Recipe 18.13 Preventing the Most Common Messages from Being Logged

18.13.1 Problem

You want to prevent the router from sending link up/down syslog messages for unimportant router interfaces.

18.13.2 Solution

Use the no logging event configuration commands to disable the logging of common interface-level messages:

Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#interface Serial0/0
Router(config-if)#no logging event link-status
Router(config-if)#no logging event dlci-status-change
Router(config-if)#no logging event subif-link-status 
Router(config-if)#end 
Router#

18.13.3 Discussion

By default, log messages are sent whenever a router interface status changes states. Generally, you want to see log messages that indicate that an interface status has changed, but there are times when it can be useful to disable these types of messages. For instance, dial interfaces may cycle up and down many times throughout the course of a normal day without being cause for concern. Suppressing these messages helps keep logs uncluttered and can prevent network management staff from wasting time responding to unnecessary trouble reports:

%LINK-3-UPDOWN: Interface Serial0, changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0, changed state to down
%LINK-3-UPDOWN: Interface Serial0, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0, changed state to up

This example shows the log messages that are sent when a router interface changes states from up to down and back to up. The no logging event link-status command will prevent the router from creating these messages.

On Frame Relay interfaces, DLCI state changes trigger the router to create log messages. In large Frame Relay-based networks, many DLCI changes can occur daily, which can clutter logs and open duplicate trouble reports. The no logging event dlci-status-change configuration command will prevent these log messages from being created:

%FR-5-DLCICHANGE: Interface Serial0 - DLCI 50 state changed to INACTIVE
%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0.1, changed state to down
%FR-5-DLCICHANGE: Interface Serial0 - DLCI 50 state changed to ACTIVE
%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0.1, changed state to up

You can also suppress subinterface link up or down messages by using the no logging event subif-link-status configuration command. The following example shows a typical Frame Relay interface failure. Note that the router sends a "line protocol down" log message for the main interface and each of the subinterfaces. Although this example only shows one subinterface, it is not uncommon to see dozens of subinterfaces on a single physical interface. In these cases, it can be useful to suppress subinterface messages:

%LINK-3-UPDOWN: Interface Serial0, changed state to down
%FR-5-DLCICHANGE: Interface Serial0 - DLCI 50 state changed to DELETED
%FR-5-DLCICHANGE: Interface Serial0 - DLCI 102 state changed to DELETED
%FR-5-DLCICHANGE: Interface Serial0 - DLCI 103 state changed to DELETED
%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0.1, changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0, changed state to down