monitor event-trace (EXEC)
To monitor and control the event trace function for a specified Cisco IOS software subsystem component, use the monitor event-trace command in privileged EXEC mode.
monitor event-trace component {clear | continuous | destroy-buffer | disable | dump [pretty] | enable | one-shot}
Cisco 10000 Series Routers
monitor event-trace component {disable | dump | enable | size | stacktrace}
Catalyst 6500 Series Switches and Cisco 7600 Series Routers
monitor event-trace all-traces {continuous [cancel] | dump [merged] [pretty]}
monitor event-trace l3 {clear | continuous [cancel] | disable | dump [pretty] | enable | interface type mod/port | one-shot}
monitor event-trace spa {clear | continuous [cancel] | disable | dump [pretty] | enable | one-shot}
monitor event-trace subsys {clear | continuous [cancel] | disable | dump [pretty] | enable | one-shot}
Syntax Description
component |
Name of the Cisco IOS software subsystem component that is the subject of the event trace. To get a list of components that support event tracing, use the monitor event-trace ? command. |
||
clear |
Clears existing trace messages for the specified component from memory on the networking device. |
||
continuous |
Continuously displays the latest event trace entries. |
||
destroy-buffer |
Clears the buffer (in volatile memory) of the trace data. Relevant only for subscriber ppp event. |
||
disable |
Turns off event tracing for the specified component. |
||
dump |
Writes the event trace results to the file configured using the monitor event-trace command in global configuration mode. The trace messages are saved in binary format. |
||
pretty |
(Optional) Saves the event trace message in ASCII format. |
||
enable |
Turns on event tracing for the specified component. |
||
one-shot |
Clears any existing trace information from memory, starts event tracing again, and disables the trace when the trace reaches the size specified using the monitor event-trace command in global configuration mode. |
||
size |
Sets the number of messages that can be written to memory for a single instance of a trace.
When the number of event trace messages in memory exceeds the size, new messages will begin to overwrite the older messages in the file. |
||
stacktrace |
Enables the stack trace at tracepoints. |
||
all-traces |
Displays the configured merged-event traces. |
||
merged |
(Optional) Dumps the entries in all event traces sorted by time. |
||
l3 |
Displays information about the Layer 3 trace. |
||
spa |
Displays information about the Shared Port Adapter (SPA) trace. |
||
interface type mod / port |
Specifies the interface to be logged. |
||
cancel |
(Optional) Cancels the continuous display of latest trace entries. |
||
subsys |
Displays information about the subsystem’s initial trace. |
Command Default
The event trace function is disabled by default.
Command Modes
Privileged EXEC (#)
Command History
Release |
Modification |
---|---|
12.0(18)S |
This command was introduced. |
12.2(8)T |
This command was integrated into Cisco IOS Release 12.2(8)T. |
12.2(14)SX |
Support for this command was introduced on the Supervisor Engine 720. |
12.2(25)S |
This command was integrated into Cisco IOS Release 12.2(25)S. The monitor event-trace cef ipv4 clear command replaces the clear ip cef event-log command. |
12.2(28)SB |
This command was integrated into Cisco IOS Release 12.2(28)SB and implemented on the Cisco 10000 series routers. |
12.2(33)SRA |
This command was integrated into Cisco IOS Release 12.2(33)SRA. |
12.2(33)SXH |
This command was integrated into Cisco IOS Release 12.2(33)SXH. |
12.4(20)T |
This command was integrated into Cisco IOS Release 12.4(20)T. |
IOS XE Fuji 16.9.1 |
The subscriber ppp component was added, and the destroy-buffer keyword was added for use with this component. |
Usage Guidelines
Use the monitor event-trace command to control what, when, and how event trace data is collected. Use this command after you have configured the event trace functionality on the networking device using the monitor event-trace command in global configuration mode.
Note |
The amount of data collected from the trace depends on the trace message size configured using the monitor event-trace command in global configuration mode for each instance of a trace. |
The Cisco IOS software allows for the subsystem components to define whether support for event tracing is enabled or disabled at boot time. You can enable or disable event tracing in two ways: using the monitor event-trace command in privileged EXEC mode or using the monitor event-trace command in global configuration mode. To disable event tracing, you would enter either of these commands with the disable keyword. To enable event tracing again, you would enter either of these commands with the enable keyword.
To determine whether you can enable event tracing on a subsystem, use the monitor event-trace ? command to get a list of software components that support event tracing. To determine whether event tracing is enabled by default for the subsystem, use the show monitor event-trace command to display trace messages.
Use the show monitor event-trace command to display trace messages. Use the monitor event-trace component dump command to save trace message information for a single event. By default, trace information is saved in binary format. If you want to save trace messages in ASCII format, possibly for additional application processing, use the monitor event-trace component dump pretty command.
To write the trace messages for all events currently enabled on a networking device to a file, enter the monitor event-trace dump command.
To configure the file where you want to save trace information, use the monitor event-trace command in global configuration mode. The trace messages are saved in a binary format.
Examples
The following example shows the privileged EXEC commands to stop event tracing, clear the current contents of memory, and reenable the trace function for the interprocess communication (IPC) component. This example assumes that the tracing function is configured and enabled on the networking device.
Router# monitor event-trace ipc disable
Router# monitor event-trace ipc clear
Router# monitor event-trace ipc enable
The following example shows how the monitor event-trace one-shot command accomplishes the same function as the previous example except in one command. In this example, once the size of the trace message file has been exceeded, the trace is terminated.
Router# monitor event-trace ipc one-shot
The following example shows the command for writing trace messages for an event in binary format. In this example, the trace messages for the IPC component are written to a file.
Router# monitor event-trace ipc dump
The following example shows the command for writing trace messages for an event in ASCII format. In this example, the trace messages for the MBUS component are written to a file.
Router# monitor event-trace mbus dump pretty
Examples
This example shows how to stop event tracing, clear the current contents of memory, and reenable the trace function for the SPA component. This example assumes that the tracing function is configured and enabled on the networking device.
Router# monitor event-trace spa disable
Router# monitor event-trace spa clear
Router# monitor event-trace spa enable