Message Format
T
Table 2able 2.4.4 lists the general format and explanation of a sylists the general format and explanation of a sy slog message at the following message levels:slog message at the following message levels:
•• EmEmeerrggeenncciiees s ((nnoonnee))
•• AAlleerrttss
•• CCrriittiiccaal (l (nnoonnee))
•• EErrrroorrs s ((nnoonnee))
•• WWaarrnniinnggss
•• NNoottiiffiiccaattiioonnss
•• IInnffoorrmmaattiioonnaall
•• DDeebbuuggggiinngg
T
Table able 2.4: 2.4: Brocade Brocade Syslog Syslog MessagesMessages M
Meessssaagge e LLeevveell MMeessssaagge e FFoorrmmaatt EExxppllaannaattiioonn A
Alleerrtt PPoowweer r ssuupppplly y <<nnuumm>>, , <<llooccaattiioonn>>, , ffaaiilleedd A A ppoowweer r ssuupppplly y hhaas s ffaaiilleedd..
The <num> is the
The <num> is the power supply number.power supply number.
The <location> describes where the failed The <location> describes where the failed power supply
power supply is in the chais in the chassis. ssis. The locationThe location can be one of t
can be one of the following:he following:
ServerIron ADX 8000:
ServerIron ADX 8000:
•• LLeefft t MMoosstt
•• SSeeccoonnd d ffrroom m LLeefftt
•• TThhiirrd d ffrroom m LLeefftt
•• LLaasstt
ServerIron ADX 4000:
ServerIron ADX 4000:
•• lleefftt
•• rriigghhtt
ServerIron ADX 1000:
ServerIron ADX 1000:
•• lleefftt
•• rriigghhtt
ServerIron ADX 10000:
ServerIron ADX 10000:
•• ttoopp
•• sseeccoonnd d ffrroom m ttoopp
•• tthhiirrd d ffrroom m ttoopp
•• bboottttoomm
A
Alleerrtt FFaan n <<nnuumm>>, , <<llooccaattiioonn>>, , ffaaiilleedd A A ffaan n hhaas s ffaaiilleedd..
The <num> is the
The <num> is the power supply number.power supply number.
The <location> describes where the failed The <location> describes where the failed power supply
power supply is in the chais in the chassis. ssis. The locationThe location can be one of t
can be one of the following:he following:
ServerIron ADX 8000:
ServerIron ADX 8000:
•• BBaacck k ttoopp
•• FFrroonnt t ttoopp
•• BBaacck k MMiiddddllee
•• FFrroonnt t MMiiddddllee
•• BBaacck k bboottttoomm
•• FFrroonnt t bboottttoomm ServerIron ADX 4000:
ServerIron ADX 4000:
•• RReeaarr
•• MMiiddddllee
•• FFrroonntt
ServerIron ADX 1000:
ServerIron ADX 1000:
•• FFanans 1 s 1 to to 6 (6 (nunumbmberered ed leleftft-t-to- o-right – All in the same
right – All in the same controller)
controller) ServerIron ADX 10000:
ServerIron ADX 10000:
•• LLeefft t mmoosstt
•• SSeeccoonnd d ffrroom m lleefftt
•• TThhiirrd d ffrroom m lleefftt
•• LLaasstt A
Alleerrtt MMaannaaggeemmeennt t mmoodduulle e aat t sslloot t <<sslloott--nnuumm>>
state changed from <module-state> to state changed from <module-state> to
<module-state>.
<module-state>.
Indicates a state change
Indicates a state change in a managementin a management module.
module.
The <slot-num> indicates the chassis slot The <slot-num> indicates the chassis slot containing the module.
containing the module.
The <module-state> can be one of t The <module-state> can be one of thehe following:
following:
•• aaccttiivvee
•• ssttaannddbbyy
•• ccrraasshheedd
•• ccoommiinngg--uupp
•• uunnkknnoowwnn T
Table able 2.4: 2.4: Brocade Brocade Syslog Syslog MessagesMessages (Continued)(Continued) M
Meessssaagge e LLeevveell MMeessssaagge e FFoorrmmaatt EExxppllaannaattiioonn
A the module specifed by the
the module specifed by the <module><module>
variable.
The <warn-degrees> value is the warning The <warn-degrees> value is the warning threshold temperature configured for the
supply, need , need more power supply!!more power supply!!
Indicates that the Chassis
Indicates that the Chassis device needsdevice needs more power supplies to run the modules in more power supplies to run the modules in the chassis.
the chassis.
The <num-modules> parameter indicates The <num-modules> parameter indicates the number of modules in the chassis.
the number of modules in the chassis.
A
application that caused the buffer overflowthe buffer overflow..
A
Alleerrtt OOuut t oof f TTCCB B mmeemmoorry y aat t <<aapppplliiccaattiioonn>> IInnddiiccaattees s tthhaat t TTCCB B mmeemmoorry y iis s eexxhhaauusstteedd..
The <application> parameter shows which The <application> parameter shows which application is out
application is out of TCB memory.of TCB memory.
W
Waarrnniinngg LLoocckkeed d aaddddrreesss s vviioollaattiioon n aat t iinntteerrffaaccee e<portnum>, address <mac-address>
e<portnum>, address <mac-address>
Indicates that a port on which you have Indicates that a port on which you have configured a lock-address filter received a configured a lock-address filter received a packet that was dropped because the packet that was dropped because the packet’
packet’s source MAC address s source MAC address did not matchdid not match an address learned by the port before the an address learned by the port before the lock took effect.
lock took effect.
The e<portnum> is the por
The e<portnum> is the por t number.t number.
The <mac-address> is the MAC address that The <mac-address> is the MAC address that was denied by the address lock.
was denied by the address lock.
Assuming that you configured the port to Assuming that you configured the port to learn only the addresses
learn only the addresses that have validthat have valid access to the port, this message indicates a access to the port, this message indicates a security violation.
security violation.
W
Waarrnniinngg NNTTP sP seerrvveer r <<iipp--aaddddrr> > ffaaiilleed d tto ro reessppoonndd IInnddiiccaattees ts thhaat t a Sa Siimmpplle e NNeettwwoorrk k TTiimmee Protocol (SNTP) server did not respond to Protocol (SNTP) server did not respond to the device’s query for the current time.
the device’s query for the current time.
The <ip-addr> indicates the IP address of The <ip-addr> indicates the IP address of the SNTP server.
the SNTP server.
T
Table able 2.4: 2.4: Brocade Brocade Syslog Syslog MessagesMessages (Continued)(Continued) M
Meessssaagge e LLeevveell MMeessssaagge e FFoorrmmaatt EExxppllaannaattiioonn
W
Waarrnniinngg DDuup p IIP P <<iipp--aaddddrr> > ddeetteecctteedd, s, seennt t ffrroom m MMAACC
<mac-addr> interface <portnum>
<mac-addr> interface <portnum>
Indicates that the Brocade
Indicates that the Brocade device received adevice received a packet from another device on the network packet from another device on the network with an IP address that is also configured on with an IP address that is also configured on the Brocade device.
the Brocade device.
The <ip-addr> is the duplicate IP
The <ip-addr> is the duplicate IP address.address.
The <mac-addr> is the MAC address of the The <mac-addr> is the MAC address of the device with the duplicate IP address.
device with the duplicate IP address.
The <portnum> is the Brocade port that The <portnum> is the Brocade port that received the packet with the duplicate IP received the packet with the duplicate IP address. The address is the packet’s source address. The address is the packet’s source IP address.
Indicates that a Layer 2 MAC filter group Indicates that a Layer 2 MAC filter group configured on a port
configured on a port has denied packets.has denied packets.
The <portnum> is the port on which the The <portnum> is the port on which the packets were denied.
packets were denied.
The <mac-addr> is eth source AMC address The <mac-addr> is eth source AMC address of the denied packets.
of the denied packets.
The <num> indicates how many packets The <num> indicates how many packets matching the values above were dropped matching the values above were dropped during the five-minute interval represented
Indicates that an Access Control List (ACL) Indicates that an Access Control List (ACL) denied (dropped) packets.
denied (dropped) packets.
The <acl-num> indicates the
The <acl-num> indicates the ACL numberACL number..
Numbers 1 – 99 indicate standard ACLs.
Numbers 1 – 99 indicate standard ACLs.
Numbers 100 – 199
Numbers 100 – 199 indicate extended ACLs.indicate extended ACLs.
The <ip-proto> indicates the IP protocol of The <ip-proto> indicates the IP protocol of the denied packets.
the denied packets.
The <src-ip-addr> is the source IP address The <src-ip-addr> is the source IP address of the denied packets.
of the denied packets.
the <src-TCP/UDP-port> is the source TCP the <src-TCP/UDP-port> is the source TCP or UDP port, if applicable, of the denied or UDP port, if applicable, of the denied packets.
packets.
The <portnum> indicates the port number on The <portnum> indicates the port number on which the packet was denied.
which the packet was denied.
The <mac-addr> indicates the source MAC The <mac-addr> indicates the source MAC address of the denied packets.
address of the denied packets.
The <dst-ip-addr> indicates the destination The <dst-ip-addr> indicates the destination IP address of the
IP address of the denied packets.denied packets.
The <dst-tcp/udp-port> indicates the The <dst-tcp/udp-port> indicates the destination TCP or UDP por
destination TCP or UDP por t number, ift number, if applicable, of the denied packets.
applicable, of the denied packets.
T
Table able 2.4: 2.4: Brocade Brocade Syslog Syslog MessagesMessages (Continued)(Continued) M
Meessssaagge e LLeevveell MMeessssaagge e FFoorrmmaatt EExxppllaannaattiioonn
W
Waar nr niinngg ffiirreewwaalll l ggrroouup p <<ggrroouuppnnuumm> > bbeeccoomme e aaccttiivvee IInnddiiccaattees s tthhaat t tthhiis s SSeer vr veerrIIrroon n AADDX X hhaass become the active ServerIron ADX in the become the active ServerIron ADX in the high-availabili
high-availability (actty (active-standby) FWLBive-standby) FWLB configuration. (High-availability FWLB configuration. (High-availability FWLB configurations also are called "IronClad"
configurations also are called "IronClad"
configurations.) configurations.)
The <groupnum> is the FWLB
The <groupnum> is the FWLB group ID,group ID, which normally is 2.
which normally is 2.
W
Waarnrniinngg ffiirreewwaalll l ggrroouup p <<ggrrooupupnnuumm> > bbeeccoomme e ststaannddbbyy InInddiiccaattees s tthhaat t ththiis s SSeervrveerIrIrroon n AADDX X hhaass become the standby ServerIron ADX in the become the standby ServerIron ADX in the high-availabili
high-availability (actty (active-standby) FWLBive-standby) FWLB configuration. (High-availability FWLB configuration. (High-availability FWLB configurations also are called "IronClad"
configurations also are called "IronClad"
configurations.) configurations.)
The <groupnum> is the FWLB
The <groupnum> is the FWLB group ID,group ID, which normally is 2.
which normally is 2.
W
Waarrnniinngg ffiirreewwaalll l ppaatth h uup p ttaarrggeet t <<ttaarrggeett--iipp--aaddddrr>>
nexthop <next-hop-ip-addr> path <path-id>
nexthop <next-hop-ip-addr> path <path-id>
port <portnum>
port <portnum>
Indicates that a firewall path has
Indicates that a firewall path has come upcome up (and is therefore good).
(and is therefore good).
The <target-ip-addr> is the IP interface at the The <target-ip-addr> is the IP interface at the remote end of the path.
remote end of the path.
The <next-hop-ip-addr> is the IP interface of The <next-hop-ip-addr> is the IP interface of the next hop in the path.
the next hop in the path.
The <path-id> is the ID you assigned to the The <path-id> is the ID you assigned to the path when you configured it.
path when you configured it.
The <portnum> is the ServerIron ADX port The <portnum> is the ServerIron ADX port connected to the
connected to the path’s next hop.path’s next hop.
W
Waarrnniinngg ffiirreewwaalll l ppaatth h ddoowwn n ttaarrggeet t <<ttaarrggeett--iipp--aaddddrr>>
nexthop <next-hop-ip-addr> path <path-id>
nexthop <next-hop-ip-addr> path <path-id>
port <portnum>
port <portnum>
Indicates that a firewall path has
Indicates that a firewall path has gone downgone down (and is therefore unusable).
(and is therefore unusable).
The <target-ip-addr> is the IP interface at the The <target-ip-addr> is the IP interface at the remote end of the path.
remote end of the path.
The <next-hop-ip-addr> is the IP interface of The <next-hop-ip-addr> is the IP interface of the next hop in the path.
the next hop in the path.
The <path-id> is the ID you assigned to the The <path-id> is the ID you assigned to the path when you configured it.
path when you configured it.
The <portnum> is the ServerIron ADX port The <portnum> is the ServerIron ADX port connected to the
connected to the path’s next hop.path’s next hop.
T
Table able 2.4: 2.4: Brocade Brocade Syslog Syslog MessagesMessages (Continued)(Continued) M
Meessssaagge e LLeevveell MMeessssaagge e FFoorrmmaatt EExxppllaannaattiioonn
W
Waarrnniinngg HHTTTTP mP maattcchh--lliisst <t <mmaattcchhiinngg--lliisstt> w> wiitth sh siimmppllee pattern <string> Alert: bring server Down.
pattern <string> Alert: bring server Down.
Indicates that an HTTP content verification Indicates that an HTTP content verification health check has matched a set of selection health check has matched a set of selection criteria specified in a
criteria specified in adown simpledown simple statement.
statement.
When the selection criteria is found in the When the selection criteria is found in the HTML file used for the health check, the HTML file used for the health check, the ServerIron ADX marks port 80 (HTTP) on ServerIron ADX marks port 80 (HTTP) on the real server FAILED.
the real server FAILED.
<matching-list> is the name of the matching
<matching-list> is the name of the matching list whose selection criteria was matched.
list whose selection criteria was matched.
<string> is the selection criteria.
<string> is the selection criteria.
W
Waarrnniinngg HHTTTTP P mmaattcchh--lliisst t <<ppoolliiccyy--nnaammee> > wwiitth h ssiimmppllee pattern <string> Alert: bring server Up.
pattern <string> Alert: bring server Up.
Indicates that an HTTP content verification Indicates that an HTTP content verification health check has matched a set of selection health check has matched a set of selection criteria specified in a
criteria specified in aup simpleup simplestatement.statement.
When the selection criteria is found in the When the selection criteria is found in the HTML file used for the health check, the HTML file used for the health check, the ServerIron ADX marks port 80 (HTTP) on ServerIron ADX marks port 80 (HTTP) on the real server ACTIVE.
the real server ACTIVE.
<policy-name> is the name of the matching
<policy-name> is the name of the matching list whose selection criteria was matched.
list whose selection criteria was matched.
<string> is the selection criteria.
<string> is the selection criteria.
W
Waarrnniinngg HHTTTTP P mmaattcchh--lliisst t <<mmaattcchhiinngg--lliisstt> > wwiitthh compound pattern1 <start> and pattern2 compound pattern1 <start> and pattern2
<end> Alert: bring server down and Extract
<end> Alert: bring server down and Extract message: message: <text-between-start-and-end-pattern>
pattern>
Indicates that an HTTP content verification Indicates that an HTTP content verification health check has matched a set of selection health check has matched a set of selection criteria specified in a
criteria specified in adown compounddown compound statement.
statement.
When the selection criteria is found in the When the selection criteria is found in the HTML file used for the health check, the HTML file used for the health check, the ServerIron ADX marks port 80 (HTTP) on ServerIron ADX marks port 80 (HTTP) on the real server FAILED.
the real server FAILED.
<matching-list> is the name of the matching
<matching-list> is the name of the matching list whose selection criteria was matched.
list whose selection criteria was matched.
<start> is the beginning of the selection
<start> is the beginning of the selection criteria.
criteria.
<end> is the end of the selection criteria.
<end> is the end of the selection criteria.