Log events overview

This section provides general information about the log events described in this guide.

For more information about event logs, see the 7450 ESS, 7750 SR, 7950 XRS, and VSR System Management Guide or the 7250 IXR System Management Guide.

About log events

Log events that are forwarded to a destination are formatted in a way appropriate for the specific destination, whether recorded to a file or sent as an SNMP trap, but log events have common elements or properties. All application generated events have the following properties:

A time stamp in UTC or local time.
The generating application.
A unique event ID within the application.
A router name identifying the router instance that generated the event.
A subject identifying the affected object.
A short text description.

Note:

The Message Format String lists the log event parameters available when the log event is output in CLI using the show log command, output to a file for file-based event logs, or output to a syslog receiver. However, for some log events their parameters may vary when the event is output to SNMP destination, NETCONF destination, or triggers an EHS script. To see a complete list of a log event parameters available to EHS scripts and NETCONF notifications, use the CLI command show log event-parameters for that specific event. For further information about variables found in the message format strings, please see the associated SNMP Notification definition in the SR OS MIBs.

The general format for a log event with either a memory, console or file destination is as follows.

nnnn <time> TZONE <severity>: <application> #<event-id> <vrtr-name> <subject> 
<message>

252 2013/05/07 16:21:00.76 UTC WARNING: SNMP #2005 Base my-interface-abc 
"Interface my-interface-abc is operational"

The specific elements that compose the general format are described in Log Entry Field Descriptions.

Table 1. Log Entry Field Descriptions
Label	Description
nnnn	The log entry sequence number.
<time>	The UTC or local date stamp for the log entry in YYYY/MM/DD format followed by the UTC time stamp in HH:MM:SS.SS format. `YYYY —` Year `MM —` Month `DD —` Date `HH` — Hour `MM` — Minute `SS.SS` — Seconds
TZONE	The time zone (for example, UTC, EDT) as configured by configure log log-id `x` time-format.
<severity>	The severity level of the event: CRITICAL — A critical severity event MAJOR — A major severity event MINOR — A minor severity event WARNING — A warning severity event CLEARED — A cleared event INDETERMINATE — An indeterminate/informational severity event Note: The term "INFO" may appear in messages in management interfaces indicating a situation that is less impactful than a "WARNING", or a situation that has an indeterminate impact, but "INFO" is not a log event severity in SR OS.
<application>	The name of the application generating the log message.
<event-id>	The application event ID number.
<vrtr-name>	The router name (vrtr-name, for example, vprn101 or Base), in a format used by the logging system, representing the router instance that generated the event.
<subject>	The subject/affected object for the event.
<message>	A text description of the event for CLI (show log), log files and syslog output. The variables in the <message> string do not necessarily apply to SNMP, NETCONF or EHS scripts. For the list of variables available to EHS scripts and NETCONF notifications, use the CLI command show log event-parameters. For further information about variables found in the <message> strings, please see the associated SNMP Notification definition in the SR OS MIBs.

Sample log event

cli_config_io properties contains a sample log event entry from this guide for the cli_config_io log event.

Table 2. cli_config_io properties
Property name	Value
Application name	USER
Event ID	2011
Event name	cli_config_io
SNMP notification prefix and OID	N/A
Default severity	minor
Source stream	change
Message format string	User from $srcAddr$: $prompt$ $message$
Cause	The user entered an authorized configuration command in the classic CLI.
Effect	The configuration was changed by the CLI command.
Recovery	No recovery is required

The table title for a log event entry is the event name. Each entry contains the information described in Log Entry Field Descriptions .

Table 3. Log Entry Field Descriptions
Label	Description
Application name	The name of the application generating the log message.
Event id	The application event ID number.
Event name	The name of the event.
SNMP notification prefix and OID	The prefix and OID of the SNMP notification associated with the log event, or "N/A" for event types that do not generate an associated SNMP notification.
Default severity	The default severity level of the event. CRITICAL MAJOR MINOR WARNING INFO CLEARED
Source stream	The event source. main security change debug li
Message format string	A text description of the event for CLI (show log), log files and syslog output. The variables in the 'Message format string' do not necessarily apply to SNMP, NETCONF or EHS scripts. For the list of variables available to EHS scripts and NETCONF notifications, use the CLI command show log event-parameters. For further information about variables found in the 'Message format string', please see the associated SNMP Notification definition in the SR OS MIBs.
Cause	The cause of the event.
Effect	The effect of the event.
Recovery	How to recover from this event, if necessary.