Contents

Customizing the Display of CEF Event Trace Messages

This module contains information about and instructions for customizing the display of recorded Cisco Express Forwarding events for Cisco IOS Releases 12.2(25)S, 12.2(33)SB, 12.2(33)SRA, 12.2.(33)SXH, 12.4(20)T, and later releases.

For information about and instructions for customizing the display of recorded Cisco Express Forwarding events for Cisco IOS releases prior to 12.2(25)S, 12.2(33)SB, 12.2(33)SRA, 12.2.(33)SXH, and 12.4(20)T, see Customizing the Display of Cisco Express Forwarding Events.

You can customize the Cisco Express Forwarding event-tracing message display by specifying the size of the file stored in memory or by choosing to display event trace messages by prefix and mask, by a specified interface, or by a Cisco Express Forwarding Virtual Private Network (VPN) routing and forwarding instance (VRF) for an IPv4 or IPv6 address family.

Cisco Express Forwarding is an advanced Layer 3 IP switching technology. It optimizes network performance and scalability for all kinds of networks: those that carry small amounts of traffic and those that carry large amounts of traffic in complex patterns, such as the Internet and networks characterized by intensive web-based applications or interactive sessions.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

Prerequisites for the Display of CEF Event Trace Messages

Cisco Express Forwarding must be running on the networking device before you can customize the display of recorded Cisco Express Forwarding events.

Restrictions for the Display of CEF Event Trace Messages

If you enable Cisco Express Forwarding and then create an access list that uses the log keyword, the packets that match the access list are not Cisco Express Forwarding switched. They are fast switched. Logging disables Cisco Express Forwarding.

Information About the Display of CEF Event Trace Messages

For links to information about other Cisco Express Forwarding and distributed Cisco Express Forwarding features that you can configure, go to the Additional References.

Cisco Platform Support for Central CEF and dCEF

Cisco Express Forwarding is enabled by default on most Cisco platforms running Cisco IOS software Release 12.0 or later. When Cisco Express Forwarding is enabled on a router, the Route Processor (RP) performs the express forwarding.

To find out if Cisco Express Forwarding is enabled on your platform, enter the show ip cefcommand. If Cisco Express Forwarding is enabled, you receive output that looks like this:

Router# show ip cef 
Prefix              Next Hop            Interface
[...]
10.2.61.8/24        192.168.100.1       FastEthernet1/0/0
                    192.168.101.1       FastEthernet6/1
[...]

If Cisco Express Forwarding is not enabled on your platform, the output for the show ip cefcommand looks like this:

Router# show ip cef
%CEF not running

Distributed Cisco Express Forwarding is enabled by default on the Catalyst 6500 series switch, the Cisco 7500 series router, and the Cisco 12000 Series Internet Router. When distributed Cisco Express Forwarding is enabled on your platform, the line cards perform the express forwarding.

If Cisco Express Forwarding is not enabled on your platform, use the ip cefcommand to enable (central) Cisco Express Forwarding or the ip cef distributed command to enable distributed Cisco Express Forwarding.

Overview of CEF Event Trace Function

The Cisco Express Forwarding event trace function collects Cisco Express Forwarding events as they occur, even when debugging is not enabled. This function allows the tracing of an event immediately after it occurs. Cisco technical personnel can use the event trace function to help resolve any problems with the Cisco Express Forwarding feature.

Cisco Express Forwarding event trace messages are saved in memory on the device. When the event trace messages exceed the configured size, the newest message in the trace will begin to overwrite the older messages. You can use the following commands to change the capacity of the Cisco Express Forwarding event message file:

  • The monitor event-trace cef events sizeglobal configuration command allows you to increase or decrease the number of messages that can be written to memory for a single instance of a trace. To display the size parameter, use the show monitor event-trace events parameters command.

  • The monitor event-trace cef events clear privileged EXEC command allows you to clear existing trace messages.

  • The monitor event-trace cef(global) command configures event tracing for Cisco Express Forwarding events. To monitor and control the event trace function for Cisco Express Forwarding events, use the monitor event-trace cef (EXEC) command.

You can use the following commands to display Cisco Express Forwarding events:

  • The show monitor event-trace cef allcommand displays all event trace messages currently in memory for Cisco Express Forwarding.

  • The debug ip cef command and the events keyword record general Cisco Express Forwarding events as they occur.

  • The debug ip cef tablecommand enables the real-time collection of events that affect entries in the Cisco Express Forwarding tables.

CEF Event Tracing Defaults and Options

Event tracing for distributed Cisco Express Forwarding events is enabled by default. The Cisco IOS XE software allows Cisco Express Forwarding to define whether support for event tracing is enabled or disabled by default. The command interface for event tracing allows you to change the default value in one of two ways: using the monitor event-trace cefcommand in privileged EXEC mode or using the monitor event-trace cefcommand in global configuration mode.

To configure the file in which you want to save trace information, use the monitor event-trace cefcommand in global configuration mode. By default, the trace messages are saved in a binary format. If you want to save trace messages in ASCII format, possibly for additional application processing, use the monitor event-trace cef dump pretty command in privileged EXEC mode. The amount of data collected from a trace depends on the trace message size configured using the monitor event-trace cefcommand in global configuration mode for each instance of a trace.

To specify the trace call stack at tracepoints, you must first clear the trace buffer.

CEF Event Tracing for IPv4 Events

Event tracing for Cisco Express Forwarding IPv4 events is enabled by default. The software allows Cisco Express Forwarding to define whether support for event tracing is enabled or disabled by default. The command interface for event tracing allows you to change the default value in one of two ways: using the monitor event-trace cef ipv4command in privileged EXEC mode or using the monitor event-trace cef ipv4command in global configuration mode.

To configure the file in which you want to save trace information for Cisco Express Forwarding IPv4 events, use the monitor event-trace cef ipv4command in global configuration mode. By default, the trace messages are saved in a binary format. If you want to save trace messages in ASCII format, possibly for additional application processing, use the monitor event-trace cef ipv4 dump pretty command in privileged EXEC mode. The amount of data collected from the trace depends on the trace message size configured using the monitor event-trace cef ipv4command for each instance of a trace.

To determine whether event tracing is enabled by default for Cisco Express Forwarding, use the show monitor event-trace cef ipv4command to display trace messages.

To specify the trace call stack at tracepoints, you must first clear the trace buffer.

CEF Event Tracing for IPv6 Events

Event tracing for Cisco Express Forwarding IPv6 events is enabled by default.The Cisco IOS XE software allows Cisco Express Forwarding to define whether support for event tracing is enabled or disabled by default. The command interface for event tracing allows you to change the default value in one of two ways: using the monitor event-trace cef ipv6command in privileged EXEC mode or using the monitor event-trace cef ipv6command in global configuration mode.

To configure the file in which you want to save trace information for Cisco Express Forwarding IPv6 events, use the monitor event-trace cef ipv6command in global configuration mode. By default, the trace messages are saved in a binary format. If you want to save trace messages in ASCII format, possibly for additional application processing, use the monitor event-trace cef ipv6 dump pretty command in privileged EXEC mode. The amount of data collected from the trace depends on the trace message size configured using the monitor event-trace cef ipv6command for each instance of a trace.

To determine whether event tracing is enabled by default for Cisco Express Forwarding, use the show monitor event-trace cef ipv6command to display trace messages.

To specify the trace call stack at tracepoints, you must first clear the trace buffer.

How to Customize the Display of CEF Event Trace Messages

Customizing CEF Event Tracing

Perform the following task to customize Cisco Express Forwarding event tracing. Event trace messages can be used to monitor Cisco Express Forwarding and to help resolve any issues with the Cisco Express Forwarding feature.

SUMMARY STEPS

    1.    enable

    2.    configure terminal

    3.    monitor event-trace cef {dump-file dump-file-name | {events | interface} {disable | dump-file dump-file-name| enable | size number | stacktrace [depth]}}

    4.    exit

    5.    monitor event-trace cef {dump [merged pretty | pretty] | {events | interface | ipv4 | ipv6} {clear | continuous [cancel] | disable | dump [pretty] | enable | one-shot}}

    6.    disable


DETAILED STEPS
     Command or ActionPurpose
    Step 1 enable


    Example:
    Router> enable
     

    Enables privileged EXEC mode.

    • Enter your password if prompted.

     
    Step 2 configure terminal


    Example:
    Router# configure terminal
     

    Enters global configuration mode.

     
    Step 3 monitor event-trace cef {dump-file dump-file-name | {events | interface} {disable | dump-file dump-file-name| enable | size number | stacktrace [depth]}}


    Example:
    Router(config)# monitor event-trace cef dump-file tftp://172.16.10.5/cef-events
     

    Configures event tracing for Cisco Express Forwarding.

    • The dump-file dump-file-name keyword and argument pair specify the file to which event trace messages are written from memory on the networking device. The maximum length of the filename (path and filename) is 100 characters, and the path can point to flash memory on the networking device or to a TFTP or FTP server.

    • The eventskeyword turns on event tracing for Cisco Express Forwarding events.

    • The interface keyword turns on event tracing for Cisco Express Forwarding interface events.

    • The disable keyword turns off event tracing for Cisco Express Forwarding events.

    • The enable keyword turns on event tracing for Cisco Express Forwarding events if it had been enabled with the monitor event-trace cef privileged EXEC command.

    • The size number keyword and argument pair sets the number of messages that can be written to memory for a single instance of a trace. Range: 1 to 65536.

    Note   

    Some Cisco IOS software subsystem components set the size by default. To display the size parameter, use the show monitor event-trace cef events parameters command.

    • The stacktrace keyword enables the stack trace at tracepoints.

    • The depth argument specifies the depth of the stack trace stored. Range: 1 to 16.

     
    Step 4 exit


    Example:
    Router(config)# exit
     

    Exits to privileged EXEC mode.

     
    Step 5 monitor event-trace cef {dump [merged pretty | pretty] | {events | interface | ipv4 | ipv6} {clear | continuous [cancel] | disable | dump [pretty] | enable | one-shot}}


    Example:
    Router# monitor event-trace cef events dump pretty
     

    Monitors and controls the event trace function for Cisco Express Forwarding.

    • The dump keyword writes the event trace results to the file configured with the monitor event-trace cefglobal configuration command. The trace messages are saved in binary format.

    • The merged pretty keywords sort all event trace entries by time and write the entries to a file in ASCII format.

    • The pretty keyword saves the event trace message in ASCII format.

    • The events keyword monitors Cisco Express Forwarding events.

    • The interfacekeyword monitors Cisco Express Forwarding interface events.

    • The ipv4keyword monitors Cisco Express Forwarding IPv4 events.

    • The ipv6 keyword monitors Cisco Express Forwarding IPv6 events.

    • The clear keyword clears existing trace messages for Cisco Express Forwarding from memory on the networking device.

    • The continuous keyword continuously displays the latest event trace entries.

    • The cancel keyword cancels the continuous display of the latest trace entries.

    • The disable keyword turns off Cisco Express Forwarding event tracing.

    • The enable keyword turns on Cisco Express Forwarding event tracing.

    • The one-shot keyword Clears any existing trace information from memory, starts event tracing again, and disables the trace when the size of the trace message file configured in the global configuration command is exceeded.

     
    Step 6 disable


    Example:
    Router# disable 
     

    Exits to user EXEC mode.

     

    Customizing CEF Event Tracing for IPv4 Events

    Perform the following task to customize Cisco Express Forwarding event tracing for Cisco Express Forwarding IPv4 events. Use event tracing to monitor Cisco Express Forwarding IPv4 events as they occur and to help resolve any issues with Cisco Express Forwarding and related IPv4 events.

    SUMMARY STEPS

      1.    enable

      2.    configure terminal

      3.    monitor event-trace cef ipv4 {disable | distribution |dump-file dump-file-name| enable | match {global | ip-address mask} | size number | stacktrace [depth] | vrf vrf-name [distribution | match {global | ip-address mask}]}

      4.    exit

      5.    monitor event-trace cef ipv4 {clear | continuous [cancel] | disable | dump [pretty] | enable | one-shot}

      6.    disable


    DETAILED STEPS
       Command or ActionPurpose
      Step 1 enable


      Example:
      Router> enable
       

      Enables privileged EXEC mode.

      • Enter your password if prompted.

       
      Step 2 configure terminal


      Example:
      Router# configure terminal
       

      Enters global configuration mode.

       
      Step 3 monitor event-trace cef ipv4 {disable | distribution |dump-file dump-file-name| enable | match {global | ip-address mask} | size number | stacktrace [depth] | vrf vrf-name [distribution | match {global | ip-address mask}]}


      Example:
      Router(config)# monitor event-trace cef ipv4 size 10000
       

      Configures event-tracing for Cisco Express Forwarding IPv4 events.

      • The disable keyword turns off event tracing for Cisco Express Forwarding IPv4 events.

      • The distribution keyword logs events related to the distribution of Cisco Express Forwarding Forwarding Information Base (FIB) tables to the line cards

      • The dump-file dump-file-name keyword and argument pair specify the file to which event trace messages are written from memory on the networking device. The maximum length of the filename (path and filename) is 100 characters, and the path can point to flash memory on the networking device or to a TFTP or FTP server.

      • The enable keyword turns on event tracing for Cisco Express Forwarding IPv4 events if it had been enabled with the monitor event-trace cef privileged EXEC command.

      • The matchkeyword turns on event tracing for Cisco Express Forwarding IPv4 events that matches global events or events that match a specific network address

      • The globalkeyword specifies global events.

      • The ip-address maskargumentsspecify an IP address in A.B.C.D format and a subnet mask in A.B.C.D format.

      • The size number keyword and argument pair sets the number of messages that can be written to memory for a single instance of a trace. Range: 1 to 65536.

      Note   

      Some Cisco IOS software subsystem components set the size by default. To display the size parameter, use the show monitor event-trace cef ipv4 parameters command.

      • The stacktrace keyword enables the stack trace at tracepoints.

      • The depth argument specifies the depth of the stack trace stored. Range: 1 to 16.

      • The vrf vrf-name keyword and argument pair turns on event tracing for a Cisco Express Forwarding IPv4 VRF table. The vrf-name argument specifies the name of the VRF

       
      Step 4 exit


      Example:
      Router(config)# exit 
       

      Exits to privileged EXEC mode.

       
      Step 5 monitor event-trace cef ipv4 {clear | continuous [cancel] | disable | dump [pretty] | enable | one-shot}


      Example:
      Router# monitor event-trace cef ipv4 continuous
       

      Monitors and controls the event trace function for Cisco Express Forwarding IPv4 events.

      • The clear keyword clears existing trace messages for Cisco Express Forwarding from memory on the networking device.

      • The continuous keyword continuously displays the latest event trace entries.

      • The cancel keyword cancels the continuous display of the latest trace entries.

      • The disable keyword turns off Cisco Express Forwarding event tracing.

      • The dump keyword writes the event trace results to the file configured with the global configuration monitor event-trace cef command. The trace messages are saved in binary format.

      • The pretty keyword saves the event trace message in ASCII format.

      • The enable keyword turns on Cisco Express Forwarding event tracing.

      • The one-shot keyword clears any existing trace information from memory, starts event tracing again, and disables the trace when the size of the trace message file configured in the global configuration command is exceeded.

       
      Step 6 disable


      Example:
      Router# disable 
       

      Exits to user EXEC mode.

       

      Customizing CEF Event Tracing for IPv6 Events

      Perform the following task to customize Cisco Express Forwarding event tracing for Cisco Express Forwarding IPv6 events.Use event tracing to monitor Cisco Express Forwarding IPv6 events as they occur and to help resolve any issues with Cisco Express Forwarding and related IPv6 events.

      SUMMARY STEPS

        1.    enable

        2.    configure terminal

        3.    monitor event-trace cef ipv4 {disable | distribution | dump-file dump-file-name| enable | match {global | ipv6-address/n} | size number | stacktrace [depth] | vrf vrf-name [distribution | match {global | ipv6-address/n}]}

        4.    exit

        5.    monitor event-trace cef ipv6 {clear | continuous [cancel] | disable | dump [pretty] | enable | one-shot}}

        6.    disable


      DETAILED STEPS
         Command or ActionPurpose
        Step 1 enable


        Example:
        Router> enable
         

        Enables privileged EXEC mode.

        • Enter your password if prompted.

         
        Step 2 configure terminal


        Example:
        Router# configure terminal
         

        Enters global configuration mode.

         
        Step 3 monitor event-trace cef ipv4 {disable | distribution | dump-file dump-file-name| enable | match {global | ipv6-address/n} | size number | stacktrace [depth] | vrf vrf-name [distribution | match {global | ipv6-address/n}]}


        Example:
        Router(config)# monitor event-trace cef ipv6 match global
         

        Configures event-tracing for Cisco Express Forwarding IPv6 events.

        • The disable keyword turns off event tracing for Cisco Express Forwarding IPv6 events.

        • The distribution keyword logs events related to the distribution of Cisco Express Forwarding FIB tables to the line cards.

        • The dump-file dump-file-name keyword and argument pair specify the file to which event trace messages are written from memory on the networking device. The maximum length of the filename (path and filename) is 100 characters, and the path can point to flash memory on the networking device or to a TFTP or FTP server.

        • The enable keyword turns on event tracing for Cisco Express Forwarding IPv6 events if it had been enabled with the monitor event-trace cef privileged EXEC command.

        • The matchkeyword turns on event tracing for Cisco Express Forwarding IPv6 events that matches global events or events that match a specific network address.

        • The globalkeyword specifies global events.

        • The ipv6-address / nargument specifies an IPv6 address. This address must be in the form documented in RFC 2373: the address is specified in hexadecimals using 16-bit values between colons. The slash followed by a number (/ n) indicates the number of bits that do not change. Range: 0 to 128

        • The size number keyword and argument pair sets the number of messages that can be written to memory for a single instance of a trace. Range: 1 to 65536.

        Note   

        Some Cisco IOS software subsystem components set the size by default. To display the size parameter, use the show monitor event-trace cef ipv6 parameters command.

        • The stacktrace keyword enables the stack trace at tracepoints.

        • The depth argument specifies the depth of the stack trace stored. Range: 1 to 16.

        • The vrf vrf-name keyword and argument pair turns on event tracing for a Cisco Express Forwarding IPv6 VRF table. The vrf-name argument specifies the name of the VRF

         
        Step 4 exit


        Example:
        Router(config)# exit 
         

        Exits to privileged EXEC mode.

         
        Step 5 monitor event-trace cef ipv6 {clear | continuous [cancel] | disable | dump [pretty] | enable | one-shot}}


        Example:
        Router# monitor event-trace cef ipv6 one-shot
         

        Monitors and controls the event trace function for Cisco Express Forwarding IPv6 events.

        • The clear keyword clears existing trace messages for Cisco Express Forwarding from memory on the networking device.

        • The continuous keyword continuously displays the latest event trace entries.

        • The cancel keyword cancels the continuous display of the latest trace entries.

        • The disable keyword turns off Cisco Express Forwarding event tracing.

        • The dump keyword writes the event trace results to the file configured with the global configuration monitor event-trace cef command. The trace messages are saved in binary format.

        • The pretty keyword saves the event trace message in ASCII format.

        • The enable keyword turns on Cisco Express Forwarding event tracing.

        • The one-shot keyword Clears any existing trace information from memory, starts event tracing again, and disables the trace when the size of the trace message file configured in the global configuration command is exceeded.

         
        Step 6 disable


        Example:
        Router# disable 
         

        Exits to privileged EXEC mode.

         

        Displaying CEF Event Trace Information

        Perform the following task to display Cisco Express Forwarding event trace information.

        SUMMARY STEPS

          1.    enable

          2.    monitor event-trace cef events clear

          3.    debug ip cef table

          4.    show monitor events-trace cef all

          5.    show monitor event-trace cef latest

          6.    show monitor event-trace cef events all

          7.    show monitor event-trace cef interface latest

          8.    show monitor event-trace cef ipv4 all

          9.    show monitor event-trace cef ipv6 parameters

          10.    disable


        DETAILED STEPS
          Step 1   enable

          Use this command to enable privileged EXEC mode. Enter your password if prompted. For example:



          Example:
          Router> enable
          Router#

          Step 2   monitor event-trace cef events clear

          Use this command to clear the Cisco Express Forwarding event trace buffer. For example:

          Router# monitor event-trace cef clear


          Example:
          
          
                  
          Step 3   debug ip cef table

          Use this command to display events that affect entries in the Cisco Express Forwarding tables. For example:



          Example:
          Router# debug ip cef table 
          01:25:46:CEF-Table:Event up, 10.1.1.1/32 (rdbs:1, flags:1000000) 
          01:25:46:CEF-IP:Checking dependencies of 0.0.0.0/0 
          01:25:47:CEF-Table:attempting to resolve 10.1.1.1/32 
          01:25:47:CEF-IP:resolved 10.1.1.1/32 via 10.9.104.1 to 10.9.104.1 Ethernet2/0/0 
          01:26:02:CEF-Table:Event up, default, 0.0.0.0/0 (rdbs:1, flags:400001) 
          01:26:02:CEF-IP:Prefix exists - no-op change 
          
          Step 4   show monitor events-trace cef all

          Use this command to display event trace messages for Cisco Express Forwarding. For example:



          Example:
          Router# show monitor event-trace cef all
          cef_events:
          *Jul 22 20:14:58.999: SubSys  ipv4fib_ios_def_cap init
          *Jul 22 20:14:58.999: SubSys  ipv6fib_ios_def_cap init
          *Jul 22 20:14:58.999: Inst    unknown -> RP
          *Jul 22 20:14:58.999: SubSys  fib_ios_chain init
          *Jul 22 20:14:59.075: SubSys  fib init
          *Jul 22 20:14:59.075: SubSys  ipv4fib init
          *Jul 22 20:14:59.075: SubSys  fib_ios init
          *Jul 22 20:14:59.075: SubSys  fib_ios_if init
          *Jul 22 20:14:59.075: SubSys  ipv4fib_ios init
          *Jul 22 20:14:59.075: Flag    Common CEF enabled set to yes
          *Jul 22 20:14:59.075: Flag    IPv4 CEF enabled set to yes
          *Jul 22 20:14:59.075: Flag    IPv4 CEF switching enabled set to yes
          *Jul 22 20:14:59.075: GState  CEF enabled
          *Jul 22 20:14:59.075: SubSys  ipv6fib_ios init
          *Jul 22 20:14:59.075: SubSys  ipv4fib_util init
          *Jul 22 20:14:59.075: SubSys  ipv4fib_les init
          *Jul 22 20:15:02.907: Process Background created
          *Jul 22 20:15:02.907: Flag    IPv4 CEF running set to yes
          *Jul 22 20:15:02.907: Process Background event loop enter
          *Jul 22 20:15:02.927: Flag    IPv4 CEF switching running set to yes
                    
          cef_interface:
          *Jul 22 20:14:58.999: Et0/0        (hw  3) SWvecLES <unknown> (0x01096A3C)
          *Jul 22 20:14:58.999: Et0/1        (hw  4) SWvecLES <unknown> (0x01096A3C)
          *Jul 22 20:14:58.999: Et0/2        (hw  5) SWvecLES <unknown> (0x01096A3C)
          *Jul 22 20:14:58.999: Et0/3        (hw  6) SWvecLES <unknown> (0x01096A3C)
          *Jul 22 20:14:58.999: Et1/0        (hw  7) SWvecLES <unknown> (0x01096A3C)
          *Jul 22 20:14:58.999: Et1/1        (hw  8) SWvecLES <unknown> (0x01096A3C)
          *Jul 22 20:14:58.999: Et1/2        (hw  9) SWvecLES <unknown> (0x01096A3C)
          *Jul 22 20:14:58.999: Et1/3        (hw 10) SWvecLES <unknown> (0x01096A3C)
          *Jul 22 20:14:58.999: Se2/0        (hw 11) SWvecLES <unknown> (0x01096A3C)
          *Jul 22 20:14:58.999: Se2/1        (hw 12) SWvecLES <unknown> (0x01096A3C)
          .
          .
          .

          The output is in table format where the first column contains a time stamp, the second column lists the type of event, and the third column lists the detail for the event.

          Step 5   show monitor event-trace cef latest

          Use this command to display only the event trace message that have been sent since the last instance of the show monitor event-trace cef command. For example:



          Example:
          Router# show monitor event-trace cef latest
          cef_events:
          cef_interface:
          *Jul 22 20:14:59.075: Se3/0        (sw 15) FlagCha  0x60C1 add puntLC
          *Jul 22 20:14:59.075: <empty>      (hw 16) State    down -> up
          *Jul 22 20:14:59.075: <empty>      (hw 16) Create   new
          *Jul 22 20:14:59.075: Se3/1        (hw 16) NameSet  
          *Jul 22 20:14:59.075: Se3/1        (hw 16) HWIDBLnk Serial3/1(16)
          *Jul 22 20:14:59.075: Se3/1        (hw 16) RCFlags  None -> Fast
          *Jul 22 20:14:59.075: <empty>      (sw 16) VRFLink  IPv4:id0 - success
          *Jul 22 20:14:59.075: <empty>      (sw 16) State    deleted -> down
          *Jul 22 20:14:59.075: <empty>      (sw 16) Create   new
          *Jul 22 20:14:59.075: Se3/1        (sw 16) NameSet  
          *Jul 22 20:14:59.075: Se3/1        (sw 16) FIBHWLnk Serial3/1(16)
          *Jul 22 20:14:59.075: Se3/1        (sw 16) SWIDBLnk Serial3/1(16)
          *Jul 22 20:14:59.075: Se3/1        (sw 16) FlagCha  0x6001 add p2p|input|first
          *Jul 22 20:14:59.075: Se3/1        (sw 16) FlagCha  0x6041 add auto_adj
          *Jul 22 20:14:59.075: Se3/1        (sw 16) Impared  lc rea Queueing configuration
          *Jul 22 20:14:59.075: Se3/1        (sw 16) FlagCha  0x60C1 add puntLC
          *Jul 22 20:14:59.075: <empty>      (hw 17) State    down -> up
          *Jul 22 20:14:59.075: <empty>      (hw 17) Create   new
          *Jul 22 20:14:59.075: Se3/2        (hw 17) NameSet 
          
          Step 6   show monitor event-trace cef events all

          Use this command to display information about Cisco Express Forwarding events. For example:



          Example:
          Router# show monitor event-trace cef events all 
          *Jul 13 17:38:27.999: SubSys  ipv4fib_ios_def_cap init
          *Jul 13 17:38:27.999: SubSys  ipv6fib_ios_def_cap init
          *Jul 13 17:38:27.999: Inst    unknown -> RP
          *Jul 13 17:38:27.999: SubSys  fib_ios_chain init
          *Jul 13 17:38:28.199: SubSys  fib init
          *Jul 13 17:38:28.199: SubSys  ipv4fib init
          *Jul 13 17:38:28.199: SubSys  fib_ios init
          *Jul 13 17:38:28.199: SubSys  fib_ios_if init
          *Jul 13 17:38:28.199: SubSys  ipv4fib_ios init
          *Jul 13 17:38:28.199: Flag    Common CEF enabled set to yes
          *Jul 13 17:38:28.199: Flag    IPv4 CEF enabled set to yes
          *Jul 13 17:38:28.199: Flag    IPv4 CEF switching enabled set to yes
          *Jul 13 17:38:28.199: GState  CEF enabled
          *Jul 13 17:38:28.199: SubSys  ipv6fib_ios init
          *Jul 13 17:38:28.199: SubSys  ipv4fib_util init
          *Jul 13 17:38:28.199: SubSys  ipv4fib_les init
          *Jul 13 17:38:34.059: Process Background created
          *Jul 13 17:38:34.059: Flag    IPv4 CEF running set to yes
          *Jul 13 17:38:34.059: Process Background event loop enter
          *Jul 13 17:38:34.079: Flag    IPv4 CEF switching running set to yes
          

          The output is in table format where the first column contains a time stamp, the second column lists the type of event, and the third column lists the detail for the event.

          For example, the Subsys event type is related to the initialization of a subset of Cisco Express Forwarding functionality. The "ipv4fib_ios_def_cap init" entry is the initialization of IPv4 Cisco Express Forwarding default capabilities.

          Step 7   show monitor event-trace cef interface latest

          Use this command to display only the event trace messages generated since the last show monitor event-trace cef interfacecommand was entered. For example:



          Example:
          Router# show monitor event-trace cef interface latest
          *Jul 22 20:14:58.999: Et0/0        (hw  3) SWvecLES <unknown> (0x01096A3C)
          *Jul 22 20:14:58.999: Et0/1        (hw  4) SWvecLES <unknown> (0x01096A3C)
          *Jul 22 20:14:58.999: Et0/2        (hw  5) SWvecLES <unknown> (0x01096A3C)
          *Jul 22 20:14:58.999: Et0/3        (hw  6) SWvecLES <unknown> (0x01096A3C)
          .
          .
          .
          *Jul 22 20:14:59.075: <empty>      (hw  3) State    down -> up
          *Jul 22 20:14:59.075: <empty>      (hw  3) Create   new
          *Jul 22 20:14:59.075: Et0/0        (hw  3) NameSet  
          *Jul 22 20:14:59.075: Et0/0        (hw  3) HWIDBLnk Ethernet0/0(3)
          *Jul 22 20:14:59.075: Et0/0        (hw  3) RCFlags  None -> Fast
          *Jul 22 20:14:59.075: <empty>      (sw  3) VRFLink  IPv4:id0 - success
          *Jul 22 20:14:59.075: <empty>      (sw  3) State    deleted -> down
          *Jul 22 20:14:59.075: <empty>      (sw  3) Create   new
          *Jul 22 20:14:59.075: Et0/0        (sw  3) NameSet  
          *Jul 22 20:14:59.075: Et0/0        (sw  3) FIBHWLnk Ethernet0/0(3)
          *Jul 22 20:14:59.075: Et0/0        (sw  3) SWIDBLnk Ethernet0/0(3)
          *Jul 22 20:14:59.075: Et0/0        (sw  3) FlagCha  0x6000 add input|first
          *Jul 22 20:14:59.075: Et0/0        (sw  3) State    down -> up
          *Jul 22 20:14:59.075: <empty>      (hw  4) State    down -> up
          *Jul 22 20:14:59.075: <empty>      (hw  4) Create   new
          *Jul 22 20:14:59.075: Et0/1        (hw  4) NameSet  
          *Jul 22 20:14:59.075: Et0/1        (hw  4) HWIDBLnk Ethernet0/1(4)
          *Jul 22 20:14:59.075: Et0/1        (hw  4) RCFlags  None -> Fast
          *Jul 22 20:14:59.075: <empty>      (sw  4) VRFLink  IPv4:id0 - success
          *Jul 22 20:14:59.075: <empty>      (sw  4) State    deleted -> down
          *Jul 22 20:14:59.075: <empty>      (sw  4) Create   new
          *Jul 22 20:14:59.075: Et0/1        (sw  4) NameSet  
          *Jul 22 20:14:59.075: Et0/1        (sw  4) FIBHWLnk Ethernet0/1(4)
          *Jul 22 20:14:59.075: Et0/1        (sw  4) SWIDBLnk Ethernet0/1(4)
          *Jul 22 20:14:59.075: Et0/1        (sw  4) FlagCha  0x6000 add input|first
          *Jul 22 20:14:59.075: Et0/1        (sw  4) State    down -> up
          .
          .
          .
          Step 8   show monitor event-trace cef ipv4 all

          Use this command to display information about Cisco Express Forwarding IPv4 events. For example:



          Example:
          Router# show monitor event-trace cef ipv4 all 
          *Jul 22 20:14:59.075:  [Default] *.*.*.*/*             Allocated FIB table      
                                [OK]
          *Jul 22 20:14:59.075:  [Default] *.*.*.*/*'00          Add source Default table 
                                [OK]
          *Jul 22 20:14:59.075:  [Default] 0.0.0.0/0'00          FIB add src DRH (ins)    
                                [OK]
          *Jul 22 20:14:59.075:  [Default] *.*.*.*/*'00          New FIB table            
                                [OK]
          *Jul 22 20:15:02.927:  [Default] *.*.*.*/*'00          FIB refresh start        
                                [OK]
          .
          .
          .

          Step 9   show monitor event-trace cef ipv6 parameters

          Use this commands to display parameters configured for Cisco Express Forwarding IPv6 events. For example:



          Example:
          Router# show monitor event-trace cef ipv6 parameters
          Trace has 1000 entries
          Stacktrace is disabled by default
          Matching all events
          
          Step 10   disable

          Use this command to exit to user EXEC mode. For example:



          Example:
          Router# disable
          Router>
          

          Configuration Examples for the Display of CEF Event Trace Messages

          Example Customizing CEF Event Tracing

          The following example shows how to enable event tracing for Cisco Express Forwarding and configure the buffer size to 2500 messages. The trace messages file is set to cef-dump in slot0 (flash memory).

          configure terminal
          !
          monitor event-trace cef events enable
          monitor event-trace cef dump-file slot0:cef-dump
          monitor event-trace cef events size 2500
          exit
          The following example shows what happens when you try to enable event tracing for Cisco Express Forwarding events when it is already enabled:
          configure terminal
          !
          monitor event-trace cef events enable
          00:04:33: %EVENT_TRACE-6-ENABLE: Trace already enabled.
          

          The following example shows the privileged EXEC commands that stop event tracing, clear the current contents of memory, and reenable the trace function for Cisco Express Forwarding events. This example assumes that the tracing function is configured and enabled on the networking device.

          enable
          !
          monitor event-trace cef events disable 
          monitor event-trace cef events clear 
          monitor event-trace cef events enable
          disable

          Example Customizing CEF Event Tracing for IPv4 Events

          The following example shows how to enable event tracing for Cisco Express Forwarding IPv4 events and configure the buffer size to 5000 messages:

          configure terminal
          !
          monitor event-trace cef ipv4 enable
          monitor event-trace cef ipv4 size 5000
          exit
          The following example shows how to enable event tracing for events that match Cisco Express Forwarding IPv4 VRF vpn1:
          configure terminal
          !
          monitor event-trace cef ipv4 enable
          monitor event-trace cef ipv4 vrf vpn1
          exit
          

          The following example shows the privileged EXEC commands to configure the continuous display of the latest Cisco Express Forwarding event trace entries for IPv4 events:

          enable
          !
          monitor event-trace cef ipv4 continuous
          disable
          

          The following example shows how to stop the continuous display of the latest trace entries:

          enable
          !
          monitor event-trace cef ipv4 continuous cancel
          disable

          Example Customizing CEF Event Tracing for IPv6 Events

          The following example shows how to enable event tracing for Cisco Express Forwarding IPv6 events and configure the buffer size to 10000:

          configure terminal
          !
          monitor event-trace cef ipv6 enable
          monitor event-trace cef ipv6 size 10000
          exit

          Additional References

          Related Documents

          Related Topic

          Document Title

          Cisco IOS commands

          Cisco IOS Master Commands List, All Releases

          Cisco Express Forwarding commands

          Cisco IOS IP Switching Command Reference

          Overview of the Cisco Express Forwarding feature

          Cisco Express Forwarding Overview

          Tasks for verifying basic Cisco Express Forwarding and distributed Cisco Express Forwarding operation

          Configuring Basic Cisco Express Forwarding for Improved Performance, Scalability, and Resiliency in Dynamic Networks

          Tasks for enabling or disabling Cisco Express Forwarding or distributed Cisco Express Forwarding

          Enabling or Disabling Cisco Express Forwarding or Distributed Cisco Express Forwarding to Customize Switching and Forwarding for Dynamic Networks

          Tasks for configuring load-balancing schemes for Cisco Express Forwarding

          Configuring a Load-Balancing Scheme for Cisco Express Forwarding Traffic

          Tasks for configuring Cisco Express Forwarding consistency checkers

          Configuring Cisco Express Forwarding Consistency Checkers for Route Processors and Line Cards

          Tasks for configuring epochs for Cisco Express Forwarding tables

          Configuring Epochs to Clear and Rebuild Cisco Express Forwarding and Adjacency Tables

          Tasks for configuring and verifying Cisco Express Forwarding network accounting

          Configuring Cisco Express Forwarding Network Accounting

          Tasks for customizing the display of recorded Cisco Express Forwarding events in Cisco IOS releases prior to Cisco IOS Releases 12.2(25)S, 12.2(33)SB, 12.2(33)SRA, 12.2(33)SXH, and 12.4(20)T

          Customizing the Display of Recorded Cisco Express Forwarding Events

          Causes of common Cisco Express Forwarding-related error messages on platforms running distributed Cisco Express Forwarding switching (Cisco 7500 series routers and Cisco 12000 series Internet routers) and how to troubleshoot them

          Troubleshooting Cisco Express Forwarding-Related Error Messages

          Standards

          Standard

          Title

          No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.

          --

          MIBs

          MIB

          MIBs Link

          No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.

          To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

          http:/​/​www.cisco.com/​go/​mibs

          RFCs

          RFC

          Title

          No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.

          --

          Technical Assistance

          Description

          Link

          The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

          http:/​/​www.cisco.com/​cisco/​web/​support/​index.html

          Feature Information for the Display of CEF Event Trace Messages

          The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

          Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to . An account on Cisco.com is not required.
          Table 1 Feature Information for Configuring the Display of Cisco Express Forwarding Event Trace Messages

          Feature Name

          Releases

          Feature Configuration Information

          This table is intentionally left blank because no features were introduced or modified in Cisco IOS Release 12.2(1) or later. This table will be updated when feature information is added to this module.

          --

          --

          Glossary

          adjacency --A relationship formed between selected neighboring routers and end nodes for the purpose of exchanging routing information. Adjacency is based upon the use of a common media segment by the routers and nodes involved.

          Cisco Express Forwarding --A Layer 3 switching technology. Cisco Express Forwarding can also refer to central Cisco Express Forwarding mode, one of two modes of Cisco Express Forwarding operation. Cisco Express Forwarding enables a Route Processor to perform express forwarding. Distributed Cisco Express Forwarding is the other mode of Cisco Express Forwarding operation.

          distributed Cisco Express Forwardin g--A mode of Cisco Express Forwarding operation in which line cards (such as Versatile Interface Processor (VIP) line cards) maintain identical copies of the forwarding information base (FIB) and adjacency tables. The line cards perform the express forwarding between port adapters; this relieves the Route Switch Processor of involvement in the switching operation.

          FIB --forwarding information base. A component of Cisco Express Forwarding that is conceptually similar to a routing table or information base. The router uses the FIB lookup table to make destination-based switching decisions during Cisco Express Forwarding operation. The router maintains a mirror image of the forwarding information in an IP routing table.

          line card --A general term for an interface processor that can be used in various Cisco products. For example, a Versatile Interface Processor (VIP) is a line card for the Cisco 7500 series router.

          prefix --The network address portion of an IP address. A prefix is specified by a network and mask and is generally represented in the format network/mask. The mask indicates which bits are the network bits. For example, 1.0.0.0/16 means that the first 16 bits of the IP address are masked, making them the network bits. The remaining bits are the host bits. In this example, the network number is 10.0.

          VPN --Virtual Private Network. The result of a router configuration that enables IP traffic to use tunneling to travel securely over a public TCP/IP network.

          VRF --A Virtual Private Network (VPN) routing/forwarding instance. A VRF consists of an IP routing table, a derived forwarding table, a set of interfaces that use the forwarding table, and a set of rules and routing protocols that determine what goes into the forwarding table. In general, a VRF includes the routing information that defines a customer VPN site that is attached to a PE router.


          Customizing the Display of CEF Event Trace Messages

          Contents

          Customizing the Display of CEF Event Trace Messages

          This module contains information about and instructions for customizing the display of recorded Cisco Express Forwarding events for Cisco IOS Releases 12.2(25)S, 12.2(33)SB, 12.2(33)SRA, 12.2.(33)SXH, 12.4(20)T, and later releases.

          For information about and instructions for customizing the display of recorded Cisco Express Forwarding events for Cisco IOS releases prior to 12.2(25)S, 12.2(33)SB, 12.2(33)SRA, 12.2.(33)SXH, and 12.4(20)T, see Customizing the Display of Cisco Express Forwarding Events.

          You can customize the Cisco Express Forwarding event-tracing message display by specifying the size of the file stored in memory or by choosing to display event trace messages by prefix and mask, by a specified interface, or by a Cisco Express Forwarding Virtual Private Network (VPN) routing and forwarding instance (VRF) for an IPv4 or IPv6 address family.

          Cisco Express Forwarding is an advanced Layer 3 IP switching technology. It optimizes network performance and scalability for all kinds of networks: those that carry small amounts of traffic and those that carry large amounts of traffic in complex patterns, such as the Internet and networks characterized by intensive web-based applications or interactive sessions.

          Finding Feature Information

          Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

          Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

          Prerequisites for the Display of CEF Event Trace Messages

          Cisco Express Forwarding must be running on the networking device before you can customize the display of recorded Cisco Express Forwarding events.

          Restrictions for the Display of CEF Event Trace Messages

          If you enable Cisco Express Forwarding and then create an access list that uses the log keyword, the packets that match the access list are not Cisco Express Forwarding switched. They are fast switched. Logging disables Cisco Express Forwarding.

          Information About the Display of CEF Event Trace Messages

          For links to information about other Cisco Express Forwarding and distributed Cisco Express Forwarding features that you can configure, go to the Additional References.

          Cisco Platform Support for Central CEF and dCEF

          Cisco Express Forwarding is enabled by default on most Cisco platforms running Cisco IOS software Release 12.0 or later. When Cisco Express Forwarding is enabled on a router, the Route Processor (RP) performs the express forwarding.

          To find out if Cisco Express Forwarding is enabled on your platform, enter the show ip cefcommand. If Cisco Express Forwarding is enabled, you receive output that looks like this:

          Router# show ip cef 
          Prefix              Next Hop            Interface
          [...]
          10.2.61.8/24        192.168.100.1       FastEthernet1/0/0
                              192.168.101.1       FastEthernet6/1
          [...]
          

          If Cisco Express Forwarding is not enabled on your platform, the output for the show ip cefcommand looks like this:

          Router# show ip cef
          %CEF not running
          

          Distributed Cisco Express Forwarding is enabled by default on the Catalyst 6500 series switch, the Cisco 7500 series router, and the Cisco 12000 Series Internet Router. When distributed Cisco Express Forwarding is enabled on your platform, the line cards perform the express forwarding.

          If Cisco Express Forwarding is not enabled on your platform, use the ip cefcommand to enable (central) Cisco Express Forwarding or the ip cef distributed command to enable distributed Cisco Express Forwarding.

          Overview of CEF Event Trace Function

          The Cisco Express Forwarding event trace function collects Cisco Express Forwarding events as they occur, even when debugging is not enabled. This function allows the tracing of an event immediately after it occurs. Cisco technical personnel can use the event trace function to help resolve any problems with the Cisco Express Forwarding feature.

          Cisco Express Forwarding event trace messages are saved in memory on the device. When the event trace messages exceed the configured size, the newest message in the trace will begin to overwrite the older messages. You can use the following commands to change the capacity of the Cisco Express Forwarding event message file:

          • The monitor event-trace cef events sizeglobal configuration command allows you to increase or decrease the number of messages that can be written to memory for a single instance of a trace. To display the size parameter, use the show monitor event-trace events parameters command.

          • The monitor event-trace cef events clear privileged EXEC command allows you to clear existing trace messages.

          • The monitor event-trace cef(global) command configures event tracing for Cisco Express Forwarding events. To monitor and control the event trace function for Cisco Express Forwarding events, use the monitor event-trace cef (EXEC) command.

          You can use the following commands to display Cisco Express Forwarding events:

          • The show monitor event-trace cef allcommand displays all event trace messages currently in memory for Cisco Express Forwarding.

          • The debug ip cef command and the events keyword record general Cisco Express Forwarding events as they occur.

          • The debug ip cef tablecommand enables the real-time collection of events that affect entries in the Cisco Express Forwarding tables.

          CEF Event Tracing Defaults and Options

          Event tracing for distributed Cisco Express Forwarding events is enabled by default. The Cisco IOS XE software allows Cisco Express Forwarding to define whether support for event tracing is enabled or disabled by default. The command interface for event tracing allows you to change the default value in one of two ways: using the monitor event-trace cefcommand in privileged EXEC mode or using the monitor event-trace cefcommand in global configuration mode.

          To configure the file in which you want to save trace information, use the monitor event-trace cefcommand in global configuration mode. By default, the trace messages are saved in a binary format. If you want to save trace messages in ASCII format, possibly for additional application processing, use the monitor event-trace cef dump pretty command in privileged EXEC mode. The amount of data collected from a trace depends on the trace message size configured using the monitor event-trace cefcommand in global configuration mode for each instance of a trace.

          To specify the trace call stack at tracepoints, you must first clear the trace buffer.

          CEF Event Tracing for IPv4 Events

          Event tracing for Cisco Express Forwarding IPv4 events is enabled by default. The software allows Cisco Express Forwarding to define whether support for event tracing is enabled or disabled by default. The command interface for event tracing allows you to change the default value in one of two ways: using the monitor event-trace cef ipv4command in privileged EXEC mode or using the monitor event-trace cef ipv4command in global configuration mode.

          To configure the file in which you want to save trace information for Cisco Express Forwarding IPv4 events, use the monitor event-trace cef ipv4command in global configuration mode. By default, the trace messages are saved in a binary format. If you want to save trace messages in ASCII format, possibly for additional application processing, use the monitor event-trace cef ipv4 dump pretty command in privileged EXEC mode. The amount of data collected from the trace depends on the trace message size configured using the monitor event-trace cef ipv4command for each instance of a trace.

          To determine whether event tracing is enabled by default for Cisco Express Forwarding, use the show monitor event-trace cef ipv4command to display trace messages.

          To specify the trace call stack at tracepoints, you must first clear the trace buffer.

          CEF Event Tracing for IPv6 Events

          Event tracing for Cisco Express Forwarding IPv6 events is enabled by default.The Cisco IOS XE software allows Cisco Express Forwarding to define whether support for event tracing is enabled or disabled by default. The command interface for event tracing allows you to change the default value in one of two ways: using the monitor event-trace cef ipv6command in privileged EXEC mode or using the monitor event-trace cef ipv6command in global configuration mode.

          To configure the file in which you want to save trace information for Cisco Express Forwarding IPv6 events, use the monitor event-trace cef ipv6command in global configuration mode. By default, the trace messages are saved in a binary format. If you want to save trace messages in ASCII format, possibly for additional application processing, use the monitor event-trace cef ipv6 dump pretty command in privileged EXEC mode. The amount of data collected from the trace depends on the trace message size configured using the monitor event-trace cef ipv6command for each instance of a trace.

          To determine whether event tracing is enabled by default for Cisco Express Forwarding, use the show monitor event-trace cef ipv6command to display trace messages.

          To specify the trace call stack at tracepoints, you must first clear the trace buffer.

          How to Customize the Display of CEF Event Trace Messages

          Customizing CEF Event Tracing

          Perform the following task to customize Cisco Express Forwarding event tracing. Event trace messages can be used to monitor Cisco Express Forwarding and to help resolve any issues with the Cisco Express Forwarding feature.

          SUMMARY STEPS

            1.    enable

            2.    configure terminal

            3.    monitor event-trace cef {dump-file dump-file-name | {events | interface} {disable | dump-file dump-file-name| enable | size number | stacktrace [depth]}}

            4.    exit

            5.    monitor event-trace cef {dump [merged pretty | pretty] | {events | interface | ipv4 | ipv6} {clear | continuous [cancel] | disable | dump [pretty] | enable | one-shot}}

            6.    disable


          DETAILED STEPS
             Command or ActionPurpose
            Step 1 enable


            Example:
            Router> enable
             

            Enables privileged EXEC mode.

            • Enter your password if prompted.

             
            Step 2 configure terminal


            Example:
            Router# configure terminal
             

            Enters global configuration mode.

             
            Step 3 monitor event-trace cef {dump-file dump-file-name | {events | interface} {disable | dump-file dump-file-name| enable | size number | stacktrace [depth]}}


            Example:
            Router(config)# monitor event-trace cef dump-file tftp://172.16.10.5/cef-events
             

            Configures event tracing for Cisco Express Forwarding.

            • The dump-file dump-file-name keyword and argument pair specify the file to which event trace messages are written from memory on the networking device. The maximum length of the filename (path and filename) is 100 characters, and the path can point to flash memory on the networking device or to a TFTP or FTP server.

            • The eventskeyword turns on event tracing for Cisco Express Forwarding events.

            • The interface keyword turns on event tracing for Cisco Express Forwarding interface events.

            • The disable keyword turns off event tracing for Cisco Express Forwarding events.

            • The enable keyword turns on event tracing for Cisco Express Forwarding events if it had been enabled with the monitor event-trace cef privileged EXEC command.

            • The size number keyword and argument pair sets the number of messages that can be written to memory for a single instance of a trace. Range: 1 to 65536.

            Note   

            Some Cisco IOS software subsystem components set the size by default. To display the size parameter, use the show monitor event-trace cef events parameters command.

            • The stacktrace keyword enables the stack trace at tracepoints.

            • The depth argument specifies the depth of the stack trace stored. Range: 1 to 16.

             
            Step 4 exit


            Example:
            Router(config)# exit
             

            Exits to privileged EXEC mode.

             
            Step 5 monitor event-trace cef {dump [merged pretty | pretty] | {events | interface | ipv4 | ipv6} {clear | continuous [cancel] | disable | dump [pretty] | enable | one-shot}}


            Example:
            Router# monitor event-trace cef events dump pretty
             

            Monitors and controls the event trace function for Cisco Express Forwarding.

            • The dump keyword writes the event trace results to the file configured with the monitor event-trace cefglobal configuration command. The trace messages are saved in binary format.

            • The merged pretty keywords sort all event trace entries by time and write the entries to a file in ASCII format.

            • The pretty keyword saves the event trace message in ASCII format.

            • The events keyword monitors Cisco Express Forwarding events.

            • The interfacekeyword monitors Cisco Express Forwarding interface events.

            • The ipv4keyword monitors Cisco Express Forwarding IPv4 events.

            • The ipv6 keyword monitors Cisco Express Forwarding IPv6 events.

            • The clear keyword clears existing trace messages for Cisco Express Forwarding from memory on the networking device.

            • The continuous keyword continuously displays the latest event trace entries.

            • The cancel keyword cancels the continuous display of the latest trace entries.

            • The disable keyword turns off Cisco Express Forwarding event tracing.

            • The enable keyword turns on Cisco Express Forwarding event tracing.

            • The one-shot keyword Clears any existing trace information from memory, starts event tracing again, and disables the trace when the size of the trace message file configured in the global configuration command is exceeded.

             
            Step 6 disable


            Example:
            Router# disable 
             

            Exits to user EXEC mode.

             

            Customizing CEF Event Tracing for IPv4 Events

            Perform the following task to customize Cisco Express Forwarding event tracing for Cisco Express Forwarding IPv4 events. Use event tracing to monitor Cisco Express Forwarding IPv4 events as they occur and to help resolve any issues with Cisco Express Forwarding and related IPv4 events.

            SUMMARY STEPS

              1.    enable

              2.    configure terminal

              3.    monitor event-trace cef ipv4 {disable | distribution |dump-file dump-file-name| enable | match {global | ip-address mask} | size number | stacktrace [depth] | vrf vrf-name [distribution | match {global | ip-address mask}]}

              4.    exit

              5.    monitor event-trace cef ipv4 {clear | continuous [cancel] | disable | dump [pretty] | enable | one-shot}

              6.    disable


            DETAILED STEPS
               Command or ActionPurpose
              Step 1 enable


              Example:
              Router> enable
               

              Enables privileged EXEC mode.

              • Enter your password if prompted.

               
              Step 2 configure terminal


              Example:
              Router# configure terminal
               

              Enters global configuration mode.

               
              Step 3 monitor event-trace cef ipv4 {disable | distribution |dump-file dump-file-name| enable | match {global | ip-address mask} | size number | stacktrace [depth] | vrf vrf-name [distribution | match {global | ip-address mask}]}


              Example:
              Router(config)# monitor event-trace cef ipv4 size 10000
               

              Configures event-tracing for Cisco Express Forwarding IPv4 events.

              • The disable keyword turns off event tracing for Cisco Express Forwarding IPv4 events.

              • The distribution keyword logs events related to the distribution of Cisco Express Forwarding Forwarding Information Base (FIB) tables to the line cards

              • The dump-file dump-file-name keyword and argument pair specify the file to which event trace messages are written from memory on the networking device. The maximum length of the filename (path and filename) is 100 characters, and the path can point to flash memory on the networking device or to a TFTP or FTP server.

              • The enable keyword turns on event tracing for Cisco Express Forwarding IPv4 events if it had been enabled with the monitor event-trace cef privileged EXEC command.

              • The matchkeyword turns on event tracing for Cisco Express Forwarding IPv4 events that matches global events or events that match a specific network address

              • The globalkeyword specifies global events.

              • The ip-address maskargumentsspecify an IP address in A.B.C.D format and a subnet mask in A.B.C.D format.

              • The size number keyword and argument pair sets the number of messages that can be written to memory for a single instance of a trace. Range: 1 to 65536.

              Note   

              Some Cisco IOS software subsystem components set the size by default. To display the size parameter, use the show monitor event-trace cef ipv4 parameters command.

              • The stacktrace keyword enables the stack trace at tracepoints.

              • The depth argument specifies the depth of the stack trace stored. Range: 1 to 16.

              • The vrf vrf-name keyword and argument pair turns on event tracing for a Cisco Express Forwarding IPv4 VRF table. The vrf-name argument specifies the name of the VRF

               
              Step 4 exit


              Example:
              Router(config)# exit 
               

              Exits to privileged EXEC mode.

               
              Step 5 monitor event-trace cef ipv4 {clear | continuous [cancel] | disable | dump [pretty] | enable | one-shot}


              Example:
              Router# monitor event-trace cef ipv4 continuous
               

              Monitors and controls the event trace function for Cisco Express Forwarding IPv4 events.

              • The clear keyword clears existing trace messages for Cisco Express Forwarding from memory on the networking device.

              • The continuous keyword continuously displays the latest event trace entries.

              • The cancel keyword cancels the continuous display of the latest trace entries.

              • The disable keyword turns off Cisco Express Forwarding event tracing.

              • The dump keyword writes the event trace results to the file configured with the global configuration monitor event-trace cef command. The trace messages are saved in binary format.

              • The pretty keyword saves the event trace message in ASCII format.

              • The enable keyword turns on Cisco Express Forwarding event tracing.

              • The one-shot keyword clears any existing trace information from memory, starts event tracing again, and disables the trace when the size of the trace message file configured in the global configuration command is exceeded.

               
              Step 6 disable


              Example:
              Router# disable 
               

              Exits to user EXEC mode.

               

              Customizing CEF Event Tracing for IPv6 Events

              Perform the following task to customize Cisco Express Forwarding event tracing for Cisco Express Forwarding IPv6 events.Use event tracing to monitor Cisco Express Forwarding IPv6 events as they occur and to help resolve any issues with Cisco Express Forwarding and related IPv6 events.

              SUMMARY STEPS

                1.    enable

                2.    configure terminal

                3.    monitor event-trace cef ipv4 {disable | distribution | dump-file dump-file-name| enable | match {global | ipv6-address/n} | size number | stacktrace [depth] | vrf vrf-name [distribution | match {global | ipv6-address/n}]}

                4.    exit

                5.    monitor event-trace cef ipv6 {clear | continuous [cancel] | disable | dump [pretty] | enable | one-shot}}

                6.    disable


              DETAILED STEPS
                 Command or ActionPurpose
                Step 1 enable


                Example:
                Router> enable
                 

                Enables privileged EXEC mode.

                • Enter your password if prompted.

                 
                Step 2 configure terminal


                Example:
                Router# configure terminal
                 

                Enters global configuration mode.

                 
                Step 3 monitor event-trace cef ipv4 {disable | distribution | dump-file dump-file-name| enable | match {global | ipv6-address/n} | size number | stacktrace [depth] | vrf vrf-name [distribution | match {global | ipv6-address/n}]}


                Example:
                Router(config)# monitor event-trace cef ipv6 match global
                 

                Configures event-tracing for Cisco Express Forwarding IPv6 events.

                • The disable keyword turns off event tracing for Cisco Express Forwarding IPv6 events.

                • The distribution keyword logs events related to the distribution of Cisco Express Forwarding FIB tables to the line cards.

                • The dump-file dump-file-name keyword and argument pair specify the file to which event trace messages are written from memory on the networking device. The maximum length of the filename (path and filename) is 100 characters, and the path can point to flash memory on the networking device or to a TFTP or FTP server.

                • The enable keyword turns on event tracing for Cisco Express Forwarding IPv6 events if it had been enabled with the monitor event-trace cef privileged EXEC command.

                • The matchkeyword turns on event tracing for Cisco Express Forwarding IPv6 events that matches global events or events that match a specific network address.

                • The globalkeyword specifies global events.

                • The ipv6-address / nargument specifies an IPv6 address. This address must be in the form documented in RFC 2373: the address is specified in hexadecimals using 16-bit values between colons. The slash followed by a number (/ n) indicates the number of bits that do not change. Range: 0 to 128

                • The size number keyword and argument pair sets the number of messages that can be written to memory for a single instance of a trace. Range: 1 to 65536.

                Note   

                Some Cisco IOS software subsystem components set the size by default. To display the size parameter, use the show monitor event-trace cef ipv6 parameters command.

                • The stacktrace keyword enables the stack trace at tracepoints.

                • The depth argument specifies the depth of the stack trace stored. Range: 1 to 16.

                • The vrf vrf-name keyword and argument pair turns on event tracing for a Cisco Express Forwarding IPv6 VRF table. The vrf-name argument specifies the name of the VRF

                 
                Step 4 exit


                Example:
                Router(config)# exit 
                 

                Exits to privileged EXEC mode.

                 
                Step 5 monitor event-trace cef ipv6 {clear | continuous [cancel] | disable | dump [pretty] | enable | one-shot}}


                Example:
                Router# monitor event-trace cef ipv6 one-shot
                 

                Monitors and controls the event trace function for Cisco Express Forwarding IPv6 events.

                • The clear keyword clears existing trace messages for Cisco Express Forwarding from memory on the networking device.

                • The continuous keyword continuously displays the latest event trace entries.

                • The cancel keyword cancels the continuous display of the latest trace entries.

                • The disable keyword turns off Cisco Express Forwarding event tracing.

                • The dump keyword writes the event trace results to the file configured with the global configuration monitor event-trace cef command. The trace messages are saved in binary format.

                • The pretty keyword saves the event trace message in ASCII format.

                • The enable keyword turns on Cisco Express Forwarding event tracing.

                • The one-shot keyword Clears any existing trace information from memory, starts event tracing again, and disables the trace when the size of the trace message file configured in the global configuration command is exceeded.

                 
                Step 6 disable


                Example:
                Router# disable 
                 

                Exits to privileged EXEC mode.

                 

                Displaying CEF Event Trace Information

                Perform the following task to display Cisco Express Forwarding event trace information.

                SUMMARY STEPS

                  1.    enable

                  2.    monitor event-trace cef events clear

                  3.    debug ip cef table

                  4.    show monitor events-trace cef all

                  5.    show monitor event-trace cef latest

                  6.    show monitor event-trace cef events all

                  7.    show monitor event-trace cef interface latest

                  8.    show monitor event-trace cef ipv4 all

                  9.    show monitor event-trace cef ipv6 parameters

                  10.    disable


                DETAILED STEPS
                  Step 1   enable

                  Use this command to enable privileged EXEC mode. Enter your password if prompted. For example:



                  Example:
                  Router> enable
                  Router#

                  Step 2   monitor event-trace cef events clear

                  Use this command to clear the Cisco Express Forwarding event trace buffer. For example:

                  Router# monitor event-trace cef clear


                  Example:
                  
                  
                          
                  Step 3   debug ip cef table

                  Use this command to display events that affect entries in the Cisco Express Forwarding tables. For example:



                  Example:
                  Router# debug ip cef table 
                  01:25:46:CEF-Table:Event up, 10.1.1.1/32 (rdbs:1, flags:1000000) 
                  01:25:46:CEF-IP:Checking dependencies of 0.0.0.0/0 
                  01:25:47:CEF-Table:attempting to resolve 10.1.1.1/32 
                  01:25:47:CEF-IP:resolved 10.1.1.1/32 via 10.9.104.1 to 10.9.104.1 Ethernet2/0/0 
                  01:26:02:CEF-Table:Event up, default, 0.0.0.0/0 (rdbs:1, flags:400001) 
                  01:26:02:CEF-IP:Prefix exists - no-op change 
                  
                  Step 4   show monitor events-trace cef all

                  Use this command to display event trace messages for Cisco Express Forwarding. For example:



                  Example:
                  Router# show monitor event-trace cef all
                  cef_events:
                  *Jul 22 20:14:58.999: SubSys  ipv4fib_ios_def_cap init
                  *Jul 22 20:14:58.999: SubSys  ipv6fib_ios_def_cap init
                  *Jul 22 20:14:58.999: Inst    unknown -> RP
                  *Jul 22 20:14:58.999: SubSys  fib_ios_chain init
                  *Jul 22 20:14:59.075: SubSys  fib init
                  *Jul 22 20:14:59.075: SubSys  ipv4fib init
                  *Jul 22 20:14:59.075: SubSys  fib_ios init
                  *Jul 22 20:14:59.075: SubSys  fib_ios_if init
                  *Jul 22 20:14:59.075: SubSys  ipv4fib_ios init
                  *Jul 22 20:14:59.075: Flag    Common CEF enabled set to yes
                  *Jul 22 20:14:59.075: Flag    IPv4 CEF enabled set to yes
                  *Jul 22 20:14:59.075: Flag    IPv4 CEF switching enabled set to yes
                  *Jul 22 20:14:59.075: GState  CEF enabled
                  *Jul 22 20:14:59.075: SubSys  ipv6fib_ios init
                  *Jul 22 20:14:59.075: SubSys  ipv4fib_util init
                  *Jul 22 20:14:59.075: SubSys  ipv4fib_les init
                  *Jul 22 20:15:02.907: Process Background created
                  *Jul 22 20:15:02.907: Flag    IPv4 CEF running set to yes
                  *Jul 22 20:15:02.907: Process Background event loop enter
                  *Jul 22 20:15:02.927: Flag    IPv4 CEF switching running set to yes
                            
                  cef_interface:
                  *Jul 22 20:14:58.999: Et0/0        (hw  3) SWvecLES <unknown> (0x01096A3C)
                  *Jul 22 20:14:58.999: Et0/1        (hw  4) SWvecLES <unknown> (0x01096A3C)
                  *Jul 22 20:14:58.999: Et0/2        (hw  5) SWvecLES <unknown> (0x01096A3C)
                  *Jul 22 20:14:58.999: Et0/3        (hw  6) SWvecLES <unknown> (0x01096A3C)
                  *Jul 22 20:14:58.999: Et1/0        (hw  7) SWvecLES <unknown> (0x01096A3C)
                  *Jul 22 20:14:58.999: Et1/1        (hw  8) SWvecLES <unknown> (0x01096A3C)
                  *Jul 22 20:14:58.999: Et1/2        (hw  9) SWvecLES <unknown> (0x01096A3C)
                  *Jul 22 20:14:58.999: Et1/3        (hw 10) SWvecLES <unknown> (0x01096A3C)
                  *Jul 22 20:14:58.999: Se2/0        (hw 11) SWvecLES <unknown> (0x01096A3C)
                  *Jul 22 20:14:58.999: Se2/1        (hw 12) SWvecLES <unknown> (0x01096A3C)
                  .
                  .
                  .

                  The output is in table format where the first column contains a time stamp, the second column lists the type of event, and the third column lists the detail for the event.

                  Step 5   show monitor event-trace cef latest

                  Use this command to display only the event trace message that have been sent since the last instance of the show monitor event-trace cef command. For example:



                  Example:
                  Router# show monitor event-trace cef latest
                  cef_events:
                  cef_interface:
                  *Jul 22 20:14:59.075: Se3/0        (sw 15) FlagCha  0x60C1 add puntLC
                  *Jul 22 20:14:59.075: <empty>      (hw 16) State    down -> up
                  *Jul 22 20:14:59.075: <empty>      (hw 16) Create   new
                  *Jul 22 20:14:59.075: Se3/1        (hw 16) NameSet  
                  *Jul 22 20:14:59.075: Se3/1        (hw 16) HWIDBLnk Serial3/1(16)
                  *Jul 22 20:14:59.075: Se3/1        (hw 16) RCFlags  None -> Fast
                  *Jul 22 20:14:59.075: <empty>      (sw 16) VRFLink  IPv4:id0 - success
                  *Jul 22 20:14:59.075: <empty>      (sw 16) State    deleted -> down
                  *Jul 22 20:14:59.075: <empty>      (sw 16) Create   new
                  *Jul 22 20:14:59.075: Se3/1        (sw 16) NameSet  
                  *Jul 22 20:14:59.075: Se3/1        (sw 16) FIBHWLnk Serial3/1(16)
                  *Jul 22 20:14:59.075: Se3/1        (sw 16) SWIDBLnk Serial3/1(16)
                  *Jul 22 20:14:59.075: Se3/1        (sw 16) FlagCha  0x6001 add p2p|input|first
                  *Jul 22 20:14:59.075: Se3/1        (sw 16) FlagCha  0x6041 add auto_adj
                  *Jul 22 20:14:59.075: Se3/1        (sw 16) Impared  lc rea Queueing configuration
                  *Jul 22 20:14:59.075: Se3/1        (sw 16) FlagCha  0x60C1 add puntLC
                  *Jul 22 20:14:59.075: <empty>      (hw 17) State    down -> up
                  *Jul 22 20:14:59.075: <empty>      (hw 17) Create   new
                  *Jul 22 20:14:59.075: Se3/2        (hw 17) NameSet 
                  
                  Step 6   show monitor event-trace cef events all

                  Use this command to display information about Cisco Express Forwarding events. For example:



                  Example:
                  Router# show monitor event-trace cef events all 
                  *Jul 13 17:38:27.999: SubSys  ipv4fib_ios_def_cap init
                  *Jul 13 17:38:27.999: SubSys  ipv6fib_ios_def_cap init
                  *Jul 13 17:38:27.999: Inst    unknown -> RP
                  *Jul 13 17:38:27.999: SubSys  fib_ios_chain init
                  *Jul 13 17:38:28.199: SubSys  fib init
                  *Jul 13 17:38:28.199: SubSys  ipv4fib init
                  *Jul 13 17:38:28.199: SubSys  fib_ios init
                  *Jul 13 17:38:28.199: SubSys  fib_ios_if init
                  *Jul 13 17:38:28.199: SubSys  ipv4fib_ios init
                  *Jul 13 17:38:28.199: Flag    Common CEF enabled set to yes
                  *Jul 13 17:38:28.199: Flag    IPv4 CEF enabled set to yes
                  *Jul 13 17:38:28.199: Flag    IPv4 CEF switching enabled set to yes
                  *Jul 13 17:38:28.199: GState  CEF enabled
                  *Jul 13 17:38:28.199: SubSys  ipv6fib_ios init
                  *Jul 13 17:38:28.199: SubSys  ipv4fib_util init
                  *Jul 13 17:38:28.199: SubSys  ipv4fib_les init
                  *Jul 13 17:38:34.059: Process Background created
                  *Jul 13 17:38:34.059: Flag    IPv4 CEF running set to yes
                  *Jul 13 17:38:34.059: Process Background event loop enter
                  *Jul 13 17:38:34.079: Flag    IPv4 CEF switching running set to yes
                  

                  The output is in table format where the first column contains a time stamp, the second column lists the type of event, and the third column lists the detail for the event.

                  For example, the Subsys event type is related to the initialization of a subset of Cisco Express Forwarding functionality. The "ipv4fib_ios_def_cap init" entry is the initialization of IPv4 Cisco Express Forwarding default capabilities.

                  Step 7   show monitor event-trace cef interface latest

                  Use this command to display only the event trace messages generated since the last show monitor event-trace cef interfacecommand was entered. For example:



                  Example:
                  Router# show monitor event-trace cef interface latest
                  *Jul 22 20:14:58.999: Et0/0        (hw  3) SWvecLES <unknown> (0x01096A3C)
                  *Jul 22 20:14:58.999: Et0/1        (hw  4) SWvecLES <unknown> (0x01096A3C)
                  *Jul 22 20:14:58.999: Et0/2        (hw  5) SWvecLES <unknown> (0x01096A3C)
                  *Jul 22 20:14:58.999: Et0/3        (hw  6) SWvecLES <unknown> (0x01096A3C)
                  .
                  .
                  .
                  *Jul 22 20:14:59.075: <empty>      (hw  3) State    down -> up
                  *Jul 22 20:14:59.075: <empty>      (hw  3) Create   new
                  *Jul 22 20:14:59.075: Et0/0        (hw  3) NameSet  
                  *Jul 22 20:14:59.075: Et0/0        (hw  3) HWIDBLnk Ethernet0/0(3)
                  *Jul 22 20:14:59.075: Et0/0        (hw  3) RCFlags  None -> Fast
                  *Jul 22 20:14:59.075: <empty>      (sw  3) VRFLink  IPv4:id0 - success
                  *Jul 22 20:14:59.075: <empty>      (sw  3) State    deleted -> down
                  *Jul 22 20:14:59.075: <empty>      (sw  3) Create   new
                  *Jul 22 20:14:59.075: Et0/0        (sw  3) NameSet  
                  *Jul 22 20:14:59.075: Et0/0        (sw  3) FIBHWLnk Ethernet0/0(3)
                  *Jul 22 20:14:59.075: Et0/0        (sw  3) SWIDBLnk Ethernet0/0(3)
                  *Jul 22 20:14:59.075: Et0/0        (sw  3) FlagCha  0x6000 add input|first
                  *Jul 22 20:14:59.075: Et0/0        (sw  3) State    down -> up
                  *Jul 22 20:14:59.075: <empty>      (hw  4) State    down -> up
                  *Jul 22 20:14:59.075: <empty>      (hw  4) Create   new
                  *Jul 22 20:14:59.075: Et0/1        (hw  4) NameSet  
                  *Jul 22 20:14:59.075: Et0/1        (hw  4) HWIDBLnk Ethernet0/1(4)
                  *Jul 22 20:14:59.075: Et0/1        (hw  4) RCFlags  None -> Fast
                  *Jul 22 20:14:59.075: <empty>      (sw  4) VRFLink  IPv4:id0 - success
                  *Jul 22 20:14:59.075: <empty>      (sw  4) State    deleted -> down
                  *Jul 22 20:14:59.075: <empty>      (sw  4) Create   new
                  *Jul 22 20:14:59.075: Et0/1        (sw  4) NameSet  
                  *Jul 22 20:14:59.075: Et0/1        (sw  4) FIBHWLnk Ethernet0/1(4)
                  *Jul 22 20:14:59.075: Et0/1        (sw  4) SWIDBLnk Ethernet0/1(4)
                  *Jul 22 20:14:59.075: Et0/1        (sw  4) FlagCha  0x6000 add input|first
                  *Jul 22 20:14:59.075: Et0/1        (sw  4) State    down -> up
                  .
                  .
                  .
                  Step 8   show monitor event-trace cef ipv4 all

                  Use this command to display information about Cisco Express Forwarding IPv4 events. For example:



                  Example:
                  Router# show monitor event-trace cef ipv4 all 
                  *Jul 22 20:14:59.075:  [Default] *.*.*.*/*             Allocated FIB table      
                                        [OK]
                  *Jul 22 20:14:59.075:  [Default] *.*.*.*/*'00          Add source Default table 
                                        [OK]
                  *Jul 22 20:14:59.075:  [Default] 0.0.0.0/0'00          FIB add src DRH (ins)    
                                        [OK]
                  *Jul 22 20:14:59.075:  [Default] *.*.*.*/*'00          New FIB table            
                                        [OK]
                  *Jul 22 20:15:02.927:  [Default] *.*.*.*/*'00          FIB refresh start        
                                        [OK]
                  .
                  .
                  .

                  Step 9   show monitor event-trace cef ipv6 parameters

                  Use this commands to display parameters configured for Cisco Express Forwarding IPv6 events. For example:



                  Example:
                  Router# show monitor event-trace cef ipv6 parameters
                  Trace has 1000 entries
                  Stacktrace is disabled by default
                  Matching all events
                  
                  Step 10   disable

                  Use this command to exit to user EXEC mode. For example:



                  Example:
                  Router# disable
                  Router>
                  

                  Configuration Examples for the Display of CEF Event Trace Messages

                  Example Customizing CEF Event Tracing

                  The following example shows how to enable event tracing for Cisco Express Forwarding and configure the buffer size to 2500 messages. The trace messages file is set to cef-dump in slot0 (flash memory).

                  configure terminal
                  !
                  monitor event-trace cef events enable
                  monitor event-trace cef dump-file slot0:cef-dump
                  monitor event-trace cef events size 2500
                  exit
                  The following example shows what happens when you try to enable event tracing for Cisco Express Forwarding events when it is already enabled:
                  configure terminal
                  !
                  monitor event-trace cef events enable
                  00:04:33: %EVENT_TRACE-6-ENABLE: Trace already enabled.
                  

                  The following example shows the privileged EXEC commands that stop event tracing, clear the current contents of memory, and reenable the trace function for Cisco Express Forwarding events. This example assumes that the tracing function is configured and enabled on the networking device.

                  enable
                  !
                  monitor event-trace cef events disable 
                  monitor event-trace cef events clear 
                  monitor event-trace cef events enable
                  disable

                  Example Customizing CEF Event Tracing for IPv4 Events

                  The following example shows how to enable event tracing for Cisco Express Forwarding IPv4 events and configure the buffer size to 5000 messages:

                  configure terminal
                  !
                  monitor event-trace cef ipv4 enable
                  monitor event-trace cef ipv4 size 5000
                  exit
                  The following example shows how to enable event tracing for events that match Cisco Express Forwarding IPv4 VRF vpn1:
                  configure terminal
                  !
                  monitor event-trace cef ipv4 enable
                  monitor event-trace cef ipv4 vrf vpn1
                  exit
                  

                  The following example shows the privileged EXEC commands to configure the continuous display of the latest Cisco Express Forwarding event trace entries for IPv4 events:

                  enable
                  !
                  monitor event-trace cef ipv4 continuous
                  disable
                  

                  The following example shows how to stop the continuous display of the latest trace entries:

                  enable
                  !
                  monitor event-trace cef ipv4 continuous cancel
                  disable

                  Example Customizing CEF Event Tracing for IPv6 Events

                  The following example shows how to enable event tracing for Cisco Express Forwarding IPv6 events and configure the buffer size to 10000:

                  configure terminal
                  !
                  monitor event-trace cef ipv6 enable
                  monitor event-trace cef ipv6 size 10000
                  exit

                  Additional References

                  Related Documents

                  Related Topic

                  Document Title

                  Cisco IOS commands

                  Cisco IOS Master Commands List, All Releases

                  Cisco Express Forwarding commands

                  Cisco IOS IP Switching Command Reference

                  Overview of the Cisco Express Forwarding feature

                  Cisco Express Forwarding Overview

                  Tasks for verifying basic Cisco Express Forwarding and distributed Cisco Express Forwarding operation

                  Configuring Basic Cisco Express Forwarding for Improved Performance, Scalability, and Resiliency in Dynamic Networks

                  Tasks for enabling or disabling Cisco Express Forwarding or distributed Cisco Express Forwarding

                  Enabling or Disabling Cisco Express Forwarding or Distributed Cisco Express Forwarding to Customize Switching and Forwarding for Dynamic Networks

                  Tasks for configuring load-balancing schemes for Cisco Express Forwarding

                  Configuring a Load-Balancing Scheme for Cisco Express Forwarding Traffic

                  Tasks for configuring Cisco Express Forwarding consistency checkers

                  Configuring Cisco Express Forwarding Consistency Checkers for Route Processors and Line Cards

                  Tasks for configuring epochs for Cisco Express Forwarding tables

                  Configuring Epochs to Clear and Rebuild Cisco Express Forwarding and Adjacency Tables

                  Tasks for configuring and verifying Cisco Express Forwarding network accounting

                  Configuring Cisco Express Forwarding Network Accounting

                  Tasks for customizing the display of recorded Cisco Express Forwarding events in Cisco IOS releases prior to Cisco IOS Releases 12.2(25)S, 12.2(33)SB, 12.2(33)SRA, 12.2(33)SXH, and 12.4(20)T

                  Customizing the Display of Recorded Cisco Express Forwarding Events

                  Causes of common Cisco Express Forwarding-related error messages on platforms running distributed Cisco Express Forwarding switching (Cisco 7500 series routers and Cisco 12000 series Internet routers) and how to troubleshoot them

                  Troubleshooting Cisco Express Forwarding-Related Error Messages

                  Standards

                  Standard

                  Title

                  No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.

                  --

                  MIBs

                  MIB

                  MIBs Link

                  No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.

                  To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

                  http:/​/​www.cisco.com/​go/​mibs

                  RFCs

                  RFC

                  Title

                  No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.

                  --

                  Technical Assistance

                  Description

                  Link

                  The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

                  http:/​/​www.cisco.com/​cisco/​web/​support/​index.html

                  Feature Information for the Display of CEF Event Trace Messages

                  The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

                  Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to . An account on Cisco.com is not required.
                  Table 1 Feature Information for Configuring the Display of Cisco Express Forwarding Event Trace Messages

                  Feature Name

                  Releases

                  Feature Configuration Information

                  This table is intentionally left blank because no features were introduced or modified in Cisco IOS Release 12.2(1) or later. This table will be updated when feature information is added to this module.

                  --

                  --

                  Glossary

                  adjacency --A relationship formed between selected neighboring routers and end nodes for the purpose of exchanging routing information. Adjacency is based upon the use of a common media segment by the routers and nodes involved.

                  Cisco Express Forwarding --A Layer 3 switching technology. Cisco Express Forwarding can also refer to central Cisco Express Forwarding mode, one of two modes of Cisco Express Forwarding operation. Cisco Express Forwarding enables a Route Processor to perform express forwarding. Distributed Cisco Express Forwarding is the other mode of Cisco Express Forwarding operation.

                  distributed Cisco Express Forwardin g--A mode of Cisco Express Forwarding operation in which line cards (such as Versatile Interface Processor (VIP) line cards) maintain identical copies of the forwarding information base (FIB) and adjacency tables. The line cards perform the express forwarding between port adapters; this relieves the Route Switch Processor of involvement in the switching operation.

                  FIB --forwarding information base. A component of Cisco Express Forwarding that is conceptually similar to a routing table or information base. The router uses the FIB lookup table to make destination-based switching decisions during Cisco Express Forwarding operation. The router maintains a mirror image of the forwarding information in an IP routing table.

                  line card --A general term for an interface processor that can be used in various Cisco products. For example, a Versatile Interface Processor (VIP) is a line card for the Cisco 7500 series router.

                  prefix --The network address portion of an IP address. A prefix is specified by a network and mask and is generally represented in the format network/mask. The mask indicates which bits are the network bits. For example, 1.0.0.0/16 means that the first 16 bits of the IP address are masked, making them the network bits. The remaining bits are the host bits. In this example, the network number is 10.0.

                  VPN --Virtual Private Network. The result of a router configuration that enables IP traffic to use tunneling to travel securely over a public TCP/IP network.

                  VRF --A Virtual Private Network (VPN) routing/forwarding instance. A VRF consists of an IP routing table, a derived forwarding table, a set of interfaces that use the forwarding table, and a set of rules and routing protocols that determine what goes into the forwarding table. In general, a VRF includes the routing information that defines a customer VPN site that is attached to a PE router.