Message Length Limit; Seqnum Field; Host Field - Cisco MCS-7825-H3-IPC1 Service Manual

Cisco Unified Serviceability Alarms and CiscoLog Messages
•
•

Message Length Limit

The maximum length of a complete CiscoLog message must not exceed 800 octets.The term octet is used
for 8-bit data type instead of byte because byte is not 8 bits on some platforms. The words "character"
and "octet" are not synonyms in parts of this specification because in places were internationalization is
supported a single character may need to be represented with multiple octets. This limit is dictated by
RFC 3164. The limit of 1024 octets reserves some extra space for syslog forwarding headers and/or
fields that may be formalized in later specifications.
When CiscoLog message includes the syslog PRI field, then the combined CiscoLog messages and PRI
field length must not exceed 805 octets.

SEQNUM Field

The SEQNUM field contains a sequence number, which can be used to order messages in the time
sequence order when multiple messages are produced with the same time stamp by the same process.
The sequence number begins at 0 for the first message fired by a process since the last startup and is
incremented by 1 for every subsequent logging message originated by the same process. Every time the
application process is restarted, its sequence number is reset back to 0. The sequence number of each
message must be in the exact order in which messages are fired/logged by the application.
This may mean that in a multi-threaded application there must be some kind of synchronization to ensure
this and another consideration may have to be made for Java applications that have some native (C) code
in JNI. If log messages originate in both native and Java parts of the same process, the implementation
needs to be synchronized to use the same sequence number counter across the two process parts and to
fire messages in the order of sequence numbers.
The maximum numeric value of the SEQNUM field is 4,294,967,295 at which point the counter must be
reset back to 0. The maximum positive value of a 32-bit unsigned integer as used in Cisco IOS. Cisco
IOS uses ulong for the sequence number counter and ulong is a 32-bit unsigned integer on all current
Cisco IOS platforms including mips, ppc, and 68k.
Sequence numbers are process specific. If application architecture has multiple application processes
on a single host, which share a single logging daemon, the sequence number still has to be
process-specific. Thus, each process has it is own sequence number which it increments.
Sequence numbers also help detect lost messages. Therefore, sequence numbers cannot be skipped. In
other words, a message must be produced for every number in the sequence order.

HOST Field

The HOST field identifies the system originating the message with a Fully Qualified DNS Name
(FQDN), hostname or an IPv4/IPv6 address. If the FQDN or hostname is known, one of the two has to
appear in the HOST field. It is expected that in most deployments the hostname is sufficient. However,
if a deployment spans multiple domains, then using FQDNs is recommend. If an application is expected
to be deployed in both scenarios, then it is recommended that the application default to the FQDNs, but
make it a configurable option.
If neither FQDN nor hostname can be identified, then the IP address of the host must be used. If the IP
address cannot be identified, then a constant "0.0.0.0" (without quotes) must appear in place of the
HOST field.
Cisco Unified Communications Manager Managed Services Guide
6-6
TAGS – "%[pname.orig=rdu][comp=parser][mac=1,6,aa:bb:cc:11:22:33][txn=mytxn123]"
MESSAGE – "Bad request received from device [1,6,aa:bb:cc:11:22:33]. Header missing."
Chapter 6 Cisco Unified Serviceability Alarms and CiscoLog Messages
OL-22523-01