By looking into the routers SYSLOG, you will realize that the outage was caused by the router restarting. This enables you to immediately narrow your search for the root cause. Through the use of the routers SYSLOG with date and time stamping, you now see the benefits of troubleshooting your network. You should familiarize yourself with how to see what time the router thinks it is and how to configure the router to operate as previously discussed.
What is the current time and date in the router? Through the use of the show clock command this can quickly and easily be determined as shown in the following example:
OSPF_Router# show clock *02:16:54.592 GMT Mon Mar 1 1993
How do I set the date and time in the router? Through the use of the following command in the routers EXEC mode:
OSPF_Router# clock set ? hh:mm:ss Current Time OSPF_Router# clock set 22:15:00 ? <1-31> Day of the month MONTH Month of the year OSPF_Router# clock set 22:15:00 19 April ? <1993-2035> Year OSPF_Router# clock set 22:15:00 19 April 1998
The next item you want to configure is the time zone for the router. The process of setting the router to automatically recognize daylight savings time is also provided in the following example.
OSPF_Router# clock timezone GMT 0 OSPF_Router# clock summer-time EST recurring
A good rule of thumb is to have all routers on the same time and in the same time zone regardless of their physical location.
The final and most important area that you need to cover on this subject is how to get the router SYSLOG to apply the date and time you just finished configuring in the router? The following example demonstrates how to do this.
OSPF_Router# configuration terminal Enter configuration commands, one per line. End with CNTL/Z. OSPF_Router(config)#service timestamps log datetime localtime show-timezone
Log OSPF Neighbor Changes
Configure your OSPF router with the debug ip ospf adjacency command if you want to know when an OSPF neighbor changes without turning on the debugging command. To configure the router to generate a SYSLOG message when an OSPF neighbor changes state, enter the following command in router configuration mode:
OSPF_Router(config)# ospf log-adj-changes
The ospf log-adj-changes command provides a high-level view of changes to the state of the OSPF peer relationships with less output and router overhead if debug was used.
Logging to the Routers Buffer
To log messages to the routers internal buffer, use the logging buffered command while in the routers global configuration mode. This command copies logging messages to an internal buffer instead of writing them to the console terminal. The buffer is circular (that is, FIFO) in nature, so newer messages overwrite older messages after the buffer is filled. The no form of this command cancels the use of the buffer and writes messages to the console terminal, which is the default.
logging buffered [size] no logging buffered
The size argument (optional) sets the size of the buffer from 4,096 to 4,294,967,295 bytes. The default is 4,096 bytes (4K).
Ensure that you do not make the buffer size too large because the router could run out of memory and not be able to perform other tasks.
Logging to a SYSLOG Server
The capability to record, at a central location, the information from a routers SYSLOG is extremely useful in determining problems that might be occurring or those that did occur on a router you can no longer reach.
To log messages to a SYSLOG server host, use the logging command in the routers global configuration command mode. This command identifies a SYSLOG server host to receive logging messages. The no form of this command deletes the SYSLOG server with the specified address from the list of SYSLOG servers in the routers configuration file. The following is the syntax for the logging command as well as its no form:
logging host ip address no logging host ip address
If you are interested, there are a variety of places to get this software. Some SYSLOG server manufacturers make you pay for it, and others will give it away. The CLS syslog daemon for Win95 and WinNT can be found at the following URL: http://www.cls.de/syslog.
By issuing the logging command more than once, you build a list of SYSLOG servers that receive logging messages. The following example shows a section of a routers configuration file.
logging buffered 8191 logging console critical logging 184.108.40.206 logging 220.127.116.11 logging 18.104.22.168
This particular router has been configured to allocate 8,191 bytes to an internal buffer, which will record the SYSLOG events. The router has also been configured to send critical events to three SYSLOG servers.
There are a variety of other options and settings for performing syslogging within a router. The example that follows shows these options through the use of the built-in help feature. Please note some of the ones already discussed. Further discussion on these features is beyond the scope of this book. If additional information is required, the reader is referred to the Cisco Network Protocol Command Reference Guide.
OSPF_Router(config)#logging ? WORD IP address of the logging host buffered Copy logging messages to an internal buffer console Set console logging level facility Facility parameter for syslog messages monitor Set terminal line (monitor) logging level on Enable logging to all supported destinations trap Set syslog server logging level