Table Of Contents

Alarm Management and Logging Correlation Commands on Cisco IOS XR Software

clear logging correlator delete

clear logging events delete

clear logging events reset

context-correlation

logging correlator apply rule

logging correlator apply ruleset

logging correlator buffer-size

logging correlator rule

logging correlator ruleset

logging events buffer-size

logging events level

logging events threshold

nonrootcause

reissue-nonbistate

reparent

rootcause

show logging correlator buffer

show logging correlator info

show logging correlator rule

show logging correlator ruleset

show logging events buffer

show logging events info

timeout

timeout-rootcause

Alarm Management and Logging Correlation Commands on Cisco IOS XR Software

---

This chapter describes the commands used to manage alarms and configure logging correlation rules.

From the Cisco IOS XR System Monitoring Configuration Guide, you can obtain detailed information about the following:

•For alarm management and logging correlation concepts, configuration tasks, and examples, refer to the Implementing and Monitoring Alarms and Logging Correlation on Cisco IOS XR Software module.

•For system logging commands, refer to the Logging Commands on Cisco IOS XR Software module.

•For system logging concepts, refer to the Implementing Logging Services on Cisco IOS XR Software module.

clear logging correlator delete

To delete all messages or messages specified by a correlation ID from the logging correlator buffer, use the clear logging correlator delete command in EXEC mode.

clear logging correlator delete {all-in-buffer | correlation-id}

Syntax Description

all-in-buffer	Clears all messages in the logging correlator buffer.
correlation-id	Correlation event record ID. Up to 14 correlation IDs can be specified, separated by a space. Range is from 0 to 4294967294.

Command Modes

EXEC

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was first supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.
Release 3.4.0	No modification.
Release 3.5.0	No modification.
Release 3.6.0	No modification.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the show logging correlator buffer command to confirm that records have been cleared.

Task ID

Task ID	Operations
logging	execute

Examples

The following example shows how to clear all records from the logging correlator buffer:

RP/0/RP0/CPU0:router# clear logging correlator delete all-in-buffer

Related Commands

Command	Description
show logging correlator buffer	Displays messages in the logging correlator buffer.

clear logging events delete

To delete messages from the logging events buffer, use the clear logging events delete command in EXEC mode.

clear logging events delete {[admin-level-only] [all-in-buffer] [bistate-alarms-set] [category name] [context name] [event-hi-limit event-id] [event-lo-limit event-id] [first event-count] [group message-group] [last event-count] [location node-id] [message message-code] [severity-hi-limit severity] [severity-lo-limit severity] [timestamp-hi-limit hh:mm:ss [month] [day] [year] [timestamp-lo-limit hh:mm:ss [month] [day] [year]}

Syntax Description

admin-level-only	Deletes only events at the administrative level.
all-in-buffer	Deletes all event IDs from the logging events buffer.
bistate-alarms-set	Deletes bi-state alarms in the SET state.
category name	Deletes events from a specified category.
context name	Deletes events from a specified context.
event-hi-limit event-id	Deletes events with an event ID equal to or lower than the event ID specified with the event-id argument. Range is from 0 to 4294967294.
event-lo-limit event-id	Deletes events with an event ID equal to or higher than the event ID specified with the event-id argument. Range is from 0 to 4294967294.
first event-count	Deletes events, beginning with the first event in the logging events buffer. For the event-count argument, enter the number of events to be deleted.
group message-group	Deletes events from a specified message group.
last event-count	Deletes events, beginning with the last event in the logging events buffer. For the event-count argument, enter the number of events to be deleted.
location node-id	Deletes messages from the logging events buffer for the specified location. The node-id argument is entered in the rack/slot/module notation.
message message-code	Deletes events with the specified message code.
severity-hi-limit	Deletes events with a severity level equal to or lower than the severity level specified with the severity argument.
severity	Severity level. Valid values are: •emergencies •alerts •critical •errors •warnings •notifications •informational Note Settings for the severity levels and their respective system conditions are listed under the "Usage Guidelines" section for the logging events level command. Events of lower severity level represent events of higher importance.
severity-lo-limit	Deletes events with a severity level equal to or higher than the severity level specified with the severity argument.
timestamp-hi-limit	Deletes events with a time stamp equal to or lower than the specified time stamp.
hh:mm:ss [month] [day] [year]	Time stamp for the timestamp-hi-limit or timestamp-lo-limit keyword. The month, day, and year arguments default to the current month, day, and year, if not specified. The ranges for the hh:mm:ss month day year arguments are as follows: •hh:—Hours. Range is 00 to 23. You must insert a colon after the hh argument. •mm:—Minutes. Range is 00 to 59. You must insert a colon after the mm argument. •ss—Seconds. Range is 00 to 59. •month—(Optional) The month of the year. The values for the month argument are: –january –february –march –april –may –june –july –august –september –october –november –december •day—(Optional) Day of the month. Range is from 01 to 31. •year—(Optional) Year. Enter the last two digits of the year (for example, 04 for 2004). Range is from 01 to 37.
timestamp-lo-limit	Deletes events with a time stamp equal to or higher than the specified time stamp.

Command Modes

EXEC

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was first supported on the Cisco XR 12000 Series Router. Support was introduced for the admin-level-only keyword option.
Release 3.3.0	No modification.
Release 3.4.0	No modification.
Release 3.5.0	No modification.
Release 3.6.0	No modification.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

This command is used to delete messages from the logging events buffer that match the keywords and arguments that you specify. The description is matched if all of the conditions are met.

Use the show logging events buffer command to verify that events have been cleared from the logging events buffer.

Task ID

Task ID	Operations
logging	execute

Examples

The following example shows how to delete all messages from the logging events buffer:

RP/0/RP0/CPU0:router# clear logging events delete all-in-buffer

Related Commands

Command	Description
clear logging events reset	Resets bi-state alarms.
show logging events buffer	Displays messages in the logging events buffer.

clear logging events reset

To reset bi-state alarms, use the clear logging events reset command in EXEC mode.

clear logging events reset {all-in-buffer | event-id}

Syntax DescriptionDescription

all-in-buffer	Resets all bi-state alarm messages in the event logging buffer.
event-id	Event ID. Resets the bi-state alarm for an event or events. Up to 32 event IDs can be specified, separated by a space. Range is from 0 to 4294967294.

Usage

Command Modes

EXEC

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was first supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.
Release 3.4.0	No modification.
Release 3.5.0	No modification.
Release 3.6.0	No modification.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

This command clears bi-state alarms messages from the logging events buffer. Bi-state alarms are generated by state changes associated with system hardware, such as a change of interface state from active to inactive, or the online insertion and removal (OIR) of a Modular Service Card (MSC), or a change in component temperature.

Use the show logging events buffer command to display messages in the logging events buffer.

Task ID

Task ID	Operations
logging	execute

Examples

The following example shows how to reset all bi-alarms in the logging events buffer:

RP/0/RP0/CPU0:router# clear logging events reset all-in-buffer

Related Commands

Command	Description
clear logging events delete	Deletes all bi-state alarm messages, or messages specified by correlation ID, from the logging events buffer.
show logging events buffer	Displays messages in the logging events buffer.

context-correlation

To enable context-specific correlation, use the context-correlation command in either stateful or nonstateful correlation rule configuration mode. To disable correlation on context, use the no form of this command.

context-correlation

no context-correlation

Syntax Description

This command has no arguments or keywords.

Defaults

Correlation on context is not enabled.

Command Modes

Stateful correlation rule configuration
Nonstateful correlation rule configuration

Command History

Release	Modification
Release 3.6.0	This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

This command enables context-specific correlation for each of the contexts in which a given rule is applied. For example, if the rule is applied to two contexts (context1 and context2), messages that have context "context1" are correlated separately from those messages with context "context2".

Use the show logging correlator rule command to show the current setting for the context-correlation flag.

Task ID

Task ID	Operations
logging	read, write

Examples

The following example shows how to enable correlation on context for a stateful correlation rule:

RP/0/RP0/CPU0:router(config)# logging correlator rule stateful_rule type stateful

RP/0/RP0/CPU0:router(config-corr-rule-st)# context-correlation

RP/0/RP0/CPU0:router(config-corr-rule-st)#

Related Commands

Command	Description
logging correlator rule	Defines the rules for correlating messages.
show logging correlator rule	Displays one or more predefined logging correlator rules.

logging correlator apply rule

To apply and activate a correlation rule and enter correlation apply rule configuration mode, use the logging correlator apply rule command in global configuration mode. To deactivate a correlation rule, use the no form of this command.

logging correlator apply rule correlation-rule [all-of-router | context name | location node-id]

no logging correlator apply rule correlation-rule [all-of-router | context name | location node-id]

Syntax Description

correlation-rule	Name of the correlation rule to be applied.
all-of-router	(Optional) Applies the correlation rule to the entire router.
context name	(Optional) Applies the correlation rule to the specified context. Unlimited number of contexts. The name string is limited to 32 characters.
location node-id	(Optional) Applies the correlation rule to the specified node. The node-id argument is entered in the rack/slot/module notation. Unlimited number of locations.

Defaults

No correlation rules are applied.

Command Modes

Global configuration

Command History

Release	Modification
Release 3.6.0	This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

The logging correlator apply rule command is used to either add or remove apply settings for a given rule. These settings then determine which messages are correlated for the affected rules.

If the rule is applied to all-of-router, then correlation occurs for only those messages that match the configured cause values for the rule to be correlated, regardless of the context or location setting of that message.

If a rule is applied to a specific set of contexts or locations, then correlation occurs for only those messages that match both the configured cause values for the rule and at least one of those contexts or locations.

Use the show logging correlator rule command to show the current apply settings for a given rule.

---

Tip When a rule is applied (or if a rule set that contains this rule is applied), then the rule definition cannot be modified through the configuration until the rule or rule set is once again unapplied.

---

---

Tip It is possible to configure apply settings at the same time for both a rule and zero or more rule sets that contain the rule. In this case, the apply settings for the rule are the union of all the apply configurations.

---

The logging correlator apply rule command allows you to enter submode (config-corr-apply-rule) to apply and activate rules:

RP/0/RP0/CPU0:router(config)# logging correlator apply rule stateful1 

RP/0/RP0/CPU0:router(config-corr-apply-rule)#?

  all-of-router  Apply the rule to all of the router

  clear          Clear the uncommitted configuration

  clear          Clear the configuration

  commit         Commit the configuration changes to running

  context        Apply rule to specified context

  describe       Describe a command without taking real actions

  do             Run an exec command

  exit           Exit from this submode

  location       Apply rule to specified location

  no             Negate a command or set its defaults

  pwd            Commands used to reach current submode

  root           Exit to the global configuration mode

  show           Show contents of configuration

RP/0/RP0/CPU0:router(config-corr-apply-rule)#

While in the submode, you can negate keyword options:

RP/0/RP0/CPU0:router(config-corr-apply-rule)#? no all-of-router

RP/0/RP0/CPU0:router(config-corr-apply-rule)#? no context

RP/0/RP0/CPU0:router(config-corr-apply-rule)#? no location

Task ID

Task ID	Operations
logging	read, write

Examples

The following example shows how to apply a predefined correlator rule to a location:

RP/0/RP0/CPU0:router(config)# logging correlator apply rule rule1

RP/0/RP0/CPU0:router(config-corr-apply-rule)# location 0/2/CPU0

Related Commands

Command	Description
logging correlator rule	Defines the rules for correlating messages.
show logging correlator rule	Displays one or more predefined logging correlator rules.
show logging correlator ruleset	Displays one or more predefined logging correlator rule sets.

logging correlator apply ruleset

To apply and activate a correlation rule set and enter correlation apply rule set configuration mode, use the logging correlator apply ruleset command in global configuration mode. To deactivate a correlation rule set, use the no form of this command.

logging correlator apply ruleset correlation-ruleset [all-of-router | context name | location node-id]

no logging correlator apply ruleset correlation-ruleset [all-of-router | context name | location node-id]

Syntax Description

correlation-ruleset	Name of the correlation rule set to be applied.
all-of-router	(Optional) Applies the correlation rule set to the entire router.
context name	(Optional) Applies the correlation rule set to the specified context. Unlimited number of contexts. The name string is limited to 32 characters.
location node-id	(Optional) Applies the correlation rule to the specified node. The node-id argument is entered in the rack/slot/module notation. Unlimited number of locations.

Defaults

No correlation rule sets are applied.

Command Modes

Global configuration

Command History

Release	Modification
Release 3.6.0	This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

The logging correlator apply ruleset command is used to either add or remove apply settings for a given rule set. These settings then determine which messages are correlated for the affected rules.

If the rule set is applied to all-of-router, then correlation occurs for only those messages that match the configured cause values for the rule to be correlated, regardless of the context or location setting of that message.

If a rule set is applied to a specific set of contexts or locations, then correlation occurs for only those messages that match both the configured cause values for the rule and at least one of those contexts or locations.

Use the show logging correlator ruleset command to show the current apply settings for a given rule set.

---

Tip When a rule is applied (or if a rule set that contains this rule is applied), then the rule definition cannot be modified through the configuration until the rule or rule set is once again unapplied.

---

---

Tip It is possible to configure apply settings at the same time for both a rule and zero or more rule sets that contain the rule. In this case, the apply settings for the rule are the union of all the apply configurations.

---

The logging correlator apply ruleset command allows you to enter the submode (config-corr-apply-ruleset) to apply and activate rule sets:

RP/0/RP0/CPU0:router(config)# logging correlator apply ruleset ruleset1 

RP/0/RP0/CPU0:router(config-corr-apply-ruleset)#?

  all-of-router  Apply the rule to all of the router

  clear          Clear the uncommitted configuration

  clear          Clear the configuration

  commit         Commit the configuration changes to running

  context        Apply rule to specified context

  describe       Describe a command without taking real actions

  do             Run an exec command

  exit           Exit from this submode

  location       Apply rule to specified location

  no             Negate a command or set its defaults

  pwd            Commands used to reach current submode

  root           Exit to the global configuration mode

  show           Show contents of configuration

RP/0/RP0/CPU0:router(config-corr-apply-ruleset)#

While in the submode, you can negate keyword options:

RP/0/RP0/CPU0:router(config-corr-apply-ruleset)#? no all-of-router

RP/0/RP0/CPU0:router(config-corr-apply-ruleset)#? no context

RP/0/RP0/CPU0:router(config-corr-apply-ruleset)#? no location

Task ID

Task ID	Operations
logging	read, write

Examples

The following example shows how to apply a predefined correlator rule set to the entire router:

RP/0/RP0/CPU0:router(config)# logging correlator apply ruleset ruleset1

RP/0/RP0/CPU0:router(config-corr-apply-rule)# all-of-router

Related Commands

Command	Description
show logging correlator ruleset	Displays one or more predefined logging correlator rule sets.

logging correlator buffer-size

To configure the logging correlator buffer size, use the logging correlator buffer-size command in global configuration mode. To return the buffer size to its default setting, use the no form of this command.

logging correlator buffer-size bytes

no logging correlator buffer-size bytes

Syntax Description

bytes

The size, in bytes, of the circular buffer. The range is from 1024 bytes to 52428800 bytes.

Defaults

bytes: 81920 bytes

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was first supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.
Release 3.4.0	No modification.
Release 3.5.0	No modification.
Release 3.6.0	No modification.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

The logging correlator buffer-size command configures the size of the correlation buffer. This buffer holds all the correlation records as well as the associated correlated messages. When the size of this buffer is exceeded, older correlations in the buffer are replaced with the newer incoming correlations. The criteria that are used to recycle these buffers are:

•First, remove the oldest non-stateful correlation records from the buffer.

•Then, if there are no more non-stateful correlations present; remove the oldest stateful correlation records.

Use the show logging correlator info command to confirm the size of the buffer and the percentage of buffer space that is currently used. The show logging events buffer all-in-buffer command can be used to show the details of the buffer contents.

Task ID

Task ID	Operations
logging	read, write

Examples

The following example shows how to set the logging correlator buffer size to 90000 bytes:

RP/0/RP0/CPU0:router(config)# logging correlator buffer-size 90000

Related Commands

Command	Description
show logging correlator info	Displays the logging correlator buffer size and the percentage of the buffer occupied by correlated messages

logging correlator rule

To define the rules for correlating messages, use the logging correlator rule command in global configuration mode. To delete the correlation rule, use the no form of this command.

logging correlator rule correlation-rule {type {stateful | nonstateful}}

no logging correlator rule correlation-rule

Syntax Description

correlation-rule	Name of the correlation rule to be applied.
type	Specifies the type of rule.
stateful	Enters stateful correlation rule configuration mode.
nonstateful	Enters nonstateful correlation rule configuration mode.

Defaults

No rules are defined.

Command Modes

Global configuration

Command History

Release	Modification
Release 3.6.0	This command was introduced on the Cisco CRS-1 and the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

The logging correlator rule command defines the correlation rules used by the correlator to store messages in the logging correlator buffer. A rule must, at a minimum, consist of three elements: a root-cause message, one or more non-root-cause messages, and a timeout.

When the root-cause message, or a non-root-cause message is received, the timer is started. Any non-root-cause messages are temporarily held, while the root-cause is sent to syslog. If, after the timer has expired, the root-cause and at least one non-root-cause message was received, a correlation is created and stored in the correlation buffer.

A rule can be of type stateful or nonstateful. Stateful rules allow non-root-cause messages to be sent from the correlation buffer if the bi-state root-cause alarm clears at a later time. Non-stateful rules result in correlations that are fixed and immutable after the correlation occurs.

Below are the rule parameters that are available while in stateful correlation rule configuration mode:

RP/0/RP0/CPU0:router(config-corr-rule-st)# ?

  context-correlation  Specify enable correlation on context

  nonrootcause         nonrootcause alarm

  reissue-nonbistate   Specify reissue of non-bistate alarms on parent clear

  reparent             Specify reparent of alarm on parent clear

  rootcause            Specify root cause alarm: Category/Group/Code combos

  timeout              Specify timeout

  timeout-rootcause    Specify timeout for root-cause

RP/0/RP0/CPU0:routerconfig-corr-rule-st)#

Below are the rule parameters that are available while in non-stateful correlation rule configuration mode:

RP/0/RP0/CPU0:router(config-corr-rule-nonst)# ?

  context-correlation  Specify enable correlation on context

  nonrootcause         nonrootcause alarm

  root                 Exit to the global configuration mode

  rootcause            Specify root cause alarm: Category/Group/Code combos

  timeout              Specify timeout

  timeout-rootcause    Specify timeout for root-cause

RP/0/RP0/CPU0:router(config-corr-rule-nonst)#

---

Note A rule cannot be deleted or modified while it is applied, so the no logging correlator apply command must be used to unapply the rule before it can be changed.

---

---

Note The name of the correlation rule must be unique across all rule types and is limited to a maximum length of 32 characters.

---

Use the show logging correlator buffer to display messages stored in the logging correlator buffer.

Use the show logging correlator rule command to verify correlation rule settings.

Task ID

Task ID	Operations
logging	read, write

Examples

The following example shows how to enter stateful correlation rule configuration mode to specify a collection duration period time for correlator messages sent to the logging events buffer:

RP/0/RP0/CPU0:router(config)# logging correlator rule state_rule type stateful

RP/0/RP0/CPU0:router(config-corr-rule-st)# timeout 50000

Related Commands

Command	Description
logging correlator apply rule	Applies and activates correlation rules.
nonrootcause	Enters non-root-cause configuration mode and specifies a non-root-cause alarm
reissue-nonbistate	Reissues non-bistate alarm messages (events) from the correlator log after its root-cause alarm clears.
reparent	Reparents non-root-cause messages to the next highest active root-cause in a hierarchical correlation when their immediate parent clears.
rootcause	Specifies a root-cause message alarm.
show logging correlator buffer	Displays messages in the logging correlator buffer.
show logging correlator rule	Displays one or more predefined logging correlator rules.
timeout	Specifies the collection period duration time for the logging correlator rule message.
timeout-rootcause	Specifies an optional parameter for an applied correlation rule.

logging correlator ruleset

To enter correlation rule set configuration mode and define a correlation rule set, use the logging correlator ruleset command in global configuration mode. To delete the correlation rule set, use the no form of this command.

logging correlator ruleset correlation-ruleset {rulename correlation-rulename}

no logging correlator ruleset correlation-ruleset

Syntax Description

correlation-ruleset	Name of the correlation rule set to be applied.
rulename	Specifies the correlation rule name.
correlation-rulename	Name of the correlation rule name to be applied.

Defaults

No rule sets are defined.

Command Modes

Global configuration

Command History

Release	Modification
Release 3.6.0	This command was introduced on the Cisco CRS-1 and the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

The logging correlator ruleset command defines a specific correlation rule set. A rule set name must be unique and is limited to a maximum length of 32 characters.

To apply a logging correlator rule set, use the logging correlator apply ruleset command.

Examples

The following example shows how to specify a logging correlator rule set:

RP/0/RP0/CPU0:router(config)# logging correlator ruleset ruleset_1

RP/0/RP0/CPU0:router(config-corr-ruleset)# rulename state_rule

RP/0/RP0/CPU0:router(config-corr-ruleset)# rulename state_rule2

Related Commands

Command	Description
logging correlator apply ruleset	Applies and activates a correlation rule set and enters correlation apply rule set configuration mode.
show logging correlator buffer	Displays messages in the logging correlator buffer.
show logging correlator ruleset	Displays defined correlation rule set names

logging events buffer-size

To configure the size of the logging events buffer, use the logging events buffer-size command in global configuration mode. To restore the buffer size to the default value, use the no form of this command.

logging events buffer-size bytes

no logging events buffer-size bytes

Syntax Description

bytes

The size, in bytes, of the logging events buffer. The range is from 1024 bytes to 1024000 bytes. The default is 43200 bytes.

Defaults

bytes: 43200

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was first supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.
Release 3.4.0	No modification.
Release 3.5.0	No modification.
Release 3.6.0	No modification.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

---

Note The logging events buffer automatically adjusts to a multiple of the record size that is lower than or equal to the value configured for the bytes argument.

---

Use the show logging events info command to confirm the size of the logging events buffer.

Task ID

Task ID	Operations
logging	read, write

Examples

The following example shows how to increase the logging events buffer size to 50000 bytes:

RP/0/RP0/CPU0:router(config)# logging events buffer-size 50000

Related Commands

Command	Description
logging events level	Specifies a severity level for logging alarm messages.
logging events threshold	Specifies the event logging buffer capacity threshold that, when surpassed, will generate an alarm.
show logging correlator info	Displays information about the size of the logging correlator buffer and available capacity.
show logging events buffer	Displays messages in the logging events buffer.
show logging events info	Displays configuration and operational messages about the logging events buffer.

logging events level

To specify a severity level for logging alarm messages, use the logging events level command in global configuration mode. To return to the default value, use the no form of this command.

logging events level severity

no logging events level

Syntax Description

severity

Severity level of events to be logged in the logging events buffer, including events of a higher severity level (numerically lower). Table 1 lists severity levels and their respective system conditions.

Defaults

All severity levels (from 0 to 6) are logged.

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was first supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.
Release 3.4.0	No modification.
Release 3.5.0	No modification.
Release 3.6.0	No modification.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

This command specifies the event severity necessary for alarm messages to be logged. Severity levels can be specified by the severity level description (for example, warnings). When a severity level is specified, events of equal or lower severity level are also written to the logging events buffer.

---

Note Events of lower severity level represent events of higher importance.

---

Table 1 lists the system severity levels and their corresponding numeric values, and describes the corresponding system condition.

Table 1 Alarm Severity Levels for Event Logging 

Severity Level Keyword	Numeric Value	Logged System Messages
emergencies	0	System is unusable.
alerts	1	Critical system condition exists requiring immediate action.
critical	2	Critical system condition exists.
errors	3	Noncritical errors.
warnings	4	Warning conditions.
notifications	5	Notifications of changes to system configuration.
informational	6	Information about changes to system state.

Task ID

Task ID	Operations
logging	read, write

Examples

The following example shows how to set the severity level for notification to warnings (level 4):

RP/0/RP0/CPU0:router(config)# logging events level warnings 

Related Commands

Command	Description
logging events buffer-size	Specifies the logging events buffer size.
logging events threshold	Specifies the logging events buffer capacity threshold that, when surpassed, will generate an alarm.

logging events threshold

To specify the logging events buffer threshold that, when surpassed, generates an alarm, use the logging events threshold command in global configuration mode. To return to the default value, use the no form of this command.

logging events