Events

An event is any significant occurrence within or affecting the VPN 3000 Concentrator, such as an alarm, trap (an event message sent to an SNMP system is called a "trap"), error condition, network problem, task completion, threshold breach, or status change. The VPN Concentrator records events in an event log, which is stored in nonvolatile memory. You can also specify that certain events trigger a console message, a UNIX syslog record, an e-mail message, or an SNMP management system trap.

Event attributes include class and severity level.

Event Class

Event class denotes the source of the event and refers to a specific hardware or software subsystem within the VPN Concentrator. Table 10-1 lists the event classes.

Table 10-1 VPN Concentrator Event Classes

Class Name	Class Description (Event Source)	Cisco-Specific Event Class?
AUTH	Authentication	N
AUTHDBG	Authentication debugging	Y
AUTHDECODE	Authentication protocol decoding	Y
AUTOUPDATE	Autoupdate subsystem	N
BMGT	Bandwidth management subsystem	Y
BMGTDBG	Bandwidth management debugging	Y
CAPI	Cryptography subsystem	N
CERT	Digital certificates subsystem including SCEP	N
CONFIG	Configuration subsystem	N
DHCP	DHCP subsystem	N
DHCPDBG	DHCP debugging	Y
DHCPDECODE	DHCP decoding	Y
DM	Data Movement subsystem	N
DNS	DNS subsystem	N
DNSDBG	DNS debugging	Y
DNSDECODE	DNS decoding	Y
EVENT	Event subsystem	N
EVENTDBG	Event subsystem debugging	Y
EVENTMIB	Event MIB changes	Y
EXPANSIONCARD	Expansion card (module) subsystem	N
FILTER	Filter subsystem	N
FILTERDBG	Filter debugging	Y
FSM	Finite State Machine subsystem (for debugging)	Y
FTPD	FTP daemon subsystem	N
GENERAL	NTP subsystem and other general events	N
GRE	GRE subsystem	N
GREDBG	GRE debugging	Y
GREDECODE	GRE decoding	Y
HARDWAREMON	Hardware monitoring (fans, temperature, voltages, etc.)	N
HTTP	HTTP subsystem	N
IKE	ISAKMP/Oakley (IKE) subsystem	N
IKEDBG	ISAKMP/Oakley (IKE) debugging	Y
IKEDECODE	ISAKMP/Oakley (IKE) decoding	Y
IP	IP router subsystem	N
IPDBG	IP router debugging	Y
IPDECODE	IP packet decoding	Y
IPSEC	IP Security subsystem	N
IPSECDBG	IP Security debugging	Y
IPSECDECODE	IP Security decoding	Y
L2TP	L2TP subsystem	N
L2TPDBG	L2TP debugging	Y
L2TPDECODE	L2TP decoding	Y
LBSSF	Load Balancing subsystem	N
MIB2TRAP	MIB-II trap subsystem: SNMP MIB-II traps	N
OSPF	OSPF subsystem	N
PPP	PPP subsystem	N
PPPDBG	PPP debugging	Y
PPPDECODE	PPP decoding	Y
PPTP	PPTP subsystem	N
PPTPDBG	PPTP debugging	Y
PPTPDECODE	PPTP decoding	Y
PSH	Operating system command shell	N
PSOS	Embedded real-time operating system	N
QUEUE	System queue	N
REBOOT	System rebooting	N
RM	Resource Manager subsystem	N
SMTP	SMTP event handling	N
SNMP	SNMP trap subsystem	N
SSH	SSH subsystem	N
SSL	SSL subsystem	N
SYSTEM	Buffer, heap, and other system utilities	N
TCP	TCP subsystem	N
TELNET	Telnet subsystem	N
TELNETDBG	Telnet debugging	Y
TELNETDECODE	Telnet decoding	Y
TIME	System time (clock)	N
VRRP	VRRP subsystem	N
XML	XML	N

Note The Cisco-specific event classes provide information that is meaningful only to Cisco engineering or support personnel. Also, the DBG and DECODE events require significant system resources and might seriously degrade performance. We recommend that you avoid logging these events unless Cisco requests it.

Event Severity Level

Severity level indicates how serious or significant the event is,. It indicates how likely it is to cause unstable operation of the VPN concentrator, whether it represents a high-level or low-level operation, or whether it returns little or great detail. Level 1 is most significant. Table 10-2 describes the severity levels.

Table 10-2 VPN Concentrator Event Severity Levels

Level	Category	Description
1	Fault	A crash or non-recoverable error.
2	Warning	A pending crash or severe problem that requires user intervention.
3	Warning	A potentially serious problem that might require user action.
4	Information	An information-only event with few details.
5	Information	An information-only event with moderate detail.
6	Information	An information-only event with greatest detail.
7	Debug	Least amount of debugging detail.
8	Debug	Moderate amount of debugging detail.
9	Debug	Greatest amount of debugging detail.
10	Packet Decode	High-level packet header decoding
11	Packet Decode	Low-level packet header decoding
12	Packet Decode	Hex dump of header
13	Packet Decode	Hex dump of packet

Within a severity level category, higher-numbered events provide more details than lower-numbered events, without necessarily duplicating the lower-level details. For example, within the Information category, Level 6 provides greater detail than Level 4, but does not necessarily include the same information as Level 4.

Logging higher-numbered severity levels causes performance to deteriorate, since more system resources are used to log and handle these events.

Note The Debug (7-9) and Packet Decode (10-13) severity levels are intended for use by Cisco engineering and support personnel. We recommend that you avoid logging these events unless Cisco requests it.

The VPN Concentrator, by default, displays all events of severity level 1 through 3 on the console. It writes all events of severity level 1 through 5 to the event log. You can change these defaults on the Configuration | System | Events | General screen, and you can configure specific events for special handling on the Configuration | System | Events | Classes screens.

Event Log

The VPN Concentrator records events in an event log, which is stored in nonvolatile memory. Thus the event log persists even if the system is powered off. For troubleshooting any system difficulty, or just to examine details of system activity, consult the event log first.

The Model 3015-3080 event log holds 2048 events, the Model 3005 holds 256 events. The log wraps when it is full; that is, newer events overwrite older events when the log is full.

For the event log, you can configure:

Which event classes and severity levels to log.
Whether to save the event log to a file in Flash memory when it is full (when it wraps). And if so:

The format of the information in the saved log file.
Whether to automatically send a copy of the saved log file via FTP to a remote system.

Event Log Data

Each entry (record) in the event log consists of several fields including:

A sequence number.
Date and time.
Event severity level.
Event class and number.
Event repetition count.
Event IP address (only for certain events).
Description string.

For more information, see the Monitoring | Filterable Event Log screen.

Configuration | System | Event

This section of the Manager lets you configure how the VPN Concentrator handles events. Events provide information for system monitoring, auditing, management, accounting, and troubleshooting.

Figure 10-1 Configuration | System | Events Screen

Configuration | System | Events | General

This Manager screen lets you configure the general, or default, handling of all events. These defaults apply to all event classes.

You can override these default settings by configuring specific events for special handling on the Configuration | System | Events | Classes screens.

Figure 10-2 Configuration | System | Events | General Screen

Save Log on Wrap

Check the Save Log on Wrap check box to automatically save the event log when it is full. (The box is unchecked by default.) The Model 3015-3080 event log holds 2048 events, the Model 3005 holds 256 events. When the log is full, newer events overwrite older events; that is, entry 2049 overwrites entry 1, etc.

If you select automatic save, the system saves the log file to a file in Flash memory with the filename LOGNNNNN.TXT, where NNNNN is an increasing sequence number that starts with 00001 and restarts after 99999. The sequence numbers continue through reboots. For example, if four log files have already been saved, the next one saved after a reboot is LOG00005.TXT.

If Flash memory has less than 2.56 MB of free space, the system deletes the oldest log file(s) to make room for the newest saved log file. It also generates an event that notes the deletion. If there are no old log files to delete, the save function fails, and the system generates an event that notes the failure.

Each saved log file requires about 334 KB. To conserve space in Flash memory, we recommend that you periodically remove the saved log files. Keeping more than 10 to 12 files wastes space. The Administration | File Management | Files screen shows total, used, and free space in Flash memory.

Note The VPN Concentrator automatically saves the log file if it crashes, and when it is rebooted, regardless of this Save Log on Wrap setting. This log file is named SAVELOG.TXT, and it overwrites any existing file with that name. The SAVELOG.TXT file is useful for debugging.

You can manage saved log files with options on this screen and on the Administration | File Management screens.

Save Log Format

Click the Save Log Format drop-down menu button to specify the format of the saved log files.

Multiline = Entries are ASCII text and appear on multiple 80-character lines (default). Choose this format for easiest reading and printing.
Comma Delimited = Each entry is a single record with fields separated by commas. Choose this format for subsequent processing by an application program such as a spreadsheet or accounting system.
Tab Delimited = Each entry is a single record with fields separated by tab characters. Choose this format for subsequent processing by an application program such as a spreadsheet or accounting system.

Refer to the section on Monitoring | Filterable Event Log in VPN 3000 Series Concentrator Reference Volume II: Administration and Monitoring for details on event log fields.

FTP Saved Log on Wrap

Check the FTP Saved Log on Wrap check box to automatically send the saved event log file, when it wraps, via FTP to a remote computer. (The box is unchecked by default.) This option copies the log file but does not delete it from the VPN Concentrator. If you check this box, you must also configure FTP destination system parameters on the Configuration | System | Events | FTP Backup screen.

Email Source Address

Enter the address to put in the From: field of an e-mailed event message. Enter up to 48 alphanumeric characters with no spaces, for example: cisco@cisco.com. You should configure this field if you configure any Severity to Email events; if you leave it blank, the From: field has the same address as the To: field (the recipient's e-mail address).

Syslog Format

Click the Syslog Format drop-down menu button and choose the format for all events sent to UNIX syslog servers. Choices are:

Original = Original VPN Concentrator event format with information on one line. Each entry in the event log consists of the following fields:

Sequence Date Time SEV=Severity Class/Number RPT=RepeatCount String

Sequence: The sequence number of the event.
Date: The date the event occurred. The date is in the following format: MM/DD/YYYY.
Time: The time the event occurred. The time is in the following format: hh:mm:ss.ttt.
Severity: The severity of the event (1-13). To see how this original severity level maps to Cisco IOS severity levels, see Table 10-3.
Class/Number: The event class and event number. For a list of event classes, see the "Events" chapter.
RepeatCount: The number of times this particular event has occurred since the VPN Concentrator was last booted.
String: The description of the event. The string sometimes includes the IP address of the user whose session generated the event.

For example:

 
3 12/06/1999 14:37:06.680 SEV=4 HTTP/47 RPT=17 10.10.1.35 New administrator login: admin.

Cisco IOS Compatible = Event format that is compatible with Cisco syslog management applications. Each entry in the event log is one line consisting of the following fields:

Sequence: Date Time TimeZone TimeZoneOffset %Class-Severity-Number: RPT=RepeatCount: String

Sequence: The sequence number of the event.
Date: The date the event occurred. The date is in the following format: YYYY MMM DD.
Time: The time the event occurred. The time is in the following format: hh:mm:ss.ttt.
TimeZone: The time zone in which the event occurred.
TimeZoneOffset: The offset of the time zone from GMT.
Class: The event class. For a list of event classes, see Table 10-1.
Severity: The Cisco IOS severity of the event (0-7). Table 10-3 shows the mapping between Cisco IOS format severity levels and Original format severity levels.
Number: The event number.
RepeatCount: The number of times this particular event has occurred since the VPN Concentrator was last booted.
String: The description of the event. The string sometimes includes the IP address of the user whose session generated the event.

For example:

 
3 1999 Dec 06 14:37:06.680 EDT -4:00 %HTTP-5-47:RPT=17 10.10.1.35: New administrator login: admin.

The Original severities and the Cisco IOS severities differ. Original severities number from 1-13. (For the meaning of each Original severity, see Table 10-2.) Cisco IOS severities number from 0-7. Table 10-3 shows the meaning of Cisco IOS severities and how they map to Original severities.

Table 10-3 Cisco IOS Severities

Cisco IOS Severity	Meaning	Original Severity
0	Emergencies	1
1	Alerts	Not used
2	Critical	2
3	Errors	Not used
4	Warning	3
5	Notification	4
6	Informational	5, 6
7	Debugging	7-13

Severity to Log

Click the Severity to Log drop-down menu button and choose the range of event severity levels to enter in the event log by default. The choices are: None, 1, 1-2, 1-3, ..., 1-13. The default is 1-5. Using the default means that all events of severity level 1 through severity level 5 are entered in the event log.

Note Avoid configuring Severity to Log with ranges greater than 1-5 for all events. Configuring the severity ranges above 5 for all events greatly impacts system performance. Instead, configure only individual event classes with higher severities.

Severity to Console

Click the Severity to Console drop-down menu button and choose the range of event severity levels to display on the console by default. The choices are: None, 1, 1-2, 1-3, ..., 1-13. The default is 1-3. Using the default means that all events of severity level 1 through severity level 3 are displayed on the console.

Note Avoid configuring Severity to Console with ranges greater than 1-5 for all events. Configuring the severity ranges above 5 for all events greatly impacts system performance. Instead, configure only individual event classes with higher severities.

Severity to Syslog

Click the Severity to Syslog drop-down menu button and choose the range of event severity levels to send to a UNIX syslog server by default. The choices are: None, 1, 1-2, 1-3, ..., 1-6. The default is None. Using the default means that no events are sent to a syslog server.

If you select any severity levels to send, you must also configure the syslog server(s) on the Configuration | System | Events | Syslog Servers screens.

Note Avoid configuring Severity to Syslog with ranges greater than 1-5 for all events. Configuring the severity ranges above 5 for all events greatly impacts system performance. Instead, configure only individual event classes with higher severities. Setting a high range can disable your ability to manage the VPN Concentrator using the browser management interface. The more calls coming into a VPN Concentrator, the greater the likelihood that high severities for Severity to Syslog could cause a problem. If Severity to Syslog has such a high range that you cannot interact with the VPN Concentrator using the browser interface, use the console interface to access the Severity to Syslog parameter and set the level to a lower range, for example: 1-5. This action enables you to regain control through the browser management interface.

Severity to Email

Click the Severity to Email drop-down menu button and choose the range of event severity levels to e-mail to recipients by default. The choices are: None, 1, 1-2, 1-3. The default is None. Using the default means that no events are sent via e-mail.

If you select any severity levels to e-mail, you must also configure an SMTP server on the Configuration | System | Events | SMTP Servers screens, and you must configure e-mail recipients on the Configuration | System | Events | Email Recipients screens. You should also configure the preceding Email Source Address.

Severity to Trap

Click the Severity to Trap drop-down menu button and choose the range of event severity levels to send to an SNMP network management system by default. Event messages sent to SNMP systems are called "traps." The choices are: None, 1, 1-2, 1-3. The default is None: no events are sent as SNMP traps.

If you select any severity levels to send, you must also configure SNMP destination system parameters on the Configuration | System | Events | Trap Destinations screens.

The VPN Concentrator can send the standard, or "well-known," SNMP traps listed in Table 10-4. To have an SNMP NMS receive them, you must configure the events as in the table, and configure a trap destination.

Table 10-4 Configuring "Well-Known" SNMP Traps

To Send this "Well-Known" SNMP Trap	Configure Either General Event Handling or this Event Class	With this Severity to Trap
coldStart	EVENT	1 or higher
linkDown	IP	1-3 or higher
linkUp	IP	1-3 or higher
authFailure (This trap is SNMP authentication failure, not tunnel authentication failure.)	SNMP	1-3 or higher

Apply / Cancel

To include your settings for default event handling in the active configuration, click Apply. The Manager returns to the Configuration | System | Events screen.

Reminder:

To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.

To discard your settings, click Cancel. The Manager returns to the Configuration | System | Events screen.

Configuration | System | Events | FTP Backup

This screen lets you configure parameters for using FTP to automatically back up saved event log files on a remote computer. If you enable FTP Saved Log on Wrap on the Configuration | System | Events | General screen, you must configure the FTP parameters on this screen.

The VPN Concentrator acts as an FTP client when executing this function.

Note Another way to back up saved event log files on a remote computer is to enable an external Syslog server.

Figure 10-3 Configuration | System | Events | FTP Backup Screen

FTP Server

Enter the IP address or host name of the destination computer to receive copies of saved event log files via FTP. (If you have configured a DNS server, you can enter a host name; otherwise enter an IP address.)

FTP Directory

Enter the complete directory path name on the destination computer to receive copies of saved event log files. For example, c:\vpn\logfiles.

FTP Username

Enter the username for FTP login on the destination computer.

FTP Password

Enter the password to use with the FTP username. The field displays only asterisks.

Verify

Re-enter the FTP password to verify it. The field displays only asterisks.

Apply / Cancel

To include your FTP backup system settings in the active configuration, click Apply. The Manager returns to the Configuration | System | Events screen.

Reminder:

To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.

To discard your settings, click Cancel. The Manager returns to the Configuration | System | Events screen.

Configuration | System | Events | Classes

This section of the Manager lets you add, configure, modify, and delete specific event classes for special handling. You can thus override the general, or default, handling of event classes. For example, you might want to send e-mail for HARDWAREMON events of severity 1 and 2, whereas default event handling does not send any e-mail.

Event classes denote the source of an event and refer to a specific hardware or software subsystem within the VPN Concentrator. Table 10-1 describes the event classes.

Figure 10-4 Configuration | System | Events | Classes Screen

To configure default event handling, click the highlighted link that says "Click here to configure general event parameters."

Configured Event Classes

The Configured Event Classes list shows the event classes that have been configured for special handling. The initial default entry is MIB2TRAP, which are SNMP MIB-II events, or "traps," that you might want to monitor with an SNMP network management system. Other configured event classes are listed in order by class number and name. If no classes have been configured for special handling, the list shows --Empty--.

Add / Modify / Delete

To configure and add a new event class for special handling, click Add. See Configuration | System | Events | Classes | Add.

To modify an event class that has been configured for special handling, select the event class from the list and click Modify. See Configuration | System | Events | Classes | Modify.

To remove an event class that has been configured for special handling, select the event class from the list and click Delete.

Note There is no confirmation or undo.

The Manager refreshes the screen and shows the remaining entries in the list.

Reminder:

The Manager immediately includes your changes in the active configuration. To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.

Configuration | System | Events | Classes| Add or Modify

These screens let you:

Add and configure the special handling of a specific event class.
Modify the special handling of a specific event class.

Figure 10-5 Configuration | System | Events | Classes | Add or Modify Screen

Class Name

Add screen:

Click the drop-down menu button and choose the event class you want to add and configure for special handling. (Please note that Select Class is an instruction reminder, not a class. Table 10-1 describes the event classes.

Modify screen:

The field shows the configured event class you are modifying. You cannot change this field.

All subsequent parameters on this screen apply to this event class only.

Enable

Check the Enable check box to enable the special handling of this event class. (The box is checked by default.)

Unchecking this box lets you set up the parameters for the event class but activate it later, or temporarily disable special handling without deleting the entry. The Configured Event Classes list on the Configuration | System | Events | Classes screen indicates disabled event classes. Disabled event classes are handled in accordance with the default parameters for all event classes.