System Messages

About System Messages


Note

For detailed reference information about faults, events, errors, and system messages, see the Cisco ACI System Messages Reference Guide or the Cisco APIC Management Information Model Reference, which is a web-based application.

In addition to creating a log entry, a fault or event in APIC can trigger the sending of a system message. The system message typically contains a subset of information about the fault or event, and the message is sent by syslog, by an SNMP trap, or by a Cisco Call Home message.

Many system messages are specific to the action that a user is performing or the object that a user is configuring or administering. These messages can be the following:

  • Informational messages, providing assistance and tips about the action being performed

  • Warning messages, providing information about system errors related to an object, such as a user account or service profile, that the user is configuring or administering

  • Finite state machine (FSM) status messages, providing information about the status of an FSM stage

A system message can contain one or more variables. The information that the APIC uses to replace these variables depends upon the context in which you see the message. Some messages can be generated by more than one type of condition.

Fault Syslogs

Fault-generated system messages are triggered by these mechanisms:

  • A fault rule

  • A threshold crossing

  • A failure of a task or finite state machine (FSM) sequence

The fault-generated system messages are described in the Cisco APIC Management Information Model Reference, which is a web-based application. Under the System Messages navigation tab, select Syslog Faults or Syslog FSM Transitions.

Examples

This example shows a rule-based fault and the resulting system message generated by the fault: 


Fault (rule-based): class=faultInst

mo (fault:Inst)

ack               no
cause    					    node-failed
changeSet         delayedHeartbeat (Old: no, New: yes), fabricSt (Old:
active, New: inactive)
childAction
code              F0110
created           2014-05-22T22:45:28.913+00:00
descr             Node 102 not reachable. unknown
dn                topology/pod-1/node-102/fault-F0110
domain            infra
highestSeverity   critical
lastTransition    2014-05-22T22:45:28.913+00:00
lc                soaking
occur             1
origSeverity      critical
prevSeverity      critical
rule              fabric-node-failed
severity          critical
status
subject           fabric-node
type              environmental

The following system message is generated by this fault: 


syslog:
May 22 15:45:28 192.168.10.1 <1026> May 22 22:45:28 apic1 
%LOG_LOCAL0-2-SYSTEM_MSG
[F0110][soaking][node-failed][critical][topology/pod-1/node-102/fault-F0110]
Node 102 not reachable. unknown

This example shows a threshold crossing fault and the resulting system message generated by the fault: 


Fault (threshold crossing): class=faultInst

ack               no
cause             threshold-crossed
changeSet         normalizedLast:84
childAction
code              F41650
created           2014-05-22T21:17:33.849+00:00
descr             TCA: eqptTemp5min normalizedLast value 84 raised above threshold 80
dn                sys/ch/scslot-6/sc/sensor-1/fault-F41650
domain            infra
highestSeverity   critical
lastTransition    2014-05-22T22:50:55.012+00:00
lc                raised
occur             75
origSeverity      major
prevSeverity      cleared
rule              tca-eqpt-temp-normalized-last
severity          major
status
subject           counter
type              operational

The following system message is generated by this fault: 


syslog:
May 22 15:49:54 192.168.10.102 <1027> May 22 22:49:54 spine1
%LOG_LOCAL0-3-SYSTEM_MSG
[F41650][raised][threshold-crossed][major][sys/ch/scslot-6/sc/sensor-1/fault-F41650]
TCA: eqptTemp5min normalizedLast value 84 raised above  threshold 80

Event Syslogs

Event-generated system messages are triggered by these mechanisms:

  • An event rule

  • An event in the NX-OS operating system of a leaf or spine switch

The event rule-generated system messages are described in the Cisco APIC Management Information Model Reference, which is a web-based application. Under the System Messages navigation tab, select Syslog Events.

The NX-OS operating system event messages are listed in the Cisco ACI System Messages Reference Guide.

Examples

This example shows a rule-based event record and the resulting system message generated by the event: 


Event: class=eventRecord

mo:

affected     topology/pod-1/lnkcnt-1/lnk-101-1-1-to-1-1-3
cause        link-state-change
changeSet    linkState:ok, n1:101, n2:1, p1:1, p2:3, s1:1, s2:1
childAction
code         E4208219
created      2014-05-22T22:45:27.757+00:00
descr        Link State of Fabric Link is set to ok
dn           subj-[topology/pod-1/lnkcnt-1/lnk-101-1-1-to-1-1-3]/rec-4294968577
id           4294968577
ind          state-transition
modTs        never
severity     info
status
trig         oper
txId         1729382256910270971
user         internal

The following system message is generated by this event: 


syslog:
May 22 15:45:27 192.168.10.1 <1030> May 22 22:45:27 apic1
%LOG_LOCAL0-6-SYSTEM_MSG
[E4208219][link-state-change][info][subj-[topology/pod-1/lnkcnt-1/lnk-101-1-1-to-1-1-3]/rec-4294968577]
Link State of Fabric Link is set to ok

This example shows an audit log event record and the resulting system message generated by the event: 


Audit log: class=aaaModLR

mo

affected     uni/userext/user-nancy
cause        transition
changeSet    accountStatus:active, clearPwdHistory:no, email:nj@example.com,
             expiration:never, expires:no, firstName:Nancy, lastName:Johnson,
             name:nancy, pwdLifeTime:no-password-expire, unixUserId:15909
childAction
code         E4205213
created      2014-05-22T23:00:38.011+00:00
descr        User nancy created
dn           subj-[uni/userext/user-nancy]/mod-4294967339
id           4294967339
ind          creation
modTs        never
severity     info
status
trig         config
txId         9799832789158202025
user         admin

The following system message is generated by this event: 


syslog:
May 22 16:00:40 192.168.10.1 <1030> May 22 23:00:40 apic1
%LOG_LOCAL0-6-SYSTEM_MSG
[E4205213][transition][info][subj-[uni/userext/user-nancy]/mod-4294967339]
User nancy created

System Message Structure

System messages have the following structure: 

TIMESTAMP SOURCE %FACILITY-SEVERITY-MNEMONIC: Message-text

The fields in the message are as follows:

  • TIMESTAMP

    The year, month, date, and time of day when the message was generated.

  • SOURCE

    The platform that sent the message, such as apic2 (for APIC messages) or nexus (for switch messages).

  • FACILITY

    The facility code consists of two or more uppercase letters that indicate the facility to which the message refers. A facility can be a hardware device, a protocol, or a module of the system software.

  • SEVERITY

    The syslog severity level is a single-digit code from 0 to 7 that reflects the severity of the condition. The lower the number, the more serious the situation. The syslog severity terminology differs from APIC severity terminology, which follows the ITU Perceived Severity values described in RFC5674.

    The following table lists the message severity levels along with the equivalent ITU values:

    Severity Level ITU Level Description

    0 – emergency

    System is unusable

    1 – alert

    Critical

    Immediate action required

    2 – critical

    Major

    Critical condition

    3 – error

    Minor

    Error condition

    4 – warning

    Warning

    Warning condition

    5 – notification

    Indeterminate, Cleared

    Normal but significant condition

    6 – informational

    Informational message only

    7 – debugging

    Message that appears during debugging only

  • MNEMONIC

    The MNEMONIC code uniquely identifies the error message.

  • Message-text

    Message-text is a text string that describes the condition. The text string sometimes contains detailed information about the event, including terminal port numbers, network addresses, or addresses that correspond to locations in the system memory address space. Because variable fields change from message to message, they are represented here by short strings enclosed in square brackets ([ ]). A decimal number, for example, is represented as [dec]. The following table lists the variable fields in messages:

    Representation Type of Information

    [chars] or [char]

    Character string

    [dec]

    Decimal

    [hex]

    Hexadecimal integer

    [int]

    Integer

    [num]

    Number

Examples

This example shows a typical system message: 


2014 Jan 25 21:42:07 Nexus: ETHPORT-5-IF_DOWN_ADMIN_DOWN:
Interface Ethernet3/1 is down (Administratively down)

In this system message:

  • Nexus indicates that the generating condition occurred in the NX-OS operating system of a switch.

  • ETHPORT is the facility code.

  • 5 is the severity level, indicating a notification message.

  • IF_DOWN_ADMIN_DOWN is the mnemonic code.

  • “Interface Ethernet3/1 is down (Administratively down)” is the message text.

This example shows a typical system message: 


May 22 15:49:54 192.168.10.102 <1027> May 22 22:49:54 spine1
%LOG_LOCAL0-3-SYSTEM_MSG
[F41650][raised][threshold-crossed][major][sys/ch/scslot-6/sc/sensor-1/fault-F41650]
TCA: eqptTemp5min normalizedLast value 84 raised above threshold 80

In this system message:

  • spine1 indicates that the generating condition occurred in a spine switch.

  • LOG_LOCAL0 is the facility code.

  • 3 is the severity level, indicating an error condition.

  • SYSTEM_MSG is the mnemonic code.

  • “[F41650][raised][threshold-crossed][major][sys/ch/scslot-6/sc/sensor-1/fault-F41650] TCA: eqptTemp5min normalizedLast value 84 raised above threshold 80” is the message text.