPU0:router(config)# logging correlator rule state_rule type stateful RP/0/0/CPU0:router(config-corr-rule-st)# nonrootcause RP/0/0/CPU0:router(config-corr-rule-st-nonrc)# ?
alarm Specify non-root cause alarm: Category/Group/Code combos clear Clear the uncommitted configuration clear Clear the configuration commit Commit the configuration changes to running describe Describe a command without taking real actions do Run an exec command exit Exit from this submode no Negate a command or set its defaults pwd Commands used to reach current submode root Exit to the global configuration mode show Show contents of configuration
This example shows how to specify a non-root-cause alarm for Layer 2 local SONET messages with an alarm severity of 4. The non-root-cause alarm is associated with the correlation rule named state_rule.
RP/0/0/CPU0:router(config-corr-rule-st-nonrc)# alarm L2 SONET_LOCAL ALARM
DescriptionCommand
Specifies the logging correlator buffer size.logging events buffer-size, on page 27
Specifies a severity level for logging alarm messages.logging events level, on page 31
logging events threshold, on page 33
show logging events info, on page 62
Specifies the logging events buffer capacity threshold that, when surpassed, will generate an alarm.
Displays configuration and operational messages about the logging events buffer.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
40 OL-24735-01
Alarm Management and Logging Correlation Commands

reissue-nonbistate

To reissue non-bistate alarm messages (events) from the correlator log after the root-cause alarm of a stateful rule clears, use the reissue-nonbistate command in stateful or nonstateful correlation rule configuration modes. To disable the reissue-nonbistate flag, use the no form of this command.
reissue-nonbistate
no reissue-nonbistate
reissue-nonbistate
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
Task ID
This command has no keywords or arguments.
Non-bistate alarm messages are not reissued after their root-cause alarm clears.
Stateful correlation rule configuration
Nonstateful correlation rule configuration
ModificationRelease
This command was introduced.Release 3.6.0
By default, when the root-cause alarm of a stateful correlation is cleared, any non-root-cause, bistate messages being held for that correlation are silently deleted and are not sent to syslog. If the non-bistate messages should be sent, use the reissue-nonbistate command for the rules where this behavior is required.
OperationsTask ID
read, writelogging
Examples
Related Commands
This example shows how to reissue nonbistate alarm messages:
RP/0/0/CPU0:router(config)# logging correlator rule state_rule type stateful RP/0/0/CPU0:router(config-corr-rule-st)# reissue-nonbistate
DescriptionCommand
Displays messages in the logging correlator buffer.show logging correlator buffer, on page 47
Displays messages in the logging events buffer.show logging events buffer, on page 57
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 41
reissue-nonbistate
Alarm Management and Logging Correlation Commands
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
42 OL-24735-01
Alarm Management and Logging Correlation Commands

reparent

To reparent non-root-cause messages to the next highest active rootcause in a hierarchical correlation when their immediate parent clears, use the reparent command in stateful correlation rule configuration mode. To disable the reparent flag, use the no form of this command.
reparent
no reparent
reparent
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
This command has no keywords or arguments.
A non-root-cause alarm is sent to syslog after a root-cause parent clears.
Stateful correlation rule configuration
ModificationRelease
This command was introduced.Release 3.6.0
Use the reparent command to specify what happens to non-root-cause alarms in a hierarchical correlation after their root-cause alarm clears. The following scenario illustrates why you may want to set the reparent flag.
Rule 1 with rootcause A and non-rootcause B
Rule 2 with rootcause B and non-rootcause C
(Alarm B is a non-rootcause for Rule 1 and a rootcause for Rule 2. For the purpose of this example, all the messages are bistate alarms.)
If both Rule 1 and Rule 2 each trigger a successful correlation, then a hierarchy is constructed that links these two correlations. When alarm B clears, alarm C would normally be sent to syslog, but the operator may choose to continue suppression of alarm C (hold it in the correlation buffer); because the rootcause that is higher in the hierarchy (alarm A) is still active.
The reparent flag allows you to specify non-root-cause behavior—if the flag is set, then alarm C becomes a child of rootcause alarm A; otherwise, alarm C is sent to syslog.
Note
OL-24735-01 43
Stateful behavior, such as reparenting, is supported only for bistate alarms. Bistate alarms are associated with system hardware, such as a change of interface state from active to inactive.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
reparent
Alarm Management and Logging Correlation Commands
Task ID
Examples
Related Commands
OperationsTask ID
read, writelogging
This example shows how to set the reparent flag for a stateful rule:
RP/0/0/CPU0:router(config)# logging correlator rule state_rule type stateful RP/0/0/CPU0:router(config-corr-rule-st)# reparent
DescriptionCommand
Defines the rules for correlating messages.logging correlator rule, on page 22
Displays messages in the logging correlator buffer.show logging correlator buffer, on page 47
show logging events info, on page 62
Displays configuration and operational messages about the logging events buffer.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
44 OL-24735-01
Alarm Management and Logging Correlation Commands

rootcause

To specify the root-cause alarm message, use the rootcause command in stateful or nonstateful correlation rule configuration modes.
rootcause msg-category group-name msg-code
no rootcause
rootcause
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
msg-category
group-name
msg-code
Message category of the root message.
Group name of the root message.
Message code of the root message.
Root-cause alarm is not specified.
Stateful correlation rule configuration
Nonstateful correlation rule configuration
ModificationRelease
This command was introduced.Release 3.6.0
This command is used to configure the root-cause message for a particular correlation rule. Messages are identified by their message category, group, and code. The category, group, and code each can contain up to 32 characters. The root-cause message for a stateful correlation rule should be a bi-state alarm.
Use the show logging events info, on page 62 command to display the root-cause and non-root-cause alarms for a correlation rule.
Task ID
OperationsTask ID
read, writelogging
Examples
OL-24735-01 45
This example shows how to configure a root-cause alarm for a stateful correlation rule:
RP/0/0/CPU0:router(config)# logging correlator rule state_rule type stateful RP/0/0/CPU0:router(config-corr-rule-st)# rootcause L2 SONET_LOCAL ALARM
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
rootcause
Alarm Management and Logging Correlation Commands
Related Commands
logging events threshold, on page 33
timeout-rootcause, on page 74
show logging events info, on page 62
DescriptionCommand
Specifies the logging correlator buffer size.logging events buffer-size, on page 27
Specifies a severity level for logging alarm messages.logging events level, on page 31
Specifies the logging events buffer capacity threshold that, when surpassed, will generate an alarm.
Specifies an optional parameter for an applied correlation rule.
Displays configuration and operational messages about the logging events buffer.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
46 OL-24735-01
Alarm Management and Logging Correlation Commands

show logging correlator buffer

To display messages in the logging correlator buffer, use the show logging correlator buffer command in EXEC mode.
show logging correlator buffer {all-in-buffer [ruletype [nonstateful| stateful]]| [rulesource [internal| user]]| rule-name correlation-rule1 ... correlation-rule14| correlationID correlation-id1 .. correlation-id14}
show logging correlator buffer
Syntax Description
Command Default
internal
rule-name
correlation-rule1...correlation-rule14
correlationID
correlation-id1..correlation-id14
None
Displays all messages in the correlation buffer.all-in-buffer
(Optional) Displays the ruletype filter.ruletype
(Optional) Displays the nonstateful rules.nonstateful
(Optional) Displays the stateful rules.stateful
(Optional) Displays the rulesource filter.rulesource
(Optional) Displays the internally defined rules from the rulesource filter.
(Optional) Displays the user-defined rules from the rulesource filter.user
Displays a messages associated with a correlation rule name. Up to 14 correlation rules can be specified, separated by a space.
Displays a message identified by correlation ID. Up to 14 correlation IDs can be specified, separated by a space. Range is 0 to 4294967294.
Command Modes
Command History
OL-24735-01 47
EXEC
ModificationRelease
This command was introduced.Release 3.2
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
show logging correlator buffer
Alarm Management and Logging Correlation Commands
ModificationRelease
Usage Guidelines
Task ID
Release 3.6.0
The following keywords were added:
internal
•
nonstateful
•
rulesource
•
ruletype
•
stateful
•
user
•
Range changed from 32 to 14 for correlationID and rule-name keywords.
This command displays messages from the logging correlator buffer that match the correlation ID or correlation rule name specified. When the all-in-buffer keyword is entered, all messages in the logging correlator buffer are displayed.
If the ruletype is not specified, then both stateful and nonstateful rules are displayed.
if the rulesource is not specified, then both user and internal rules are displayed.
OperationsTask ID
Examples
readlogging
This is the sample output from the show logging correlator buffer command:
RP/0/0/CPU0:router# show logging correlator buffer all-in-buffer
#C_id.id:Rule Name:Source :Context: Time : Text #14.1 :Rule1:RP/0/5/CPU0: :Aug 22 13:39:13.693 2007:ifmgr[196]: %PKT_INFRA-LINK-3-UPDOWN :
Interface MgmtEth0/5/CPU0/0, changed state to Down #14.2 :Rule1:RP/0/5/CPU0: :Aug 22 13:39:13.693 2007:ifmgr[196]: %PKT_INFRA-LINEPROTO-3-UPDOWN
: Line protocol on Interface MgmtEth0/5/CPU0/0, changed state to Down
This table describes the significant fields shown in the display.
Table 3: show logging correlator buffer Field Descriptions
DescriptionField
C_id.
Correlation ID assigned to a event that matches a logging correlation rule.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
48 OL-24735-01
Alarm Management and Logging Correlation Commands
show logging correlator buffer
DescriptionField
Related Commands
id
Rule Name
show logging correlator info, on page 50
show logging correlator rule, on page 52
An ID number assigned to each event matching a particular correlation rule. This event number serves as index to identify each individual event that has been matched for a logging correlation rule.
Name of the logging correlation rule that filters messages defined in a logging correlation rule to the logging correlator buffer.
Node from which the event is generated.Source
Date and time at which the event occurred.Time
Message string that delineates the event.Text
DescriptionCommand
Displays the logging correlator buffer size and the percentage of the buffer occupied by correlated messages.
Displays one or more predefined logging correlator rules.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 49

show logging correlator info

show logging correlator info
To display the logging correlator buffer size and the percentage of the buffer occupied by correlated messages, use the show correlator info command in EXEC mode.
show logging correlator info
Alarm Management and Logging Correlation Commands
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
Task ID
This command has no keywords or arguments.
None
EXEC
ModificationRelease
This command was introduced.Release 3.2
This command displays the size of the logging correlator buffer and the percentage of the buffer allocated to correlated messages.
Use the logging correlator buffer-size, on page 20 command to set the size of the buffer.
OperationsTask ID
readlogging
Examples
In this example, the show logging correlator info command is used to display remaining buffer size and percentage allocated to correlated messages:
RP/0/0/CPU0:router# show logging correlator info
Buffer-Size Percentage-Occupied
81920 0.00
Related Commands
DescriptionCommand
Specifies the logging correlator buffer size.logging correlator buffer-size, on page 20
Displays messages in the logging correlator buffer.show logging correlator buffer, on page 47
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
50 OL-24735-01
Alarm Management and Logging Correlation Commands
show logging correlator info
DescriptionCommand
show logging correlator rule, on page 52
Displays one or more predefined logging correlator rules.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 51

show logging correlator rule

show logging correlator rule
To display defined correlation rules, use the show logging correlator rule command in EXEC mode.
show logging correlator rule {all| correlation-rule1...correlation-rule14} [context context1...context 6] [location node-id1...node-id6] [rulesource {internal| user}] [ruletype {nonstateful| stateful}] [summary| detail]
Alarm Management and Logging Correlation Commands
Syntax Description
correlation-rule1...correlation-rule14
context context1...context 6
location node-id1...node-id6
internal
Displays all rule sets.all
Rule set name to be displayed. Up to 14 predefined correlation rules can be specified, separated by a space.
(Optional) Displays a list of context rules.
(Optional) Displays the location of the list of rules filter from the designated node. The node-id argument is entered in the rack/slot/module notation.
(Optional) Displays the rulesource filter.rulesource
(Optional) Displays the internally defined rules from the rulesource filter.
(Optional) Displays the user defined rules from the rulesource filter.user
(Optional) Displays the ruletype filter.ruletype
(Optional) Displays the nonstateful rules.nonstateful
(Optional) Displays the stateful rules.stateful
(Optional) Displays the summary information.summary
(Optional) Displays detailed information.detail
Command Default
Command Modes
Command History
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
52 OL-24735-01
None
EXEC
ModificationRelease
This command was introduced.Release 3.2
Alarm Management and Logging Correlation Commands
show logging correlator rule
ModificationRelease
Usage Guidelines
Task ID
Release 3.6.0
The following keyword and argument pairs were added:
context context
•
detail
•
location node-id
•
rulesource { internal | user }
•
ruletype { nonstateful | stateful }
•
summary
•
If the ruletype is not specified, then both stateful and nonstateful rules are displayed as the default.
If the rulesource is not specified, then both user and internally defined rules are displayed as the default.
If the summary or detail keywords are not specified, then detailed information is displayed as the default.
OperationsTask ID
readlogging
Examples
This is sample output from the show logging correlator rule command:
RP/0/0/CPU0:router# show logging correlator rule test
Rule Name : test Type : Non Stateful Source : User Timeout : 30000 Rule State: RULE_APPLIED_ALL Rootcause Timeout : None Context Correlation : disabled Reissue Non Bistate : N/A Reparent : N/A Alarms : Code Type: Category Group Message Root: MGBL CONFIG DB_COMMIT Leaf: L2 SONET ALARM Apply Locations: None Apply Contexts: None Number of buffered alarms : 0
This table describes the significant fields shown in the display.
Table 4: show logging correlator rule Field Descriptions
DescriptionField
Name of defined correlation rule.Rule Name
Configured timeout for the correlation rule.Time out
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 53
show logging correlator rule
Alarm Management and Logging Correlation Commands
DescriptionField
Related Commands
Rule State
Root
Leaf
Apply Locations
Apply Contexts
Indicates whether or not the rule has been applied. If the rule applies to the entire router, this field will display “RULE_APPLIED_ALL.”
Message category, group, and code.Code Type
Message category, group and code of the root message configured in the logging correlation rule.
Message category, group and code of a non-root-cause message configured in the logging correlation rule.
Node or nodes where the rule is applied. If the logging correlation rule applies to the entire router, this field will display “None.”
Context or contexts to which the rule is applied. If the logging correlation rule is not configured to apply to a context, this field will display “None.”
DescriptionCommand
show logging correlator info, on page 50
Applies and activates correlation rules.logging correlator apply rule, on page 15
Defines the rules for correlating messages.logging correlator rule, on page 22
Displays messages in the logging correlator buffer.show logging correlator buffer, on page 47
Displays the logging correlator buffer size and the percentage of the buffer occupied by correlated messages
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
54 OL-24735-01
Alarm Management and Logging Correlation Commands

show logging correlator ruleset

To display defined correlation rule set names, use the show logging correlator ruleset command in EXEC mode.
show logging correlator ruleset {all| correlation-ruleset1 ... correlation-ruleset14} [detail| summary]
show logging correlator ruleset
Syntax Description
Command Default
Command Modes
Command History
Displays all rule set names.all
correlation-rule1...correlation-rule14
Rule set name to be displayed. Up to 14 predefined rule set names can be specified, separated by a space.
(Optional) Displays detailed information.detail
(Optional) Displays the summary information.summary
Detail is the default, if nothing is specified.
EXEC
ModificationRelease
This command was introduced.Release 3.6.0
Usage Guidelines
If the ruletype is not specified, then both stateful and nonstateful rules are displayed as the default.
If the rulesource is not specified, then both user and internally defined rules are displayed as the default.
If the summary or detail options are not specified, then detailed information is displayed as the default.
Task ID
OperationsTask ID
readlogging
Examples
OL-24735-01 55
This is the sample output from the show logging correlator ruleset command:
RP/0/0/CPU0:router# show logging correlator RuleSetOne RuleSetTwo
Rule Set Name : RuleSetOne Rules: Rule1 : Applied
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
show logging correlator ruleset
Rule2 : Applied Rule3 : Applied Rule Set Name : RuleSetTwo Rules: Rule1 : Applied Rule5 : Not Applied
This is the sample output from the show logging correlator ruleset command when the all option is specified:
RP/0/0/CPU0:router# show logging correlator ruleset all
Rule Set Name : RuleSetOne Rules: Rule1 : Applied Rule2 : Applied Rule3 : Applied Rule Set Name : RuleSetTwo Rules: Rule1 : Applied Rule5 : Not Applied Rule Set Name : RuleSetThree Rules: Rule2 : Applied Rule3 : Applied
This is sample output from the show logging correlator ruleset command when the all and summary options are specified:
RP/0/0/CPU0:router# show logging correlator ruleset all summary RuleSetOne RuleSetTwo RuleSetThree
This table describes the significant fields shown in the display.
Alarm Management and Logging Correlation Commands
Related Commands
Table 5: show logging correlator ruleset Field Descriptions
show logging correlator info, on page 50
DescriptionField
Name of the ruleset.Rule Set Name
All rules contained in the ruleset are listed.Rules
The rule is applied.Applied
The rule is not applied.Not Applied
DescriptionCommand
Applies and activates correlation rules.logging correlator apply rule, on page 15
Defines the rules for correlating messages.logging correlator rule, on page 22
Displays messages in the logging correlator buffer.show logging correlator buffer, on page 47
Displays the logging correlator buffer size and the percentage of the buffer occupied by correlated messages.
Displays defined correlation rules.show logging correlator rule, on page 52
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
56 OL-24735-01
Alarm Management and Logging Correlation Commands

show logging events buffer

To display messages in the logging events buffer, use the show logging events buffer command in EXEC mode.
show logging events buffer [admin-level-only] [all-in-buffer] [bistate-alarms-set] [category name] [context name] [event-hi-limit event-id] [event-lo-limit event-id] [first event-count] [group message-group] [last event-count] [location node-id] [message message-code] [severity-hi-limit severity] [severity-lo-limit
severity] [timestamp-hi-limit hh:mm:ss [month] [day] [year] timestamp-lo-limit hh:mm:ss [month] [day] [year]]
show logging events buffer
Syntax Description
category name
context name
event-hi-limit event-id
event-lo-limit event-id
first event-count
group message-group
last event-count
location node-id
Displays only the events that are at the adminstrative level.admin-level-only
Displays all event IDs in the events buffer.all-in-buffer
Displays bi-state alarms in the SET state.bistate-alarms-set
Displays events from a specified category.
Displays events from a specified context.
Displays events with an event ID equal to or lower than the event ID specified with the event-id argument. Range is 0 to 4294967294.
Displays events with an event ID equal to or higher than the event ID specified with event-id argument. Range is 0 to 4294967294.
Displays events in the logging events buffer, beginning with the first event. For the event-count argument, enter the number of events to be displayed.
Displays events from a specified message group.
Displays events, beginning with the last event in the logging events buffer. For the event-count argument, enter the number of events to be displayed.
Displays events for the specified location. The node-id argument is entered in the rack/slot/module notation.
message message-code
severity-hi-limit
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 57
Displays events with the specified message code.
Displays events with a severity level equal to or lower than the specified severity level.
show logging events buffer
Alarm Management and Logging Correlation Commands
severity
severity-lo-limit
timestamp-hi-limit
Severity level. Valid values are:
emergencies
•
alerts
•
critical
•
errors
•
warnings
•
notifications
•
informational
•
Note
Settings for the severity levels and their respective system conditions are listed under the “Usage Guidelines” section for the logging events level command. Events of lower severity level represent events of higher importance.
Displays events with a severity level equal to or higher than the specified severity level.
Displays events with a time stamp equal to or lower than the specified time stamp.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
58 OL-24735-01
Alarm Management and Logging Correlation Commands
show logging events buffer
hh : mm : ss [month] [day] [year]
Time stamp for the timestamp-hi-limit or timestamp-lo-limit keyword. The month, day, and year arguments default to the current month, day, and year if not specified.
Ranges for the hh : mm : ss month day year arguments are as follows:
• hh :—Hours. Range is 00 to 23. You must insert a colon after the hh
argument.
• mm :—Minutes. Range is 00 to 59. You must insert a colon after the mm
argument.
• ss—Seconds. Range is 00 to 59.
• month—(Optional) The month of the year. The values for the month
argument are:
january
◦
february
◦
march
◦
april
◦
may
◦
june
◦
july
◦
Command Default
Command Modes
timestamp-lo-limit
None
EXEC
august
◦
september
◦
october
◦
november
◦
december
◦
• day—(Optional) Day of the month. Range is 01 to 31.
• year—(Optional) Year. Enter the last two digits of the year (for example,
04 for 2004). Range is 01 to 37.
Displays events with a time stamp equal to or higher than the specified time stamp.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 59
show logging events buffer
Alarm Management and Logging Correlation Commands
Command History
Usage Guidelines
Task ID
Examples
ModificationRelease
This command was introduced.Release 3.2
This command displays messages from the logging events buffer matching the description. The description is matched when all of the conditions are met.
OperationsTask ID
readlogging
This is the sample output from the show logging events buffer all-in-buffer command:
RP/0/0/CPU0:router# show logging events buffer all-in-buffer
#ID :C_id:Source :Time :%CATEGORY-GROUP-SEVERITY-MESSAGECODE: Text
#1 : :RP/0/0/CPU0:Jan 9 08:57:54 2004:nvram[66]: %MEDIA-NVRAM_PLATFORM-3-BAD_N VRAM_VAR : ROMMON variable-value pair: '^['[19~CONFIG_FILE = disk0:config/startup, contains
illegal (non-printable)characters #2 : :RP/0/0/CPU0:Jan 9 08:58:21 2004:psarb[238]: %PLATFORM-PSARB-5-GO_BID : Card
is going to bid state. #3 : :RP/0/0/CPU0:Jan 9 08:58:22 2004:psarb[238]: %PLATFORM-PSARB-5-GO_ACTIVE : Card is becoming active. #4 : :RP/0/0/CPU0:Jan 9 08:58:22 2004:psarb[238]: %PLATFORM-PSARB-6-RESET_ALL_LC_ CARDS : RP going active; resetting all linecards in chassis #5 : :RP/0/0/CPU0:Jan 9 08:58:22 2004:redcon[245]: %HA-REDCON-6-GO_ACTIVE : this card going active #6 : :RP/0/0/CPU0:Jan 9 08:58:22 2004:redcon[245]: %HA-REDCON-6-FAILOVER_ENABLED :
Failover has been enabled by config
This table describes the significant fields shown in the display.
Table 6: show logging correlator buffer Field Descriptions
DescriptionField
#ID
Integer assigned to each event in the logging events buffer.
C_id.
Correlation ID assigned to a event that has matched a logging correlation rule.
Node from which the event is generated.Source
Date and time at which the event occurred.Time
%CATEGORY-GROUP-SEVERITY-MESSAGECODE
The category, group name, severity level, and message code associated with the event.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
60 OL-24735-01
Alarm Management and Logging Correlation Commands
show logging events buffer
DescriptionField
Message string that delineates the event.Text
Related Commands
show logging events info, on page 62
DescriptionCommand
Displays configuration and operational messages about the logging events buffer.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 61

show logging events info

show logging events info
To display configuration and operational information about the logging events buffer, use the show logging events info command in EXEC mode.
show logging events info
Alarm Management and Logging Correlation Commands
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
Task ID
This command has no keywords or arguments.
None
EXEC
ModificationRelease
This command was introduced.Release 3.2
This command displays information about the size of the logging events buffer, the maximum size of the buffer, the number of records being stored, the maximum allowable number of records threshold for circular filing, and message filtering.
OperationsTask ID
readlogging
Examples
This is the sample output from the show logging events info command:
RP/0/0/CPU0:router# show logging events info
Size (Current/Max) #Records Thresh Filter 16960 /42400 37 90 Not Set
This table describes the significant fields shown in the display.
Table 7: show logging events info Field Descriptions
DescriptionField
Size (Current/Max)
The current and maximum size of the logging events buffer. The maximum size of the buffer is controlled by the logging events buffer-size, on page 27 command.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
62 OL-24735-01
Alarm Management and Logging Correlation Commands
show logging events info
DescriptionField
Related Commands
#Records
Thresh
Filter
logging events threshold, on page 33
show logging events buffer, on page 57
The number of event records stored in the logging events buffer.
The configured logging events threshold value. This field is controlled by the logging events threshold,
on page 33 command.
The lowest severity level for events that will be displayed. This field is controlled by the logging
events level, on page 31 command.
DescriptionCommand
Specifies the logging correlator buffer size.logging events buffer-size, on page 27
Specifies a severity level for logging alarm messages.logging events level, on page 31
Specifies the logging events buffer capacity threshold that, when surpassed, will generate an alarm.
Displays information about messages in the logging events buffer according to type, time, or severity level.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 63

show logging suppress rule

show logging suppress rule
To display defined logging suppression rules, use the show logging suppression rule command in EXEC mode.
show logging suppress rule [rule-name1 [... [ rule-name14 ]]| all [detail] [summary] [source location node-id]]
Alarm Management and Logging Correlation Commands
Syntax Description
Command Default
Command Modes
Command History
rule-name1 [...[rule-name14]]
source location node-id
None
EXEC
Specifies up to 14 logging suppression rules to display.
Displays all logging suppression rules.all
(Optional) Displays the location of the list of rules filter from the designated node. The node-id argument is entered in the rack/slot/module notation.
(Optional) Displays detailed information.detail
(Optional) Displays the summary information.summary
ModificationRelease
This command was introduced.Release 3.8.0
Usage Guidelines
Task ID
OperationsTask ID
readlogging
Examples
This example displays information about a logging suppression rule that has been configured but has not been activated:
RP/0/0/CPU0:router# show logging suppression rule test_suppression
Rule Name : test_suppression
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
64 OL-24735-01
Alarm Management and Logging Correlation Commands
Rule State: RULE_UNAPPLIED Severities : informational, critical Alarms :
Category Group Message CAT_C GROUP_C CODE_C CAT_D GROUP_D CODE_D
Apply Alarm-Locations: PLIM-0/2, PowerSupply-0/A/A0 Apply Sources: 0/RP0/CPU0, 1/6/SP
Number of suppressed alarms : 0
This example displays information about all logging suppression rules applied to a specific source location on the router:
RP/0/0/CPU0:router# show logging suppress rule all source location 0/RP0/CPU0
Rule Name : test_suppression Rule State: RULE_APPLIED_ALL Severities : N/A Alarms :
Category Group Message CAT_E GROUP_F CODE_G
Apply Alarm-Locations: None Apply Sources: 0/RP0/CPU0
Number of suppressed alarms : 0
This example shows summary information about all logging suppression rules:
show logging suppress rule
Related Commands
RP/0/0/CPU0:router# show logging suppression rule all summmary Rule Name :Number of Suppressed Alarms Mike1 0 Mike2 0 Mike3 0 Real1 4
DescriptionCommand
Applies and activates a logging suppression rule.logging suppress apply rule, on page 35
Creates a logging suppression rule.logging suppress rule, on page 37
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 65

show snmp correlator buffer

show snmp correlator buffer
To display messages in SNMP correlator buffer, use the show snmp correlator buffer in EXEC mode.
show snmp correlator buffer [all| correlation ID | rule-name name]
Alarm Management and Logging Correlation Commands
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
correlation id
rule-name name
None
EXEC
Displays all messages in the correlator buffer.all
Displays a message identified by correlation ID. Range is 0 to 4294967294. Up to 14 correlation rules can be specified, separated by a space.
Displays a messages associated with a SNMP correlation rule name. Up to 14 correlation rules can be specified, separated by a space.
ModificationRelease
This command was introduced.Release 3.8.0
Task ID
OperationTask ID
readsnmp
Examples
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
66 OL-24735-01
The sample shows an output from the show snmp correlator buffer command:
RP/0/0/CPU0:router# show snmp correlator buffer correlationID 10
Correlation ID : 10 Rule : ospf-trap-rule Rootcause: 1.3.6.1.6.3.1.1.5.3 Time : Dec 14 02:32:05 Varbind(s):
ifIndex.17 = 17 ifDescr.17 = POS0/7/0/0 ifType.17 = other(1) cieIfStateChangeReason.17 = down
Nonroot : 1.3.6.1.2.1.14.16.2.2 Time: Dec 14 02:32:04
Alarm Management and Logging Correlation Commands
Varbind(s):
ospfRouterId = 1.1.1.1 ospfNbrIpAddr = 30.0.28.2 ospfNbrAddressLessIndex = 0 ospfNbrRtrId = 3.3.3.3 ospfNbrState = down(1)
show snmp correlator buffer
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 67

show snmp correlator info

show snmp correlator info
To display the SNMP correlator buffer size and the percentage of the buffer occupied by correlated messages, use the show snmp correlator info command in EXEC mode.
show snmp correlator info
Alarm Management and Logging Correlation Commands
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
Task ID
Examples
This command has no keywords or arguments.
None
EXEC
ModificationRelease
This command was introduced.Release 3.8.0
OperationTask ID
readsnmp
The sample shows an output that contains remaining buffer size and percentage allocated to correlated messages from the show snmp correlator info command:
RP/0/0/CPU0:router# show snmp correlator info
Buffer-Size Percentage-Occupied
85720 0.00
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
68 OL-24735-01
Alarm Management and Logging Correlation Commands

show snmp correlator rule

To display defined SNMP correlation rules, use the show snmp correlator rule command in EXEC mode.
show snmp correlator rule [all| rule-name]
show snmp correlator rule
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
Task ID
rule-name
None
EXEC
Displays all rule sets.all
Specifies the name of a rule. Up to 14 predefined SNMP correlation rules can be specified, separated by a space.
ModificationRelease
This command was introduced.Release 3.8.0
OperationTask ID
readsnmp
Examples
OL-24735-01 69
This sample shows an output from the show snmp correlator rule command:
RP/0/0/CPU0:router# show snmp correlator rule rule_1 Rule Name : rule_1
Time out : 888 Rule State: RULE_APPLIED_ALL
Root: OID : 1.3.6.1.2.1.11.0.2
vbind : 1.3.6.1.2.1.2.2.1.2 value /3\.3\.\d{1,3}\.\d{1,3}/ vbind : 1.3.6.1.2.1.5.8.3 index val
Nonroot: OID : 1.3.6.1.2.1.11.3.3
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1

show snmp correlator ruleset

show snmp correlator ruleset
To display defined SNMP correlation rule set names, use the show snmp correlator ruleset command in EXEC mode.
show snmp correlator ruleset [all| ruleset-name]
Alarm Management and Logging Correlation Commands
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
Task ID
ruleset-name
None
EXEC
Displays all rule set names.all
Specifies the name of a rule set. Up to 14 predefined rule set names can be specified, separated by a space.
ModificationRelease
This command was introduced.Release 3.8.0
OperationTask ID
readsnmp
Examples
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
70 OL-24735-01
This sample shows an output from the show snmp correlator ruleset command:
RP/0/0/CPU0:router# show snmp correlator ruleset test
Rule Set Name : test
Rules: chris1 : Not Applied
chris2 : Applied
Alarm Management and Logging Correlation Commands

source

To apply a logging suppression rule to alarms originating from a specific node on the router, use the source command in logging suppression apply rule configuration mode.
source location node-id
no source location node-id
source
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
Task ID
location node-id
Specifies a node. The node-id argument is entered in the rack/slot/module notation.
No scope is configured by default.
Logging suppression apply rule configuration
ModificationRelease
This command was introduced.Release 3.8.0
OperationsTask ID
executelogging
Examples
This example shows how to configure the logging suppression rule infobistate to suppress alarms from 0/RP0/CPU0:
RP/0/0/CPU0:router(config)# logging suppress apply rule infobistate RP/0/0/CPU0:router(config-suppr-apply-rule)# source location 0/RP0/CPU0
Related Commands
DescriptionCommand
Applies and activates a logging suppression rule.logging suppress apply rule, on page 35
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 71

timeout

timeout
Alarm Management and Logging Correlation Commands
To specify the collection period duration time for the logging correlator rule message, use the timeout command in stateful or nonstateful correlation rule configuration modes. To remove the timeout period, use the no form of this command.
timeout [ milliseconds ]
no timeout
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
milliseconds
Timeout period is not specified.
Stateful correlation rule configuration
Nonstateful correlation rule configuration
Each correlation rule that is applied must have a timeout value, and only those messages captured within this timeout period can be correlated together.
The timeout begins when the first matching message for a correlation rule is received. If the root-cause message is received, it is immediately sent to syslog, while any non-root-cause messages are held.
When the timeout expires and the rootcause message has not been received, then all the non-root-cause messages captured during the timeout period are reported to syslog. If the root-cause message was received during the timeout period, then a correlation is created and placed in the correlation buffer.
Range is 1 to 600000 milliseconds.
ModificationRelease
This command was introduced.Release 3.6.0
Note
Task ID
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
72 OL-24735-01
The root-cause alarm does not have to appear first. It can appear at any time within the correlation time period.
OperationsTask ID
read, writelogging
Alarm Management and Logging Correlation Commands
timeout
Examples
Related Commands
This example shows how to define a logging correlation rule with a timeout period of 60,000 milliseconds (one minute):
RP/0/0/CPU0:router(config)# logging correlator rule state_rule type stateful RP/0/0/CPU0:router(config-corr-rule-st)# timeout 60000
DescriptionCommand
logging correlator rule, on page 22
Defines the rules by which the correlator logs messages to the logging events buffer.
timeout-rootcause, on page 74
Specifies an optional parameter for an applied correlation rule.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 73

timeout-rootcause

timeout-rootcause
To specify an optional parameter for an applied correlation rule, use the timeout-rootcause command in stateful or nonstateful correlation rule configuration modes. To remove the timeout period, use the no form of this command.
timeout-rootcause [ milliseconds ]
no timeout-rootcause
Alarm Management and Logging Correlation Commands
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
milliseconds
Root-cause alarm timeout period is not specified.
Stateful correlation rule configuration
Nonstateful correlation rule configuration
When a root-cause timeout is configured and a non-root-cause message is received first, the following occurs:
When a root-cause timeout is configured and a non-root-cause message is received first, the following
•
occurs:
When the root-cause message arrives before the root-cause timeout expires, then the correlation continues as normal using the remainder of the main rule timeout.
Range is 1 to 600000 milliseconds.
ModificationRelease
This command was introduced.Release 3.6.0
When the root-cause message is not received before the root-cause timeout expires, then all the
•
non-root-cause messages held during the root-cause timeout period are sent to syslog and the correlation is terminated.
Task ID
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
74 OL-24735-01
OperationsTask ID
read, writelogging
Alarm Management and Logging Correlation Commands
timeout-rootcause
Examples
Related Commands
This example shows how to configure a timeout period for a root cause alarm:
RP/0/0/CPU0:router(config)# logging correlator rule state_rule type stateful RP/0/0/CPU0:router(config-corr-rule-st)# timeout-rootcause 50000
DescriptionCommand
logging correlator rule, on page 22
Defines the rules by which the correlator logs messages to the logging events buffer.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 75
timeout-rootcause
Alarm Management and Logging Correlation Commands
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
76 OL-24735-01

Embedded Event Manager Commands

This module describes the commands that are used to set the Embedded Event Manager (EEM) operational attributes and monitor EEM operations.
The Cisco IOS XR software EEM functions as the central clearing house for the events detected by any portion of Cisco IOS XR software High Availability Services. The EEM is responsible for fault detection, fault recovery, and process the reliability statistics in a system. The EEM is policy driven and enables you to configure the high-availability monitoring features of the system to fit your needs.
The EEM monitors the reliability rates achieved by each process in the system. You can use these metrics during testing to identify the components that do not meet their reliability or availability goals, which in turn enables you to take corrective action.
For detailed information about the EEM concepts, configuration tasks, and examples, see the Configuring
and Managing Embedded Event Manager Policies module in Cisco IOS XR System Monitoring Configuration Guide for the Cisco XR 12000 Series Router.
event manager directory user, page 78
•
event manager environment, page 80
•
event manager policy, page 82
•
event manager refresh-time, page 85
•
event manager run, page 86
•
event manager scheduler suspend, page 88
•
show event manager directory user, page 90
•
show event manager environment, page 92
•
show event manager metric hardware , page 94
•
show event manager metric process, page 96
•
show event manager policy available, page 100
•
show event manager policy registered, page 102
•
show event manager refresh-time, page 105
•
show event manager statistics-table, page 107
•
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 77

event manager directory user

event manager directory user
To specify a directory name for storing user library files or user-defined Embedded Event Manager (EEM) policies, use the event manager directory user command in global configuration mode. To disable the use of a directory for storing user library files or user-defined EEM policies, use the no form of this command.
event manager directory user {library path| policy path}
no event manager directory user {library path| policy path}
Embedded Event Manager Commands
Syntax Description
Command Default
Command Modes
Command History
Specifies a directory name for storing user library files.library
path
No directory name is specified for storing user library files or user-defined EEM policies.
Global configuration
Release 3.6.0
Absolute pathname to the user directory on the flash device.
Specifies a directory name for storing user-defined EEM policies.policy
ModificationRelease
This command was introduced.Release 3.2
The fault manager userlibdirectory and fault manager
userpolicydirectory commands were replaced with the event manager directory user command.
Task ID was changed from fault-mgr to eem.Release 3.7.0
Usage Guidelines
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
78 OL-24735-01
Cisco IOS XR software supports only the policy files that are created by using the Tool Command Language (TCL) scripting language. The TCL software is provided in the Cisco IOS XR software image when the EEM is installed on the network device. Files with the .tcl extension can be EEM policies, TCL library files, or a special TCL library index file named tclindex. The tclindex file contains a list of user function names and library files that contain the user functions (procedures). The EEM searches the user library directory when the TCL starts to process the tclindex file.
User Library
A user library directory is needed to store user library files associated with authoring EEM policies. If you do not plan to write EEM policies, you do not have to create a user library directory.
Embedded Event Manager Commands
To create user library directory before identifying it to the EEM, use the mkdir command in EXEC mode. After creating the user library directory, use the copy command to copy the .tcl library files into the user library directory.
User Policy
A user policy directory is essential to store the user-defined policy files. If you do not plan to write EEM policies, you do not have to create a user policy directory. The EEM searches the user policy directory when you enter the event manager policy policy-name user command.
To create a user policy directory before identifying it to the EEM, use the mkdir command in EXEC mode. After creating the user policy directory, use the copy command to copy the policy files into the user policy directory.
event manager directory user
Task ID
Examples
Related Commands
OperationsTask ID
read, writeeem
This example shows how to set the pathname for a user library directory to /usr/lib/tcl on disk0:
RP/0/0/CPU0:router(config)# event manager directory user library disk0:/usr/lib/tcl
This example shows how to set the location of the EEM user policy directory to /usr/fm_policies on disk0:
RP/0/0/CPU0:router(config)# event manager directory user policy disk0:/usr/fm_policies
DescriptionCommand
Registers an EEM policy with the EEM.event manager policy, on page 82
show event manager directory user, on page 90
Displays the directory name for storing user library and policy files.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 79

event manager environment

event manager environment
To set an Embedded Event Manager (EEM) environment variable, use the event manager environment command in global configuration mode. To remove the configuration, use the no form of this command.
event manager environment var-name [ var-value ]
no event manager environment var-name
Embedded Event Manager Commands
Syntax Description
Command Default
Command Modes
Command History
var-name
var-value
None
Global configuration
Release 3.6.0
Name assigned to the EEM environment configuration variable.
(Optional) Series of characters, including embedded spaces, to be placed in the environment variable var-name.
ModificationRelease
This command was introduced.Release 3.2
The fault manager environment command was replaced with the event manager environment command.
The var-value argument was changed from required to optional.
Task ID was changed from fault-mgr to eem.Release 3.7.0
Usage Guidelines
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
80 OL-24735-01
Environment variables are available to EEM policies when you set the variables using the event manager environment command. They become unavailable when you remove them with the no form of this command.
By convention, the names of all the environment variables defined by Cisco begin with an underscore character (_) to set them apart, for example, _show_cmd.
Spaces can be used in the var-value argument. This command interprets everything after the var-name argument uptil the end of the line in order to be a part of the var-value argument.
Use the show event manager environment, on page 92 command to display the name and value of all EEM environment variables before and after they have been set using the event manager environment command.
Embedded Event Manager Commands
event manager environment
Task ID
Examples
Related Commands
OperationsTask ID
read, writeeem
This example shows how to define a set of EEM environment variables:
RP/0/0/CPU0:router(config)# event manager environment _cron_entry 0-59/2 0-23/1 * * 0-7 RP/0/0/CPU0:router(config)# event manager environment _show_cmd show eem manager policy
registered
RP/0/0/CPU0:router(config)# event manager environment _email_server alpha@cisco.com RP/0/0/CPU0:router(config)# event manager environment _email_from beta@cisco.com RP/0/0/CPU0:router(config)# event manager environment _email_to beta@cisco.com RP/0/0/CPU0:router(config)# event manager environment _email_cc
DescriptionCommand
show event manager environment, on page 92
Displays the name and value for all the EEM environment variables.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 81

event manager policy

event manager policy
To register an Embedded Event Manager (EEM) policy with the EEM, use the event manager policy command in global configuration mode. To unregister an EEM policy from the EEM, use the no form of this command.
event manager policy policy-name username username [persist-time [seconds| infinite]| type {system| user}]
no event manager policy policy-name [username username]
Embedded Event Manager Commands
Syntax Description
Command Default
policy-name
username username
persist-time [seconds | infinite]
The default persist time is 3600 seconds (1 hour).
Name of the policy file.
Specifies the username used to run the script. This name can be different from that of the user who is currently logged in, but the registering user must have permissions that are a superset of the username that runs the script. Otherwise, the script is not registered, and the command is rejected.
In addition, the username that runs the script must have access privileges to the commands issued by the EEM policy being registered.
(Optional) The length of the username authentication validity, in seconds. The default time is 3600 seconds (1 hour). The seconds range is 0 to 4294967294. Enter 0 to stop the username authentication from being cached. Enter the infinite keyword to stop the username from being marked as invalid.
(Optional) Specifies the type of policy.type
(Optional) Registers a system policy defined by Cisco.system
(Optional) Registers a user-defined policy.user
Command Modes
Command History
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
82 OL-24735-01
Global configuration
Release 3.3.0
ModificationRelease
This command was introduced.Release 3.2
Support was added for the required keyword and argument username username .
Support was added for the optional keyword and argument persist-time [ seconds | infinite ].
Embedded Event Manager Commands
event manager policy
ModificationRelease
Usage Guidelines
Note
Release 3.6.0
The fault manager policy command was replaced with the event manager policy command.
The type keyword was added.
Task ID was changed from fault-mgr to eem.Release 3.7.0
Release 5.2.0
Support added for verifying scripts against digital signatures, checksum, third party scripts and Cisco signing server.
The EEM schedules and runs policies on the basis of an event specification that is contained within the policy itself. When the event manager policy command is invoked, the EEM examines the policy and registers it to be run when the specified event occurs. An EEM script is available to be scheduled by the EEM until the no form of this command is entered.
AAA authorization (such as the aaa authorization command with the eventmanager and default keywords) must be configured before the EEM policies can be registered. The eventmanager and default keywords must be configured for policy registration. See the Configuring AAA Services on the Cisco IOS XR Softwaremodule of Cisco IOS XR System Security Configuration Guide for the Cisco XR 12000 Series Router for more information on AAA authorization configuration.
Note
Username
Enter the username that should execute the script with the username username keyword and argument. This name can be different from the user who is currently logged in, but the registering user must have permissions that are a superset of the username that runs the script. Otherwise, the script will not be registered, and the command will be rejected. In addition, the username that runs the script must have access privileges to the commands issued by the EEM policy being registered.
Persist-time
When a script is first registered, the configured username for the script is authenticated. If authentication fails, or if the AAA server is down, the script registration fails.
After the script is registered, the username is authenticated each time a script is run.
If the AAA server is down, the username authentication can be read from memory. The persist-time determines the number of seconds this username authentication is held in memory.
If the AAA server is down and the persist-time has not expired, the username is authenticated from
•
memory, and the script runs.
If the AAA server is down, and the persist-time has expired, user authentication fails, and the script
•
does not run.
EEM attempts to contact the AAA server and refresh the username reauthenticate whenever the configured refresh-time expires. See the event manager refresh-time, on page 85 command for more information.
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 83
event manager policy
Embedded Event Manager Commands
These values can be used for the persist-time:
The default persist-time is 3600 seconds (1 hour). Enter the event manager policy command without
•
the persist-time keyword to set the persist-time to 1 hour.
Enter zero to stop the username authentication from being cached. If the AAA server is down, the
•
username is not authenticated and the script does not run.
Enter infinite to stop the username from being marked as invalid. The username authentication held in
•
the cache will not expire. If the AAA server is down, the username is authenticated from the cache.
Type
If you enter the event manager policy command without specifying the type keyword, the EEM first tries to locate the specified policy file in the system policy directory. If the EEM finds the file in the system policy directory, it registers the policy as a system policy. If the EEM does not find the specified policy file in the system policy directory, it looks in the user policy directory. If the EEM locates the specified file in the user policy directory, it registers the policy file as a user policy. If the EEM finds policy files with the same name in both the system policy directory and the user policy directory, the policy file in the system policy directory takes precedence, and the policy file is registered as a system policy.
Task ID
Examples
Related Commands
OperationsTask ID
read, writeeem
This example shows how to register a user-defined policy named cron.tcl located in the user policy directory:
RP/0/0/CPU0:router(config)# event manager policy cron.tcl username joe
DescriptionCommand
Specifies a directory for storing user library files.event manager environment, on page 80
event manager refresh-time, on page 85
Specifies the time between the system attempts to contact the AAA server and refresh the username reauthentication.
show event manager environment, on page 92
Displays the name and value for all EEM environment variables.
show event manager policy available, on page 100
Displays EEM policies that are available to be registered.
Displays the EEM policies that are already registered.show event manager policy registered, on page 102
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
84 OL-24735-01
Embedded Event Manager Commands

event manager refresh-time

To define the time between user authentication refreshes in Embedded Event Manager (EEM), use the event manager refresh-time command in global configuration mode. To restore the system to its default condition, use the no form of this command.
event manager refresh-time seconds
no event manager refresh-time seconds
event manager refresh-time
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
seconds
The default refresh time is 1800 seconds (30 minutes).
Global configuration
Release 3.6.0
EEM attempts to contact the AAA server and refresh the username reauthentication whenever the configured refresh-time expires.
Number of seconds between user authentication refreshes, in seconds. Range is 10 to 4294967295.
ModificationRelease
This command was introduced.Release 3.3.0
The fault manager refresh-time command was replaced with the event manager refresh-time command.
Task ID was changed from fault-mgr to eem.Release 3.7.0
Task ID
Examples
OL-24735-01 85
This example shows how to set the refresh time:
RP/0/0/CPU0:router(config)# event manager refresh-time 1900
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OperationsTask ID
read, writeeem

event manager run

event manager run
To manually run an Embedded Event Manager (EEM) policy, use the event manager run command in EXEC mode.
event manager run policy [argument [... [ argument15 ]]]
Embedded Event Manager Commands
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
policy
[argument[...[argument15]]]
Name of the policy file.
Argument that you want to pass to the policy. The maximum number of arguments is 15.
No registered EEM policies are run.
EXEC
ModificationRelease
This command was introduced.Release 3.6.0
Task ID was changed from fault-mgr to eem.Release 3.7.0
EEM usually schedules and runs policies on the basis of an event specification that is contained within the policy itself. The event manager run command allows policies to be run manually.
You can query the arguments in the policy file by using the TCL command event_reqinfo , as shown in this example:
array set arr_einfo [event_reqinfo] set argc $arr_einfo(argc) set arg1
$arr_einfo(arg1)
Use the event manager policy, on page 82 command to register the policy before using the event manager run command to run the policy. The policy can be registered with none as the event type.
Task ID
OperationsTask ID
readeem
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
86 OL-24735-01
Embedded Event Manager Commands
event manager run
Examples
Related Commands
This example of the event manager run command shows how to manually run an EEM policy named policy-manual.tcl:
RP/0/0/CPU0:router# event manager run policy-manual.tcl parameter1 parameter2 parameter3 RP/0/0/CPU0:Sep 20 10:26:31.169 : user-plocy.tcl[65724]: The reqinfo of arg2 is parameter2.
RP/0/0/CPU0:Sep 20 10:26:31.170 : user-plocy.tcl[65724]: The reqinfo of argc is 3. RP/0/0/CPU0:Sep 20 10:26:31.171 : user-plocy.tcl[65724]: The reqinfo of arg3 is parameter3.
RP/0/0/CPU0:Sep 20 10:26:31.172 : user-plocy.tcl[65724]: The reqinfo of event_type_string is none. RP/0/0/CPU0:Sep 20 10:26:31.172 : user-plocy.tcl[65724]: The reqinfo of event_pub_sec is
1190283990. RP/0/0/CPU0:Sep 20 10:26:31.173 : user-plocy.tcl[65724]: The reqinfo of event_pub_time is
1190283990. RP/0/0/CPU0:Sep 20 10:26:31.173 : user-plocy.tcl[65724]: The reqinfo of event_id is 3. RP/0/0/CPU0:Sep 20 10:26:31.174 : user-plocy.tcl[65724]: The reqinfo of arg1 is parameter1.
RP/0/0/CPU0:Sep 20 10:26:31.175 : user-plocy.tcl[65724]: The reqinfo of event_type is 16. RP/0/0/CPU0:Sep 20 10:26:31.175 : user-plocy.tcl[65724]: The reqinfo of event_pub_msec is 830
DescriptionCommand
Registers an EEM policy with the EEM.event manager policy, on page 82
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
OL-24735-01 87

event manager scheduler suspend

event manager scheduler suspend
To suspend the Embedded Event Manager (EEM) policy scheduling execution immediately, use the event manager scheduler suspend command in global configuration mode. To restore a system to its default condition, use the no form of this command.
event manager scheduler suspend
no event manager scheduler suspend
Embedded Event Manager Commands
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
This command has no keywords or arguments.
Policy scheduling is active by default.
Global configuration
ModificationRelease
This command was introduced.Release 3.2
Release 3.6.0
Use the event manager scheduler suspend command to suspend all the policy scheduling requests, and do not perform scheduling until you enter the no form of this command. The no form of this command resumes policy scheduling and runs pending policies, if any.
It is recommended that you suspend policy execution immediately instead of unregistering policies one by one, for the following reasons:
The fault manager schedule-policy suspend command was replaced with the event manager scheduler suspend command.
Task ID was changed from fault-mgr to eem.Release 3.7.0
• Security—If you suspect that the security of your system has been compromised.
• Performance—If you want to suspend policy execution temporarily to make more CPU cycles available
for other functions.
Task ID
Cisco IOS XR System Monitoring Command Reference for the Cisco XR 12000 Series Router, Release 4.1
88 OL-24735-01
OperationsTask ID
read, writeeem
Loading...
Buy Points How it Works FAQ Contact Us Questions and Suggestions Privacy Policy Cookie Policy Terms of Use