How to view logs and alarms on S series switches

31

For S series switches (except the S1700), logs are stored first in the log buffer. When the number of logs reaches the threshold, they will be stored in the syslogfile or logfile folder of the storage card on the device. To view log files and the log buffer, run the following commands:
- To view log files in the logfile folder, run the following commands in the user view:
cd logfile//Access the root directory of the logfile folder
dir//Display all files in the root directory
Directory of flash:/logfile/


Idx Attr Size(Byte) Date Time FileName
0 -rw- 516,885 Feb 14 2009 02:13:14 2009-02-14.02-13-00.dblg.zip
1 -rw- 479,440 Jan 17 2009 04:10:43 2009-01-17.04-10-30.dblg.zip
2 -rw- 484,459 Jan 25 2009 19:35:59 2009-01-25.19-35-45.dblg.zip
3 -rw- 160,660 Mar 17 2009 14:27:58 2009-03-17.12-27-52.dblg.zip
- To check the detailed logs in the log files, run the display logfile logfile/xxxx command, in which xxxx indicates the log file name.
- To view logs in the log buffer, run the display logbuffer command.
- To view logs in the trap buffer, run the display trapbuffer command.
- To view the uncleared alarms after the device starts, run the display alarm active command.
- To view historical alarms recorded after the device starts, run the display alarm history command.
- To view alarms related to device hardware management, run the display alarm urgent [ slot slot-id | time interval ] command. This command applies only to S series fixed switches.
For the meaning of logs, you can log in to Huawei Enterprise Product & Service Support , download the appropriate Log Reference and Alarms Handling documents, and find the meaning for specific logs.

Other related questions:
How to view log and alarm information on CE series switches
Run the following command to view log information:
<HUAWEI> display logbuffer
Run the following command to view alarm information:
<HUAWEI>display trapbuffer

How to view log history on S series switches
For S series switches (except the S1700), you can only view the latest cached logs and traps in the buffer. If you want to view earlier messages, run the display logfile file-name command to check log files stored in the logfile or syslogfile folder on the storage card.

Description of common OSPF logs and alarms on S series switches
Description of common OSPF logs on S series switches What do the following OSPF logs indicate? NBR_CHG_DOWN NBR_CHANGE_E IF_CHG_E The logs are described as follows: Feb 13 2009 17:10:52 LL-NE40E-1 %%01OSPF/3/NBR_CHG_DOWN(l): Neighbor event:neighbor state changed to Down. (ProcessId=1, NeighborAddress=10.0.97.129, NeighborEvent=InactivityTimer, NeighborPreviousState=Full, NeighborCurrentState=Down) Log description: The status of the neighbor of which the IP address is 10.0.97.129 turns from Full to Down due to InactivityTimer, which indicates that the switch does not receive a Hello keepalive packet from the neighbor within the period specified by DeadInterval. The following causes also lead to changes in neighbor status. KillNbr: An interface goes Down, the BFD session becomes Down, or a process is reset. LLDown: A VLANIF, trunk, or serial port becomes Down. SeqNumberMismatch: An error occurs when the two switches exchange routing information, or due to link transmission delay, the neighbor receives a Hello packet sent by the local switch after the neighbor relationship is interrupted and sends the local switch a DD packet. When the local switch in the Full state receives the DD packet, the event occurs. May 10 2009 14:13:00 R13 %%01OSPF/6/NBR_CHANGE_E(l): Neighbor changes event: neighbor status changed. (ProcessId=1, NeighborAddress=100.113.114.114, NeighborEvent=1-Way, NeighborPreviousState=Full, NeighborCurrentState=Init) Log description: The status of the neighbor of which the IP address is 100.113.114.114 turns from Full to Init due to 1-Way, which indicates that the switch receives a Hello packet from the neighbor that requires initializing the neighbor relationship. The OSPF neighbor status on the neighbor switch turns Down, the neighbor then sends an initialization packet to the local switch, and the local switch disconnects the neighbor relationship after receiving the packet. The log is generated. May 12 2009 14:23:58 R13 %%01OSPF/6/IF_CHG_E(l): Interface 82.2.76.3 received event InterfaceDown, interface state changed from DR to Down. (Process ID=1) Log description: The status of the interface with the IP address 82.2.76.3 turns from DR to Down due to an interface Down event. For example, the physical interface goes Down. The following cause also leads to changes in interface status. NeighborChange: Generally, after the status of an interface on a broadcast network turns from DR to Down, the BDR becomes the DR. Description of common OSPF alarms on S series switches What do the following OSPF alarms indicate? NBRCHG IFCHG The alarms are described as follows: #Feb 2 20:49:25 2009 ONT-NE40-8-A OSPF/5/NBRCHG:OSPF TrapID1.3.6.1.2.1.14.16.2.2: Non-virtual neighbor 0.0.0.0 1082 Router 18.1.1.101 NbrRouter 172.21.59.1 state change to 8. Alarm description: The neighbor state between the neighbor with the router ID 172.21.59.1 and local switch changes to Full. Note: 1: Down 2: Attempt 3: Init 4: 2-Way 5: ExStart 6: Exchange 7: Loading 8: Full #Feb 2 20:40:45 2009 ONT-NE40-8-A OSPF/5/IFCHG:OSPF TrapID1.3.6.1.2.1.14.16.2.16: Non-virtual interface 11.1.1.137 0 Router 18.1.1.101 state change to 5. Alarm description: The status of the interface with the IP address 11.1.1.137 changes to DR. Note: 1: Down 2: Loopback 3: Waiting 4: P2P 5: DR 6: BDR 7: DROther

How do S series switches suppress ARP Miss logs and alarms
For S series switches: To filter ARP Miss logs, you can run the info-center source SECE channel 4 log state off command. To filter ARP Miss alarms: - ARP Miss message rate limit based on source IP addresses In the system view, run the arp-miss speed-limit source-ip [ ip-address ] maximum 0 command to disable ARP Miss message rate limit based on source IP addresses. If ip-address is not specified, the rate limit is not implemented on ARP Miss messages from all source IP addresses. If a device with a source IP address generates a large number of ARP Miss messages, high CPU usage may be caused. If the ip-address parameter is specified, the ARP Miss message rate limit will not be implemented based on the source IP address. If the source IP address generates a large number of ARP Miss messages, high CPU usage may be caused. Run the info-center source SECE channel 4 log state off command in the system view to disable the device from sending SECE alarms. - ARP Miss message rate limit configured globally, based on VLAN, or based on interfaces Run the undo arp-miss anti-attack rate-limit alarm enable command in the global, VLAN, or interface view to disable the alarm function for the ARP Miss messages discarded when the rate of ARP Miss messages exceeds the maximum rate. After this function is disabled, when the number of ARP Miss messages ignored by the switch exceeds the alarm threshold, the switch does not send an alarm to notify the network administrator. Run the info-center source SECE channel 4 log state off command in the system view to disable the device from sending SECE alarms.

If you have more questions, you can seek help from following ways:
To iKnow To Live Chat
Scroll to top