cc/td/doc/product/vpn/vpn3002/3_0
hometocprevnextglossaryfeedbacksearchhelp
PDF

Table of Contents

Events

Events

An event is any significant occurrence within or affecting the VPN 3002 such as an alarm, trap, error condition, network problem, task completion, threshold breach, or status change. The VPN 3002 records events in an event log, which is stored in nonvolatile memory. You can also specify that certain events trigger a console message, a UNIX syslog record, or an SNMP management system trap.

Event attributes include class and severity level.

Event class

Event class denotes the source of the event and refers to a specific hardware or software subsystem within the VPN 3002.Table 9-1 describes the event classes.


Table 9-1: VPN 3002 event classes
Class name Class description (event source)
(*Cisco-specific event class)
AUTH

Authentication*

AUTHDBG

Authentication debugging*

AUTHDECODE

Authentication protocol decoding*

AUTOUPDATE

Autoupdate subsystem*

BKPLN

WAN backplane driver*

CAPI

Cryptography subsystem*

CERT

Digital certificates subsystem

CONFIG

Configuration subsystem*

DHCP

DHCP subsystem

DHCPDBG

DHCP debugging*

DHCPDECODE

DHCP decoding*

DM

Data Movement subsystem*

DNS

DNS subsystem

DNSDBG

DNS debugging*

DNSDECODE

DNS decoding*

EVENT

Event subsystem*

EVENTDBG

Event subsystem debugging*

EVENTMIB

Event MIB changes*

EXPANSIONCARD

Expansion card (module) subsystem

FILTER

Filter subsystem

FILTERDBG

Filter debugging*

FSM

Finite State Machine subsystem (for debugging)*

FTPD

FTP daemon subsystem

GENERAL

NTP subsystem and other general events

GRE

GRE subsystem

GREDBG

GRE debugging*

GREDECODE

GRE decoding*

HARDWAREMON

Hardware monitoring (fans, temperature, voltages, etc.)

HDLC

HDLC/SYNC driver for WAN module*

HTTP

HTTP subsystem

HWDIAG

Hardware diagnostics for WAN module*

IKE

ISAKMP/Oakley (IKE) subsystem

IKEDBG

ISAKMP/Oakley (IKE) debugging*

IKEDECODE

ISAKMP/Oakley (IKE) decoding*

IP

IP router subsystem

IPDBG

IP router debugging*

IPDECODE

IP packet decoding*

IPSEC

IP Security subsystem

IPSECDBG

IP Security debugging*

IPSECDECODE

IP Security decoding*

L2TP

L2TP subsystem

L2TPDBG

L2TP debugging*

L2TPDECODE

L2TP decoding*

LBSSF

Load Balancing/Secure Session Failover subsystem*

MIB2TRAP

MIB-II trap subsystem: SNMP MIB-II traps*

OSPF

OSPF subsystem

PPP

PPP subsystem

PPPDBG

PPP debugging*

PPPDECODE

PPP decoding*

PPTP

PPTP subsystem

PPTPDBG

PPTP debugging*

PPTPDECODE

PPTP decoding*

PSH

Operating system command shell*

PSOS

Embedded real-time operating system*

QUEUE

System queue*

REBOOT

System rebooting

RM

Resource Manager subsystem*

SMTP

SMTP event handling

SNMP

SNMP trap subsystem

SSH

SSH subsystem

SSL

SSL subsystem

SYSTEM

Buffer, heap, and other system utilities*

T1E1

T1/E1 ports on WAN module*

TCP

TCP subsystem

TELNET

Telnet subsystem

TELNETDBG

Telnet debugging*

TELNETDECODE

Telnet decoding*

TIME

System time (clock)

VRRP

VRRP subsystem

WAN

WAN module subsystem*


Note   The Cisco-specific event classes provide information that is meaningful only to Cisco engineering or support personnel. Also, the DBG and DECODE events require significant system resources and may seriously degrade performance. We recommend that you avoid logging these events unless Cisco requests it.

Event severity level

Severity level indicates how serious or significant the event is; i.e., how likely it is to cause unstable operation of the VPN 3002, whether it represents a high-level or low-level operation, or whether it returns little or great detail. Level 1 is most significant.Table 9-2 describes the severity levels.


Table 9-2: VPN 3002 event severity levels
Level Category Description
1

Fault

A crash or non-recoverable error.

2

Warning

A pending crash or severe problem that requires user intervention.

3

Warning

A potentially serious problem that may require user action.

4

Information

An information-only event with few details.

5

Information

An information-only event with moderate detail.

6

Information

An information-only event with greatest detail.

7

Debug

Least amount of debugging detail.

8

Debug

Moderate amount of debugging detail.

9

Debug

Greatest amount of debugging detail.

10

Packet Decode

High-level packet header decoding

11

Packet Decode

Low-level packet header decoding

12

Packet Decode

Hex dump of header

13

Packet Decode

Hex dump of packet

Within a severity level category, higher-numbered events provide more details than lower-numbered events, without necessarily duplicating the lower-level details. For example, within the Information category, Level 6 provides greater detail than Level 4 but doesn't necessarily include the same information as Level 4.

Logging higher-numbered severity levels degrades performance, since more system resources are used to log and handle these events.


Note   The Debug (7-9) and Packet Decode (10-13) severity levels are intended for use by Cisco engineering and support personnel. We recommend that you avoid logging these events unless Cisco requests it.

The VPN 3002, by default, displays all events of severity level 1 through 3 on the console. It writes all events of severity level 1 through 5 to the event log. You can change these defaults on the Configuration | System | Events | General screen, and you can configure specific events for special handling on the Configuration | System | Events | Classes screens.

Event log

The VPN 3002 records events in an event log, which is stored in nonvolatile memory. Thus the event log persists even if the system is powered off. For troubleshooting any system difficulty, or just to examine details of system activity, consult the event log first.

The VPN 3002 holds 256 events. The log wraps when it is full; that is, newer events overwrite older events when the log is full.

For the event log, you can configure which event classes and severity levels to log.


Note   The VPN 3002 automatically saves the log file if it crashes, and when it is rebooted. This log file is named SAVELOG.TXT, and it overwrites any existing file with that name. The SAVELOG.TXT file is useful for debugging.

Event log data

Each entry (record) in the event log consists of several fields including:

For more information, see the Monitoring | Filterable Event Log screen.

Configuration | System | Events

This section of the Manager lets you configure how the VPN 3002 handles events. Events provide information for system monitoring, auditing, management, accounting, and troubleshooting.


Figure 9-1: Configuration | System | Events screen

Configuration | System | Events | General

This Manager screen lets you configure the general, or default, handling of all events. These defaults apply to all event classes.

You can override these default settings by configuring specific events for special handling on the Configuration | System | Events | Classes screens.


Figure 9-2: Configuration | System | Events | General screen

Syslog Format

Click the drop-down menu button and select the format for all events sent to UNIX syslog servers. Choices are:

Severity to Log

Click the drop-down menu button and select the range of event severity levels to enter in the event log by default. Choices are: None, 1, 1-2, 1-3, ..., 1-13. The default is 1-5: all events of severity level 1 through severity level 5 are entered in the event log.

Severity to Console

Click the drop-down menu button and select the range of event severity levels to display on the console by default. Choices are: None, 1, 1-2, 1-3, ..., 1-13. The default is 1-3: all events of severity level 1 through severity level 3 are displayed on the console.

Severity to Syslog

Click the drop-down menu button and select the range of event severity levels to send to a UNIX syslog server by default. Choices are: None, 1, 1-2, 1-3, ..., 1-6. The default is None: no events are sent to a syslog server.

If you select any severity levels to send, you must also configure the syslog server(s) on the Configuration | System | Events | Syslog Servers screens.

Severity to Trap

Click the drop-down menu button and select the range of event severity levels to send to an SNMP network management system by default. Event messages sent to SNMP systems are called "traps." Choices are: : None, 1, 1-2, 1-3. The default is None: no events are sent as SNMP traps.

If you select any severity levels to send, you must also configure SNMP destination system parameters on the Configuration | System | Events | Trap Destinations screens.

The VPN 3002 can send the standard, or "well-known," SNMP traps listed in Table 9-3. To have an SNMP NMS receive them, you must configure the events as in the table, and configure a trap destination.


Table 9-3: Configuring "well-known" SNMP traps
To send this "well-known" SNMP trap Configure either General event handling or this Event Class With this Severity to Trap
coldStart EVENT 1 or higher
linkDown IP 1-3 or higher
linkUp IP 1-3 or higher
authFailure

(This trap is SNMP authentication failure, not tunnel authentication failure.)

SNMP 1-3 or higher

Apply / Cancel

To include your settings for default event handling in the active configuration, click Apply. The Manager returns to the Configuration | System | Events screen.

Reminder:

To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.

To discard your settings, click Cancel. The Manager returns to the Configuration | System | Events screen.

Configuration | System | Events | Classes

This section of the Manager lets you add, configure, modify, and delete specific event classes for special handling. You can thus override the general, or default, handling of event classes. For example, you might want to send email for HARDWAREMON events of severity 1-2, whereas default event handling doesn't send any email.

Event classes denote the source of an event and refer to a specific hardware or software subsystem within the VPN 3002.Table 9-1 describes the event classes.


Figure 9-3: Configuration | System | Events | Classes screen

To configure default event handling, click the highlighted link that says "Click here to configure general event parameters."

Configured Event Classes

The Configured Event Classes list shows the event classes that have been configured for special handling. The initial default entry is MIB2TRAP, which are SNMP MIB-II events, or "traps," that you might want to monitor with an SNMP network management system. Other configured event classes are listed in order by class number and name. If no classes have been configured for special handling, the list shows --Empty--.

Add / Modify / Delete

To configure and add a new event class for special handling, click Add. See Configuration | System | Events | Classes | Add.

To modify an event class that has been configured for special handling, select the event class from the list and click Modify. See Configuration | System | Events | Classes | Modify.

To remove an event class that has been configured for special handling, select the event class from the list and click Delete. There is no confirmation or undo. The Manager refreshes the screen and shows the remaining entries in the list.

Reminder:

The Manager immediately includes your changes in the active configuration. To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.

Configuration | System | Events | Classes | Add or Modify

These screens let you:


Figure 9-4: Configuration | System | Events | Classes | Add screen

Class Name

Add screen:

Modify screen:

All subsequent parameters on this screen apply to this event class only.

Enable

Check this box to enable the special handling of this event class. (The box is checked by default.)

Clearing this box lets you set up the parameters for the event class but activate it later, or temporarily disable special handling without deleting the entry. The Configured Event Classes list on the Configuration | System | Events | Classes screen indicates disabled event classes. Disabled event classes are handled according to the default parameters for all event classes.

Severity to Log

Click the drop-down menu button and select the range of event severity levels to enter in the event log. Choices are: None, 1, 1-2, 1-3,..., 1-13. The default is 1-5: events of severity level 1 through severity level 5 are entered in the event log.

Severity to Console

Click the drop-down menu button and select the range of event severity levels to display on the console. Choices are: None, 1, 1-2, 1-3,..., 1-13. The default is 1-3: events of severity level 1 through severity level 3 are displayed on the console.

Severity to Syslog

Click the drop-down menu button and select the range of event severity levels to send to a UNIX syslog server. Choices are: None, 1, 1-2, 1-3,..., 1-13. The default is None: no events are sent to a syslog server.


Note   Sending events to a syslog server generates IP packets, which can generate new events if this setting is above level 9. We strongly recommend that you keep this setting at or below level 6. Avoid setting this parameter above level 9.

If you select any severity levels to send, you must also configure the syslog server(s) on the Configuration | System | Events | Syslog Servers screens, and you should configure the Syslog Format on the Configuration | System | Events | General screen.

Severity to Trap

Click the drop-down menu button and select the range of event severity levels to send to an SNMP network management system. Event messages sent to SNMP systems are called "traps." Choices are: None, 1, 1-2, 1-3, 1-4, 1-5. The default is None: no events are sent as SNMP traps.

If you select any severity levels to send, you must also configure SNMP destination system parameters on the Configuration | System | Events | Trap Destinations screens.

To configure "well-known" SNMP traps, seeTable 9-3 under Severity to Trap for Configuration | System | Events | General.

Add or Apply / Cancel

To add this event class to the list of those with special handling, click Add. Or to apply your changes to this configured event class, click Apply. Both actions include your entry in the active configuration. The Manager returns to the Configuration | System | Events | Classes screen. Any new event class appears in the Configured Event Classes list.

Reminder:

To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.

To discard your settings, click Cancel. The Manager returns to the Configuration | System | Events | Classes screen.

Configuration | System | Events | Trap Destinations

This section of the Manager lets you configure SNMP network management systems as destinations of event traps. Event messages sent to SNMP systems are called "traps." If you configure any event handling—default or special—with values in Severity to Trap fields, you must configure trap destinations in this section.

To configure default event handling, click the highlighted link that says "Click here to configure general event parameters." To configure special event handling, see the Configuration | System | Events | Classes screens.

To configure "well-known" SNMP traps, seeTable 9-3 under Severity to Trap for Configuration | System | Events | General.

To have an SNMP-based network management system (NMS) receive any events, you must also configure the NMS to "see" the VPN 3002 as a managed device or "agent" in the NMS domain.


Figure 9-5: Configuration | System | Events | Trap Destinations screen

Trap Destinations

The Trap Destinations list shows the SNMP network management systems that have been configured as destinations for event trap messages, and the SNMP protocol version associated with each destination. If no trap destinations have been configured, the list shows --Empty--.

Add / Modify / Delete

To configure a new SNMP trap destination, click Add. See Configuration | System | Events | Trap Destinations | Add.

To modify an SNMP trap destination that has been configured, select the destination from the list and click Modify. See Configuration | System | Events | Trap Destinations | Modify.

To remove an SNMP trap destination that has been configured, select the destination from the list and click Delete. There is no confirmation or undo. The Manager refreshes the screen and shows the remaining entries in the list.

Reminder:

The Manager immediately includes your changes in the active configuration. To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.

Configuration | System | Events | Trap Destinations |
Add or Modify

These screens let you:


Figure 9-6: Configuration | System | Events | Trap Destinations | Add screen

Destination

Enter the IP address or hostname of the SNMP network management system that is a destination for event trap messages. (If you have configured a DNS server, you can enter a hostname; otherwise enter an IP address.)

SNMP Version

Click the drop-down menu button and select the SNMP protocol version to use when formatting traps to this destination. Choices are SNMPv1 (version 1; the default) and SNMPv2 (version 2).

Community

Enter the community string to use in identifying traps from the VPN 3002 to this destination. The community string is like a password: it validates messages between the VPN 3002 and this NMS destination. If you leave this field blank, the default community string is public.

Port

Enter the UDP port number by which you access the destination SNMP server. Use a decimal number from 0 to 65535. The default is 162, which is the well-known port number for SNMP traps.

Add or Apply / Cancel

To add this system to the list of SNMP trap destinations, click Add. Or to apply your changes to this trap destination, click Apply. Both actions include your entry in the active configuration. The Manager returns to the Configuration | System | Events | Trap Destinations screen. Any new destination system appears in the Trap Destinations list.

Reminder:

To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.

To discard your settings, click Cancel. The Manager returns to the Configuration | System | Events | Trap Destinations screen, and the Trap Destinations list is unchanged.

Configuration | System | Events | Syslog Servers

This section of the Manager lets you configure UNIX syslog servers as recipients of event messages. Syslog is a UNIX daemon, or background process, that records events. The VPN 3002 can send event messages in two syslog formats to configured syslog systems. If you configure any event handling—default or special—with values in Severity to Syslog fields, you must configure syslog servers in this section.

To configure default event handling and syslog formats, click the highlighted link that says "Click here to configure general event parameters." To configure special event handling, see the Configuration | System | Events | Classes screens.


Figure 9-7: Configuration | System | Events | Syslog Servers screen

Syslog Servers

The Syslog Servers list shows the UNIX syslog servers that have been configured as recipients of event messages. You can configure a maximum of five syslog servers. If no syslog servers have been configured, the list shows --Empty--.

Add / Modify / Delete

To configure a new syslog server, click Add. See Configuration | System | Events | Syslog Servers | Add.

To modify a syslog server that has been configured, select the server from the list and click Modify. See Configuration | System | Events | Syslog Servers | Modify.

To remove a syslog server that has been configured, select the server from the list and click Delete. There is no confirmation or undo. The Manager refreshes the screen and shows the remaining entries in the list.

Reminder:

The Manager immediately includes your changes in the active configuration. To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.

Configuration | System | Events | Syslog Servers | Add or Modify

These screens let you:


Figure 9-8: Configuration | System | Events | Syslog Servers | Add screen

Syslog Server

Enter the IP address or hostname of the UNIX syslog server to receive event messages. (If you have configured a DNS server, you can enter a hostname; otherwise, enter an IP address.)

Port

Enter the UDP port number by which you access the syslog server. Use a decimal number from 0 to 65535. The default is 514, which is the well-known port number.

Facility

Click the drop-down menu button and select the syslog facility tag for events sent to this server. The facility tag lets the syslog server sort messages into different files or destinations. The choices are:

Add or Apply / Cancel

To add this server to the list of syslog servers, click Add. Or to apply your changes to this syslog server, click Apply. Both actions include your entry in the active configuration. The Manager returns to the Configuration | System | Events | Syslog Servers screen. Any new server appears in the Syslog Servers list.

Reminder:

To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.

To discard your entries, click Cancel. The Manager returns to the Configuration | System | Events | Syslog Servers screen, and the Syslog Servers list is unchanged.


hometocprevnextglossaryfeedbacksearchhelp
Posted: Tue Nov 19 15:14:23 PST 2002
Copyright 1989-2000©Cisco Systems Inc.