Retrieving System Event Archive (SEA) logs from Catalyst 6500/6800 Platforms

Introduction

This document discusses the System Event Archieve (SEA) feature in general, that is available in Catalyst 6500/6800 platforms, steps to locate the SEA archives rand also steps to convert them to text format for further analysis.

Background Information

System Events Archive (SEA) is one of the device management feartures avalable in Cat 6500/6800 platforms. SEA enables the CPUs in the switch builds archives of the events, and thess archives are stored in a local non-volatile file system.

SEA maintains two files - sea_log.dat and sea_console.dat.

sea_log.dat = archive of the events reported by each application in the IOS (e.g., GOLD)

sea_console.dat = archive of the console messages

SEA feature allocates 32MB of memory for each of these files (so, total of 64 MB) in a local filesystem - e.g., bootdisk:

Remember, this 32 MB is a circular buffer and will overwrite the oldest messages.

The configuration guides (given in the "Relavant Documents" section below) provide commands to check if the feature is enabled, the file system selected for the archive, how to clear archive files etc.

Example commands:

show logging system

show logging system disk

show logging system size

clear logging system

Locating SEA Logs

Do "dir all" command to locate the sea_console.dat and sea_log.dat files.

From a Catalyst 6800 VSS setup:

6800-A# show switch virtual

Switch mode                  : Virtual Switch
Virtual switch domain number : 10
Local switch number          : 1
Local switch operational role: Virtual Switch Active
Peer switch number           : 2
Peer switch operational role : Virtual Switch Standby

6800-A# dir all

<snip>

Directory of bootdisk:/    <<== From Sw1
    1  -rw-    33554432   Mar 8 2014 03:11:52 +00:00  sea_console.dat
    3  -rw-    33554432   Mar 8 2014 03:12:30 +00:00  sea_log.dat

<snip>

Directory of slavebootdisk:/   <<=== From Sw2
    1  -rw-    33554432  Mar 10 2014 05:12:12 +00:00  sea_log.dat
    3  -rw-    33554432  Mar 10 2014 05:12:50 +00:00  sea_console.dat

<snip>

From a Catalyst 6500 VSS setup:

VS6500# show switch virt
Switch mode                  : Virtual Switch
Virtual switch domain number : 1
Local switch number          : 1
Local switch operational role: Virtual Switch Active
Peer switch number           : 2
Peer switch operational role : Virtual Switch Standby

VS6500# dir all

<snip>

Directory of sup-bootdisk:/   <<== From Sw1
    1  -rw-    33554432  Aug 29 2014 14:06:42 -04:00  sea_console.dat
    3  -rw-    33554432   Nov 8 2012 16:59:38 -05:00  sea_log.dat

<snip>

Directory of slavesup-bootdisk:/   <<== From Sw1
    1  -rw-    33554432   Sep 8 2014 08:34:02 -04:00  sea_log.dat
    2  -rw-    33554432  Mar 19 2015 12:36:16 -04:00  sea_console.dat

<snip>

Retrieving SEA Logs

It is strongly recommended to add followings to the file name:

Switch name

Switch # (in case of VSS)

Module # (in case mod 5 and mod 6 are present in the same chassis)

File content (sea console or log)

Date

Following are the steps to convert the .dat files to text files.

(1) Convert the logs to text

USe following commands to conver the archives to text. Please note that "show logging system console" is used to convert the sea_console.dat file and "show logging system disk" is used to convert sea_log.dat file.

From a Catalyst 6800 VSS setup (example given above):

For Active/Sw1:

6800A# show logging system console file bootdisk:sea_console.dat | redirect bootdisk:6800A-Sw1-SEA-Console-Jul082015.txt

6800A# show logging system disk bootdisk:sea_log.dat | redirect bootdisk:6800A-Sw1-SEA-Log-Jul082015.txt

For Standby/Sw2:

6800A# show logging system console file slavebootdisk:sea_console.dat | redirect slavebootdisk:6800A-Sw2-SEA-Console-Jul082015.txt

6800A# show logging system disk slavebootdisk:sea_log.dat | redirect slavebootdisk:6800A-Sw2-SEA-Log-Jul082015.txt

(2) Make sure the text files are created and are in the file system:

Make sure the file sizes are non-zero, It is NOT necessary for the text files to be 32MB.

32MB is just an "allocated" space for the .dat files not necessarily used.

Moreover, the files are in different formats - dat vs. txt.

6800A# dir bootdisk:

<snip>

   56  -rw-       57875   Jul 9 2015 19:32:38 +00:00  6800A-Sw1-SEA-Console-Jul082015.txt
   57  -rw-    31136641  Jul 9 2015 19:53:56 +00:00  6800A-Sw1-SEA-Log-Jul082015.txt

<snip>

6800A# dir slavebootdisk:

<snip>

   56  -rw-        5325   Jul 9 2015 20:07:31 +00:00  6800A-Sw2-SEA-Console-Jul082015.txt
   57  -rw-     2899567   Jul 9 2015 20:12:47 +00:00  6800A-Sw2-SEA-Log-Jul082015.txt

<snip>

(3) Make sure the files are accessible/readable before exporting it to TFTP/FTP server.

6800A#more bootdisk:6800A-Sw1-SEA-Log-Jul082015.txt
SEQ: MM/DD/YY HH:MM:SS SW/MOD/SUB: SEV, COMP,    MESSAGE
========================================================
  1: 07/09/15 19:38:00     1/5/-1: MAJ, GOLD, diag_get_fabric_link_status:fexmgr_axs_fport_info_sdp_up returned api_rc=1
  2: 07/09/15 19:37:57     1/5/-1: MAJ, GOLD, diag_get_fabric_link_status:fexmgr_axs_fport_info_sdp_up returned api_rc=1
  3: 07/09/15 19:37:57     1/5/-1: MAJ, GOLD, diag_get_fabric_link_status:fexmgr_axs_fport_info_sdp_up returned api_rc=1
  4: 07/09/15 19:37:52     1/5/-1: MAJ, GOLD, diag_get_fabric_link_status:fexmgr_axs_fport_info_sdp_up returned api_rc=1
  5: 07/09/15 19:37:52     1/5/-1: MAJ, GOLD, diag_get_fabric_link_status:fexmgr_axs_fport_info_sdp_up returned api_rc=1

Relevant Documents

SEA Configuration Guide for 12.2SX releases

SEA Configuration Guide for 15.0SY releases