Management and Configuration Guide K/KA/KB.15.15

Turning event numbering on
Syntax
[ no ] log-numbers
Turns event numbering on and off
Using log throttling to reduce duplicate Event Log and SNMP messages
A recurring event can generate a series of duplicate Event Log messages and SNMP traps in a
relatively short time. As a result, the Event Log and any configured SNMP trap receivers may be
flooded with excessive, exactly identical messages. To help reduce this problem, the switch uses
log throttle periods to regulate (throttle) duplicate messages for recurring events, and maintains a
counter to record how many times it detects duplicates of a particular event since the last system
reboot.
When the first instance of a particular event or condition generates a message, the switch initiates
a log throttle period that applies to all recurrences of that event. If the logged event recurs during
the log throttle period, the switch increments the counter initiated by the first instance of the event,
but does not generate a new message.
If the logged event repeats again after the log throttle period expires, the switch generates a
duplicate of the first message, increments the counter, and starts a new log throttle period during
which any additional instances of the event are counted, but not logged. Thus, for a particular
recurring event, the switch displays only one message in the Event Log for each log throttle period
in which the event reoccurs. Also, each logged instance of the event message includes counter
data showing how many times the event has occurred since the last reboot. The switch manages
messages to SNMP trap receivers in the same way.
Log throttle periods
The length of the log throttle period differs according to an event's severity level:
Log throttle periodSeverity level
6000 SecondsI (Information)
600 SecondsW (Warning)
60 SecondsD (Debug)
6 SecondsM (Major)
Example
Suppose that you configure VLAN 100 on the switch to support PIM operation, but
do not configure an IP address. If PIM attempts to use VLAN 100, the switch
generates the first instance of the following Event Log message and counter.
Example 113 The first instance of an event message and counter
The counter (1) indicates that this is the first instance of this event since the switch
last rebooted.
W 10/01/12 09:00:33 PIM:No IP address configured on VID 100 (1)
If PIM operation causes the same event to occur six more times during the initial
log throttle period, there are no further entries in the Event Log. However, if the
event occurs again after the log throttle period has expired, the switch repeats the
message (with an updated counter) and starts a new log throttle period.
Unusual network activity 393