Using the System Event Archive

This chapter describes how to use the System Event Archive (SEA). Release 12.2(33)SXH and later releases support the SEA.

Note•For complete syntax and usage information for the commands used in this chapter, see the Cisco IOS Master Command List, at this URL:

http://www.cisco.com/en/US/docs/ios/mcl/allreleasemcl/all_book.html

•SEA is supported with Supervisor Engine 32, Supervisor Engine 720-10GE, and Supervisor Engine 720 with a CompactFlash adapter and a CompactFlash card (WS-CF-UPG=).

Tip For additional information about Cisco Catalyst 6500 Series Switches (including configuration examples and troubleshooting information), see the documents listed on this page:

http://www.cisco.com/en/US/products/hw/switches/ps708/tsd_products_support_series_home.html

Participate in the Technical Documentation Ideas forum

This chapter consists of these sections:

•Understanding the System Event Archive

•Displaying the SEA Logging System

•Copying the SEA To Another Device

Understanding the System Event Archive

The primary method of discovering the cause of system failure is system messages. When system messages do not provide the information needed to determine the cause of a failure, you can enable debug traces and attempt to recreate the failure. However, there are several situations in which neither of the above methods provides an optimum solution:

•Reviewing a large number of system messages can be an inefficient method of determing the cause of a failure.

•Debug trace is usually not configured by default.

•You cannot recreate the failure while using debug trace.

•Using debug trace is not an option if the switch on which the failure has occurred is part of your critical network.

The SEA enables each of the CPUs on a switch to report events to the management processor using an out-of-band interface. Each event is logged in nonvolatile memory with a time stamp. You can retrieve the event log by accessing the bootflash on the device, or you can copy the log to another location such as a removable storage device.

The SEA maintains two files in the bootdisk, using up to 32 MB. These files contain the most recent messages recorded to the log:

•sea_log.dat—Applications store the most recent system events in this file.

•sea_console.dat—The most recent console messages are stored in this file.

These files are for system use and should not be removed.

Displaying the SEA Logging System

To display the SEA logging system, perform this task:

Command
Purpose

Router# show logging system [disk | size]

Displays the contents of the SEA.

(Optional) Use the keyword disk to display the location where the SEA is stored. Use the keyword size to display the current size of the SEA.

Router# clear logging system

Removes the event records stored in the SEA.


The following example shows how to display the SEA: 

Router# show logging system

SEQ: MM/DD/YY HH:MM:SS MOD/SUB: SEV, COMP,    MESSAGE

===================================================== 

 

1: 01/24/07 15:38:40   6/-1 : MAJ, GOLD, syndiagSyncPinnacle failed in slot 6

 

2: 01/24/07 15:38:40   6/-1 : MAJ, GOLD, queryHyperionSynched[6]: Hyperion out of sync in sw_mode 1

 

3: 01/24/07 15:38:40   6/-1 : MAJ, GOLD, queryHyperionSynched[6]: Hyperion out of sync in sw_mode 1

 

4: 01/24/07 15:38:40   6/-1 : MAJ, GOLD, queryHyperionSynched[6]: Hyperion out of sync in sw_mode 1

 

5: 01/24/07 15:38:40   6/-1 : MAJ, GOLD, queryHyperionSynched[6]: Hyperion out of sync in sw_mode 1

 

6: 01/24/07 15:38:40   6/-1 : MAJ, GOLD, queryHyperionSynched[6]: Hyperion out of sync in sw_mode 1

 

7: 01/24/07 15:38:39   6/-1 : MAJ, GOLD, queryHyperionSynched[6]: Hyperion out of sync in sw_mode 1

 
   
 
    
   
 The following example shows how to display the SEA logging system disk: 
 
    
   
 
    
Router# show logging system disk

 
   
 
    
   
 
    
SEA log disk: sup-bootdisk:

 
   
 
    
   
 
    
 
   
 
    
   
 The following example shows how to display the current size of the SEA: 
 
    
   
 
    
Router# show logging system size

 
   
 
    
   
 
    
SEA log size: 33554432 bytes

 
   
 
    
   
 
    
 
   
 
    
   
 The following example shows how to clear the SEA: 
 
    
   
 
    
Router# clear logging system

 
   
 
    
   
 
    
Clear logging system operation will take a while.

 
   
 
    
   
 
    
Do you want to continue? [no]: yes

 
   
 
    
   
 
    
Router#

 
   
 
     
    
    
   
 Copying the SEA To Another Device 
 
    
   
 To copy the SEA to another device, such as a removeable memory device, perform this task: 
 
    
   
 
 
   
 
    
 
      
      
      
 
        
        

          Command 
        
 		 
        
        

          Purpose 
        
 		 
      
 
      
 
       
Router# copy logging system file_system 
 
       
 Copies the contents of the SEA to the specified destination file system or process. 
 		 
      
 
      
    
 
   
 
   
 
   
 
 
    
   
 The valid values for file_system are: 
 
    
   
 •bootflash: 
 
    
   
 •disk0: 
 
    
   
 •disk1: 
 
    
   
 •ftp: 
 
    
   
 •http: 
 
    
   
 •https: 
 
    
   
 •rcp: 
 
    
   
 •slavebootflash: 
 
    
   
 •slavedisk0: 
 
    
   
 •slavedisk1: 
 
    
   
 •slavesup-bootdisk: 
 
    
   
 •slavesup-bootflash: 
 
    
   
 •sup-bootdisk: 
 
    
   
 •sup-bootflash: 
 
    
   
 •tftp: 
 
    
   
 The following example shows how to copy the SEA to the disk0 file system: 
 
    
   
 
    
Router# copy logging system disk0:

 
   
 
    
   
 
    
Destination filename [sea_log.dat]? 

 
   
 
    
   
 
    
Copy in 
progress...CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC

 
   
 
    
   
 
    
33554432 bytes copied in 112.540 secs (298156 bytes/sec)

 
   
 
    
   
 
    
 
   
 
    
   
 The following example shows how to copy the SEA using the remote file copy function (rcp): 
 
    
   
 
    
Router# copy logging system rcp:

 
   
 
    
   
 
    
Address or name of remote host []? 192.0.2.1

 
   
 
    
   
 
    
Destination username [Router]? username1

 
   
 
    
   
 
    
Destination filename [sea_log.dat]? /auto/tftpboot-users/username1/sea_log.dat

 
   
 
    
   
 
    
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

 
   
 
    
   
 
    
33554432 bytes copied in 48.172 secs (696555 bytes/sec)

 
   
 
    
   
 
    
 
   
 
   
 
     
   
 
   
 
    
   
 Tip For additional information about Cisco Catalyst 6500 Series Switches (including configuration examples and troubleshooting information), see the documents listed on this page: 
 
    
   
 http://www.cisco.com/en/US/products/hw/switches/ps708/tsd_products_support_series_home.html 
 
    
   
 Participate in the Technical Documentation Ideas forum