Customizing the Display of Recorded CEF Events

Last Updated: November 3, 2011

This module contains information about and instructions for customizing the display of recorded Cisco Express Forwarding events for Cisco IOS releases prior to 12.2(25)S, 12.2(33)SB, 12.2(33)SRA, 12.2.(33)SXH, and 12.4(20)T.

For information about and instructions for customizing the display of recorded Cisco Express Forwarding events for Cisco IOS Releases 12.2(25)S, 12.2(33)SB, 12.2(33)SRA, 12.2.(33)SXH, 12.4(20)T, and later releases, see Customizing the Display of Cisco IOS Event Trace Messages.

You can customize the Cisco Express Forwarding event log display by specifying the size of the Cisco Express Forwarding event log or by choosing to display events by prefix and mask or by Cisco Express Forwarding Virtual Private Network (VPN) routing/forwarding instance (VRF).

Cisco Express Forwarding is an advanced Layer 3 IP switching technology. It optimizes network performance and scalability for all kinds of networks: those that carry small amounts of traffic and those that carry large amounts of traffic in complex patterns, such as the Internet and networks characterized by intensive web-based applications or interactive sessions.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

Prerequisites for the Display of Recorded CEF Events

Cisco Express Forwarding must be running on the networking device before you can customize the display of recorded Cisco Express Forwarding events.

Restrictions for the Display of Recorded CEF Events

If you enable Cisco Express Forwarding and then create an access list that uses the log keyword, the packets that match the access list are not Cisco Express Forwarding switched. They are fast switched. Logging disables Cisco Express Forwarding.

Information About the Display of Recorded CEF Events

For links to information about other Cisco Express Forwarding and distributed Cisco Express Forwarding features that you can configure, go to the Additional References.

Cisco Platform Support for Central CEF and dCEF

Cisco Express Forwarding is enabled by default on most Cisco platforms running Cisco IOS software Release 12.0 or later. When Cisco Express Forwarding is enabled on a router, the Route Processor (RP) performs the express forwarding.

To find out if Cisco Express Forwarding is enabled on your platform, enter the show ip cefcommand. If Cisco Express Forwarding is enabled, you receive output that looks like this:

Router# show ip cef 
Prefix              Next Hop            Interface
[...]
10.2.61.8/24        192.168.100.1       FastEthernet1/0/0
                    192.168.101.1       FastEthernet6/1
[...]

If Cisco Express Forwarding is not enabled on your platform, the output for the show ip cefcommand looks like this:

Router# show ip cef
%CEF not running

Distributed Cisco Express Forwarding is enabled by default on the Catalyst 6500 series switch, the Cisco 7500 series router, and the Cisco 12000 Series Internet Router. When distributed Cisco Express Forwarding is enabled on your platform, the line cards perform the express forwarding.

If Cisco Express Forwarding is not enabled on your platform, use the ip cef command to enable (central) Cisco Express Forwarding or the ip cef distributed command to enable distributed Cisco Express Forwarding.

CEF Event Log Overview

The Cisco Express Forwarding event log collects Cisco Express Forwarding events as they occur, even when debugging is not enabled. This allows the tracing of an event immediately after it occurs. Cisco technical personnel can use the event log to help resolve problems with the Cisco Express Forwarding feature.

When the Cisco Express Forwarding event log has reached its capacity, the oldest event is written over by the newest event. You can use the following commands to change the capacity of the Cisco Express Forwarding event log:

  • The ip cef table event-logcommand allows you to increase or decrease the number of entries that the event log can hold.
  • The clear ip cef event-log command allows you to clear all event log entries.

You can use the following commands to display Cisco Express Forwarding events:

  • The show ip cef eventscommand displays all recorded Cisco Express Forwarding forwarding information base (FIB) and adjacency events.
  • The debug ip cef command and the events keyword record general Cisco Express Forwarding events as they occur.
  • The debug ip cef tablecommand enables the real-time collection of events that affect entries in the Cisco Express Forwarding tables.

How to Customize the Display of Recorded CEF Events

Customizing CEF Event Logging

This section contains information about and instructions for customizing Cisco Express Forwarding event logging.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ip cef table event-log [size event-number] [match ip-prefix mask] [vrf vrf-name]

4.    exit


DETAILED STEPS
  Command or Action Purpose
Step 1
enable


Example:

Router> enable

 

Enables privileged EXEC mode.

  • Enter your password if prompted.
 
Step 2
configure terminal


Example:

Router# configure terminal

 

Enters global configuration mode.

 
Step 3
ip cef table event-log [size event-number] [match ip-prefix mask] [vrf vrf-name]


Example:

Router(config)# ip cef table event-log size 25000

 

Controls Cisco Express Forwarding table event-log characteristics.

  • The size event-number keyword-argument pair specifies the number of event entries. The range is from 1 to 4294967295.
  • The match keyword logs events that match the specified prefix and mask.
  • The ip-prefix argument is the specified IP prefix to match in dotted decimal format (A.B.C.D).
  • The mask argument is the network mask written as A.B.C.D.
  • The vrf vrf-name keyword-argument pair displays the named Virtual Private Network (VPN) routing/forwarding instance (VRF) Cisco Express Forwarding table.
 
Step 4
exit


Example:

Router(config)# exit

 

Exits to privileged EXEC mode.

 

Displaying CEF Event-Log Information

Perform the following task to display Cisco Express Forwarding event-log information.

SUMMARY STEPS

1.    enable

2.    clear ip cef event-log

3.    debug ip cef table

4.    show ip cef events summary

5.    show ip cef events within seconds

6.    exit


DETAILED STEPS
Step 1   enable

Use this command to enable privileged EXEC mode. For example:



Example: 
Router> enable

Enter your password if prompted.
Step 2   clear ip cef event-log

Use this command to clear the Cisco Express Forwarding event-log buffer. For example:

Router# clear ip cef event-log


Example: 
 		 
        
 
        
 
         Step 3   
            debug ip cef table  
 
 Use this command to enable the collection of events that affect entries in the Cisco Express Forwarding tables. For example:
 

Example: 
Router# debug ip cef table 
01:25:46:CEF-Table:Event up, 10.1.1.1/32 (rdbs:1, flags:1000000) 
01:25:46:CEF-IP:Checking dependencies of 0.0.0.0/0 
01:25:47:CEF-Table:attempting to resolve 10.1.1.1/32 
01:25:47:CEF-IP:resolved 10.1.1.1/32 via 10.9.104.1 to 10.9.104.1 Ethernet2/0/0 
01:26:02:CEF-Table:Event up, default, 0.0.0.0/0 (rdbs:1, flags:400001) 
01:26:02:CEF-IP:Prefix exists - no-op change 

 		 
        
 
        
 
         Step 4   
            show ip cef events   summary  
 
 Use this command to display a summary of recorded Cisco Express Forwarding FIB and adjacency events. For example:
 

Example: 
Router# show ip cef events summary
CEF table events summary:
     Storage for 10000 events (320000 bytes), 822/0 events recorded/ignored
     Matching all events, traceback depth 16
     Last event occurred 00:00:06.516 ago.

 		 
        
 
        
 
         Step 5   
            show ip cef events   within   seconds  
 
 Use this command to display Cisco Express Forwarding events that occurred within (during) a specified number of seconds. For example, within 1 second:
 

Example: 
Router# show ip cef events within 1
CEF table events (storage for 10000 events, 14 events recorded)
+00:00:00.000:[Default-table] *.*.*.*/*           New FIB table          [OK]
+00:00:00.000:[Default-table] 10.1.80.194/32      FIB insert in mtrie    [OK]
+00:00:00.000:[Default-table] 10.1.80.0/32        FIB insert in mtrie    [OK]
+00:00:00.000:[Default-table] 10.1.80.255/32      FIB insert in mtrie    [OK]
+00:00:00.004:[Default-table] 10.1.80.0/24        FIB insert in mtrie    [OK]
+00:00:00.004:[Default-table] 10.1.80.0/24        NBD up                 [OK]
+00:00:00.004:[Default-table] 239.224.0.0/4       FIB insert in mtrie    [OK]
+00:00:00.012:[Default-table] 10.1.80.0/24        NBD up                 [Ignr]
+00:00:00.012:[Default-table] 239.224.0.0/4       FIB remove             [OK]
+00:00:00.016:[Default-table] 239.224.0.0/4       FIB insert in mtrie    [OK]
+00:00:05.012:[Default-table] 239.224.0.0/4       FIB remove             [OK]
+00:00:05.012:[Default-table] 239.224.0.0/4       FIB insert in mtrie    [OK]
+00:00:28.440:[Default-table] 239.224.0.0/4       FIB remove             [OK]
+00:00:28.440:[Default-table] 239.224.0.0/4       FIB insert in mtrie    [OK]
First event occured at 00:00:36.568 (00:04:40.756 ago)
Last event occured at 00:01:05.008 (00:04:12.316 ago)

 		 
        
 
        
 
         Step 6   
            exit  
 
 Use this command to exit to user EXEC mode. For example:
 

Example: 
Router# exit
Router>
 		 
        
 
        
      
 
      
 
     
 
     
 
      
 
      
 
     
 
    
 
   
 
   
 
     
      
    
Configuration Examples for the Display of Recorded CEF Events
 
    
 
    
 
    
 
      
     
 
     
 
    
 
    
 
      
       
     
Example Customizing CEF Event Logging
 
     
 
      
 
        
         
       
 The following example shows how to enable event logging for Cisco Express Forwarding:
 
       
clear ip cef event-log
!
debug ip cef table
!
configure terminal
!
ip cef table event-log size 25000
exit
!
 
       
 In this example, the Cisco Express Forwarding event log is configured to hold 25000 entries.
 
      
 
     
 
     
 
      
 
      
 
     
 
    
 
   
 
   
 
     
      
    
Additional References
 
    
 
     
 
       
        
     
 
     
 
       
        
      
Related Documents
 
      
 
        
         
       
 
         
         
 
           
 Related Topic 
 		 
           
 Document Title 
 		 
         
 
         
         
         
 
           
 Cisco IOS commands 
 		 
           
 Cisco IOS Master Commands List, All Releases 
 		 
         
 
         
 
           
 Cisco Express Forwarding commands 
 		 
           
 Cisco IOS IP Switching Command Reference 
 		 
         
 
         
 
           
 Overview of the Cisco Express Forwarding feature 
 		 
           
 Cisco Express Forwarding Overview 
 		 
         
 
         
 
           
 Tasks for verifying basic Cisco Express Forwarding and distributed Cisco Express Forwarding operation 
 		 
           
 Configuring Basic Cisco Express Forwarding for Improved Performance, Scalability, and Resiliency in Dynamic Networks 
 		 
         
 
         
 
           
 Tasks for enabling or disabling Cisco Express Forwarding or distributed Cisco Express Forwarding 
 		 
           
 Enabling or Disabling Cisco Express Forwarding or Distributed Cisco Express Forwarding to Customize Switching and Forwarding for Dynamic Networks 
 		 
         
 
         
 
           
 Tasks for configuring load-balancing schemes for Cisco Express Forwarding 
 		 
           
 Configuring a Load-Balancing Scheme for Cisco Express Forwarding Traffic 
 		 
         
 
         
 
           
 Tasks for configuring Cisco Express Forwarding consistency checkers 
 		 
           
 Configuring Cisco Express Forwarding Consistency Checkers for Route Processors and Line Cards 
 		 
         
 
         
 
           
 Tasks for configuring epochs for Cisco Express Forwarding tables 
 		 
           
 Configuring Epochs to Clear and Rebuild Cisco Express Forwarding and Adjacency Tables 
 		 
         
 
         
 
           
 Tasks for configuring and verifying Cisco Express Forwarding network accounting 
 		 
           
 Configuring Cisco Express Forwarding Network Accounting 
 		 
         
 
         
 
           
 Tasks for customizing the display of recorded Cisco Express Forwarding events trace messages for Cisco IOS Releases 12.2(25)S, 12.2(33)SB, 12.2(33)SRA, 12.2.(33)SXH, 12.4(20)T and later releases 
 		 
           
 Customizing the Display of Cisco IOS Event Trace Messages 
 		 
         
 
         
 
           
 Causes of common Cisco Express Forwarding-related error messages on platforms running distributed Cisco Express Forwarding switching (Cisco 7500 series routers and Cisco 12000 series Internet routers) and how to troubleshoot them 
 		 
           
 Troubleshooting Cisco Express Forwarding-Related Error Messages 
 		 
         
 
         
       
 
      
 
     
 
     
 
       
        
      
Standards
 
      
 
        
         
       
 
         
         
 
           
 Standards 
 		 
           
 Title 
 		 
         
 
         
         
         
 
           
 No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature. 
 		 
           
 -- 
 		 
         
 
         
       
 
      
 
     
 
     
 
       
        
      
MIBs
 
      
 
        
         
       
 
         
         
 
           
 MIBs 
 		 
           
 MIBs Link 
 		 
         
 
         
         
         
 
           
 No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature. 
 		 
           
 To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: 
 
 http://www.cisco.com/go/mibs 
 		 
         
 
         
       
 
      
 
     
 
     
 
       
        
      
RFCs
 
      
 
        
         
       
 
         
         
 
           
 RFCs 
 		 
           
 Title 
 		 
         
 
         
         
         
 
           
 No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature. 
 		 
           
 -- 
 		 
         
 
         
       
 
      
 
     
 
     
 
       
        
      
Technical Assistance
 
      
 
        
         
       
 
         
         
 
           
 Description 
 		 
           
 Link 
 		 
         
 
         
         
         
 
           
 The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password. 
 		 
           
 http://www.cisco.com/cisco/web/support/index.html 
 		 
         
 
         
       
 
      
 
     
 
    
 
    
 
     
 
     
 
    
 
   
 
   
 
     
      
    
Feature Information for the Display of Recorded CEF Events
 
    
 
     
 
       
        
      
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature. 
 
      
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required. 
 
     
 
     
 
       
        
      
 
        
         
       
 
         
         
 
          Table 1 
          Feature Information for Configuring the Display of Recorded Cisco Express Forwarding Events  
         
 
         
       
 
       
 
         
         
 
           
 Feature Name 
 		 
           
 Releases 
 		 
           
 Feature Configuration Information 
 		 
         
 
         
         
         
 
           
 This table is intentionally left blank because no features were introduced or modified in Cisco IOS Release 12.2(1) or later. This table will be updated when feature information is added to this module. 
 		 
           
 -- 
 		 
           
 -- 
 		 
         
 
         
       
 
      
 
     
 
    
 
    
 
     
 
     
 
    
 
   
 
   
 
     
      
    
Glossary
 
    
 
     
  adjacency --A relationship formed between selected neighboring routers and end nodes for the purpose of exchanging routing information. Adjacency is based upon the use of a common media segment by the routers and nodes involved. 
 
     
  Cisco Express Forwarding --A Layer 3 switching technology. Cisco Express Forwarding can also refer to central Cisco Express Forwarding mode, one of two modes of Cisco Express Forwarding operation. Cisco Express Forwarding enables a Route Processor to perform express forwarding. Distributed Cisco Express Forwarding is the other mode of Cisco Express Forwarding operation.
 
     
  distributed Cisco Express Forwardin g--A mode of Cisco Express Forwarding operation in which line cards (such as Versatile Interface Processor (VIP) line cards) maintain identical copies of the forwarding information base (FIB) and adjacency tables. The line cards perform the express forwarding between port adapters; this relieves the Route Switch Processor of involvement in the switching operation.
 
     
  FIB --forwarding information base. A component of Cisco Express Forwarding that is conceptually similar to a routing table or information base. The router uses the FIB lookup table to make destination-based switching decisions during Cisco Express Forwarding operation. The router maintains a mirror image of the forwarding information in an IP routing table.
 
     
  line card --A general term for an interface processor that can be used in various Cisco products. For example, a Versatile Interface Processor (VIP) is a line card for the Cisco 7500 series router.
 
     
  prefix --The network address portion of an IP address. A prefix is specified by a network and mask and is generally represented in the format network/mask. The mask indicates which bits are the network bits. For example, 1.0.0.0/16 means that the first 16 bits of the IP address are masked, making them the network bits. The remaining bits are the host bits. In this example, the network number is 10.0.
 
     
  VPN --Virtual Private Network. The result of a router configuration that enables IP traffic to use tunneling to travel securely over a public TCP/IP network. 
 
     
  VRF --A Virtual Private Network (VPN) routing/forwarding instance. A VRF consists of an IP routing table, a derived forwarding table, a set of interfaces that use the forwarding table, and a set of rules and routing protocols that determine what goes into the forwarding table. In general, a VRF includes the routing information that defines a customer VPN site that is attached to a PE router. 
 
     
 
 
    
 
    
 
     
 
     
 
    
 
   
 
   
 
     
      
    
 
 
    
 
     
 
       
        
      
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R) 
 
      
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental. 
 
     
 
    
 
    
 
     
 
     
 
     
 
     
 
     
 
     
 
     
 
     
 
     
 
     
 
     
 
     
 
     
 
     
 
     
 
     
 
     
 
     
 
     
 
     
 
     
 
     
 
     
 
     
 
    
 
   
 
   
  

    © 2011 Cisco Systems, Inc. All rights reserved.