![Cisco ASR 9000 Serie Configuration Manuals Download Page 52](http://html.mh-extra.com/html/cisco/asr-9000-serie/asr-9000-serie_configuration-manuals_66679052.webp)
#12.3 :nodestatus:RP/0/0/CPU0:Aug
2 22:32:44 : alphadisplay[102]:
%PLATFORM-ALPHA_DISPLAY-6-CHANGE : Alpha display on node 0/1/CPU0 changed to IOX RUN
in
state default
Because this rule was defined as nonstateful, these messages are held in the buffer
indefinitely.
Configuring a Stateful Correlation Rule for LINK UPDOWN and SONET ALARM
Alarms: Example
This example shows how to configure a correlation rule for the LINK UPDOWN and SONET ALARM
messages:
!
logging correlator rule updown type stateful
timeout 10000
rootcause PKT_INFRA LINK UPDOWN
nonrootcause
alarm L2 SONET ALARM
!
!
logging correlator apply rule updown
all-of-router
!
In this example, suppose that two routers are connected. When the correlator receives a root-cause message,
the correlator sends it directly to the syslog process. Subsequent PKT_INFRA-LINK- UPDOWN or
L2-SONET-ALARM messages matching the rule are considered leaf messages and are stored in the logging
correlator buffer. If, for any reason, a leaf message (such as the L2-SONET-ALARM alarm in this example)
is received first, the correlator does not send it to the logging events buffer immediately; the correlator, instead,
waits until the timeout interval expires. After the timeout, if the root message is never received, all messages
in the logging correlator buffer received during the timeout interval are forwarded to the syslog process.
In this example, the correlation rule named updown is configured to correlate the
PKT_INFRA-LINK-UPDOWN alarm (the root message) and L2-SONET-ALARM alarms (leaf messages
associated with PKT_INFRA-LINK-UPDOWN alarms).
logging correlator rule updown type stateful
timeout 10000
rootcause PKT_INFRA LINK UPDOWN
nonrootcause
alarm L2 SONET ALARM
In this example, the updown correlation rule is applied to the entire router:
logging correlator apply rule updown
all-of-router
This example shows sample output from the
show logging events buffer all-in-buffer
command. The output
displays the alarms stored in the logging events buffer after the one minute time period expires for the updown
correlation rule configured:
RP/0/RSP0/CPU0:router#
show logging events buffer all-in-buffer
#ID :C_id:Source :Time :%CATEGORY-GROUP-SEVERITY-MESSAGECODE: Text
#144 :46 :LC/0/7/CPU0:Jan 30 16:35:39 2004:ifmgr[130]: %PKT_INFRA-LINK-3-UPDOWN :
Interface POS0/7/0/0, changed state to Down
Only the first LINK UPDOWN root message is forwarded to the syslog process during the timeout interval.
Note
Cisco ASR 9000 Series Aggregation Services Router System Monitoring Configuration Guide, Release 4.2.x
36
Implementing and Monitoring Alarms and Alarm Log Correlation
Configuring a Stateful Correlation Rule for LINK UPDOWN and SONET ALARM Alarms: Example