Reducing Excessive Event Logging - Cisco ASR 5000 Series Administration Manual

Reducing Excessive Event Logging

• Process – where the crash occurred (Card, CPU, PID, etc.)
• Crash time – timestamp for when the crash occurred in the format: YYYY-MMM-DD+hh:mm:ss time zone
• Recent errno – text of most recent error number.
• Stack – memory stack information
• Last Bounce – information about the messaging received prior to the crash
• Registers – memory register contents
• Current inbound message – hexadecimal information for the current inbound message
• Address Map
• Recent heap activity (oldest first)
• Recent events (oldest first)
• Profile depth
The informational content of each crash log entry varies based on the type of crash and the StarOS release.
Reducing Excessive Event Logging
Event logging (evlogd) is a shared medium that captures event messages sent by StarOS facilities. When one
or more facilities continuously and overwhelmingly keep sending a high volume of event messages, the
remaining non-offender facilities are impacted. This scenario degrades system performance, especially as the
number of facilities generating logs increases.
Rate-control of event message logging is handled in the Log Source path. Essentially, every second a counter
is set to zero and is incremented for each log event that is sent to evlogd. If the count reaches a threshold
before the second is up, the event is sent, queued or dropped (if the evlogd messenger queue is full).
When any facility exceeds the upper threshold set with this command for the rate of message logging and
remains in the same state for prolonged interval, StarOS notifies the user via an SNMP trap or alarm.
A new threshold command allows a user to specify the percentage of facility event queue full. When this
threshold is exceeded, an SNMP trap and alarm are generated that specifies the offending facility.
The formats for the SNMP traps associated with this command are as follows:
• ThreshLSLogsVolume
• ThreshClearLSLogsVolume
If a trigger condition occurs within the polling interval, the alert or alarm will not be generated until the end
of the polling interval.
ASR 5500 System Administration Guide, StarOS Release 21.4
186
<timestamp> Internal trap notification <trap_id> (ThreshLSLogsVolume) threshold
<upper_percent>%
measured value <actual_percent>% for facility <facility_name> instance <instance_id>
<timestamp> Internal trap notification <trap_id> (ThreshClearLSLogsVolume) threshold
<upper_percent>%
measured value <actual_percent>% for facility <facility_name> instance <instance_id>
System Logs