Title | Size | Downloads |
---|---|---|
H3C S6800 Switch Series System Log Messages Reference-6W100-book.pdf | 2.71 MB |
- Table of Contents
- Related Documents
-
|
H3C S6800 Switch Series |
|
Document version: 6W100-20171220
Copyright © 2017 New H3C Technologies Co., Ltd. All rights reserved. No part of this manual may be reproduced or transmitted in any form or by any means without prior written consent of New H3C Technologies Co., Ltd. The information in this document is subject to change without notice. |
|
Contents
Managing and obtaining system log messages
Obtaining log messages from the console terminal
Obtaining log messages from the log buffer
Obtaining log messages from a monitor terminal
Obtaining log messages from the log file
Obtaining log messages from a log host
ACL_ACCELERATE_NONCONTIGUOUSMASK
ACL_ACCELERATE_NOT_SUPPORTHOPBYHOP
ACL_ACCELERATE_NOT_SUPPORTMULTITCPFLAG
PFILTER_VLAN_IPV4_DACT_UNK_ERR
PFILTER_VLAN_IPV6_DACT_UNK_ERR
APMGR_CWC_IMG_DOWNLOAD_COMPLETE
APMGR_CWC_RUN_DOWNLOAD_COMPLETE
APMGR_CWS_IMG_DOWNLOAD_COMPLETE
APMGR_CWS_RUN_DOWNLOAD_COMPLETE
ARP_ACTIVE_ACK_NOREQUESTED_REPLY
ATK_ICMPV6_DEST_UNREACH_RAW_SZ
ATK_ICMPV6_GROUPREDUCTION_RAW_SZ
ATK_ICMPV6_PACKETTOOBIG_RAW_SZ
ATK_IP4_TCP_INVALIDFLAGS_RAW_SZ
ATK_IP6_TCP_INVALIDFLAGS_RAW_SZ
ATK_IPOPT_LOOSESRCROUTE_RAW_SZ
ATK_IPOPT_STRICTSRCROUTE_RAW_SZ
DOT1X_LOGIN_SUCC (in open mode)
DOT1X_LOGOFF_ABNORMAL (in open mode)
DOT1X_NOTENOUGH_EADFREERULE_RES
DOT1X_NOTENOUGH_EADMACREDIR_RES
DOT1X_NOTENOUGH_EADPORTREDIR_RES
DOT1X_NOTENOUGH_ENABLEDOT1X_RES
DRNI_IFEVENT_DR_PEER_NOSELECTED
DRNI_KEEPALIVEINTERVAL_MISMATCH
DRNI_SYSEVENT_DEVICEROLE_CHANGE
EDEV_FAILOVER_GROUP_STATE_CHANGE
ETHOAM_CONNECTION_FAIL_TIMEOUT
ETHOAM_CONNECTION_FAIL_UNSATISF
ETHOAM_ENTER_LOOPBACK_CTRLLING
ETHOAM_LOCAL_ERROR_FRAME_PERIOD
ETHOAM_LOCAL_ERROR_FRAME_SECOND
ETHOAM_LOOPBACK_EXIT_ERROR_STATU
ETHOAM_REMOTE_ERROR_FRAME_PERIOD
ETHOAM_REMOTE_ERROR_FRAME_SECOND
FCLINK_FDISC_REJECT_NORESOURCE
FCLINK_FLOGI_REJECT_NORESOURCE
FCOE_INTERFACE_NOTSUPPORT_FCOE
FCOE_FIPS_HARD_RESOURCE_NOENOUGH
FCOE_FIPS_HARD_RESOURCE_RESTORE
IF_BUFFER_CONGESTION_OCCURRENCE
L2PT_CREATE_TUNNELGROUP_FAILED
LAGG_INACTIVE_RESOURCE_INSUFICIE
LLDP_NEIGHBOR_PROTECTION_BLOCK
LLDP_NEIGHBOR_PROTECTION_UNBLOCK
MAC_VLAN_LEARNLIMIT_NORESOURCE
MAC_VLAN_LEARNLIMIT_NOTSUPPORT
MACA_LOGIN_SUCC (in open mode)
NAT_SERVICE_CARD_RECOVER_FAILURE
ND_SET_VLAN_REDIRECT_NORESOURCE
OFP_FLOW_ADD_TABLE_MISS_FAILED
OFP_FLOW_DEL_TABLE_MISS_FAILED
OFP_FLOW_MOD_TABLE_MISS_FAILED
PEX_AUTOCONFIG_BAGG_ASSIGNMEMBER
PEX_AUTOCONFIG_BAGG_NORESOURCE
PEX_AUTOCONFIG_BAGG_REMOVEMEMBER
PEX_AUTOCONFIG_CAPABILITY_ENABLE
PEX_AUTOCONFIG_CONNECTION_ERROR
PEX_AUTOCONFIG_DIFFGROUPNUMBER
PEX_AUTOCONFIG_DYNAMICBAGG_STP
PEX_AUTOCONFIG_NONUMBERRESOURCE
PEX_AUTOCONFIG_NOT_CASCADEPORT
PORTSEC_PORTMODE_NOT_EFFECTIVE
QOS_QMPROFILE_MODIFYQUEUE_FAIL
RPR_PROTECTION_INCONSISTENT_OVER
RPR_TOPOLOGY_INCONSISTENT_OVER
STAMGR_AUTHORUSERPROFILE_FAILURE
Introduction
This document includes the following system messages:
· Messages specific to Release 2609 of the switch.
· Messages for the Comware 7 software platform version based on which Release 2609 was produced. Some platform system messages might not be available on the switch.
This document is intended only for managing S6800 switches. Do not use this document for any other device models.
This document assumes that the readers are familiar with data communications technologies and H3C networking products.
System log message format
By default, the system log messages use one of the following formats depending on the output destination:
· Log host:
<PRI>TIMESTAMP Sysname %%vendorMODULE/severity/MNEMONIC: location; CONTENT
· Destinations except for the log host:
Prefix TIMESTAMP Sysname MODULE/severity/MNEMONIC: CONTENT
Table 1 System log message elements
Element |
Description |
<PRI> |
Priority identifier. It is calculated by using the following formula: Priority identifier=facilityx8+severity Where: · Facility is specified by using the info-center loghost command. A log host uses this parameter to identify log sources and filter log messages. · Severity represents the importance of the message. For more information about severity levels, see Table 2. |
Prefix |
Message type identifier. This element is contained in the system log messages sent to non-log host destinations. The element uses the following symbols to indicate message severity: · Percentage sign (%)—Informational and higher levels. · Asterisk (*)—Debug level. |
TIMESTAMP |
Date and time when the event occurred. The following are commands for configuring the timestamp format: · Log host—Use the info-center timestamp loghost command. · Non-log host destinations—Use the info-center timestamp command. |
Sysname |
Name or IP address of the device that generated the message. |
%%vendor |
Manufacturer flag. This element is %%10 for H3C. This element is only available in messages sent to the log host. |
MODULE |
Name of the module that produced the message. |
severity |
Severity level of the message. (For more information about severity levels, see Table 2.) |
MNEMONIC |
Text string that uniquely identifies the system message. The maximum length is 32 characters. |
location |
Optional. This element presents location information for the message in the following format: -attribute1=x-attribute2=y…-attributeN=z This element is separated from the message description by using a semicolon (;). |
CONTENT |
Text string that contains detailed information about the event or error. For variable fields in this element, this document uses the representations in Table 3. |
System log messages are classified into eight severity levels from 0 to 7. The lower the number, the higher the severity, as shown in Table 2.
Table 2 System log message severity levels
Level |
Severity |
Description |
0 |
Emergency |
The system is unusable. For example, the system authorization has expired. |
1 |
Alert |
Action must be taken immediately. For example, traffic on an interface exceeds the upper limit. |
2 |
Critical |
Critical condition. For example, the device temperature exceeds the upper limit, the power module fails, or the fan tray fails. |
3 |
Error |
Error condition. For example, the link state changes or a storage card is unplugged. |
4 |
Warning |
Warning condition. For example, an interface is disconnected, or the memory resources are used up. |
5 |
Notification |
Normal but significant condition. For example, a terminal logs in to the device, or the device reboots. |
6 |
Informational |
Informational message. For example, a command or a ping operation is executed. |
7 |
Debug |
Debugging message. |
For variable fields in the message text, this document uses the representations in Table 3. The values are case insensitive, even though the representations are uppercase letters.
Table 3 Variable field representations
Representation |
Information type |
INT16 |
Signed 16-bit decimal number. |
UINT16 |
Unsigned 16-bit decimal number. |
INT32 |
Signed 32-bit decimal number. |
UINT32 |
Unsigned 32-bit decimal number. |
INT64 |
Signed 64-bit decimal number. |
UINT64 |
Unsigned 64-bit decimal number. |
DOUBLE |
Two dot-separated signed 32-bit decimal numbers. The format is [INTEGER].[INTEGER]. |
HEX |
Hexadecimal number. |
CHAR |
Single character. |
STRING |
Character string. |
IPADDR |
IP address. |
MAC |
MAC address. |
DATE |
Date. |
TIME |
Time. |
Managing and obtaining system log messages
You can manage system log messages by using the information center.
By default, the information center is enabled. Log messages can be output to the console, log buffer, monitor terminal, log host, and log file.
To filter log messages, use the info-center source command to specify log output rules. A log output rule specifies the source modules and the lowest severity level of log messages that can be output to a destination. A log message is output if its severity level is higher than or equal to the specified level. For example, if you specify a severity level of 6 (informational), log messages that have a severity level from 0 to 6 are output.
For more information about using the information center, see the network management and monitoring configuration guide for the product.
Obtaining log messages from the console terminal
Access the device through the console port. Real-time log messages are displayed on the console terminal.
Obtaining log messages from the log buffer
Use the display logbuffer command to display history log messages in the log buffer.
Obtaining log messages from a monitor terminal
Monitor terminals refer to terminals that access the device through the AUX, VTY, or TTY lines (for example, Telnet). To obtain log messages from a monitor terminal, use the following guidelines:
· To display log messages on the monitor terminal, you must configure the terminal monitor command.
· For monitor terminals, the lowest level of log messages that can be displayed is determined by both the terminal logging level and info-center source commands.
Obtaining log messages from the log file
By default, the log file feature automatically saves logs from the log file buffer to the log file every 24 hours. You can use the info-center logfile frequency command to change the automatic saving internal.
To manually save logs to the log file, use the logfile save command. The log file buffer is cleared each time a save operation is performed.
By default, you can obtain the log file from the flash:/logfile/ path .
Obtaining log messages from a log host
Use the info-center loghost command to specify the service port number and IP address of a log host. To specify multiple log hosts, repeat the command.
For a successful log message transmission, make sure the specified port number is the same as the port number used on the log host. The default service port number is 514.
Software module list
Table 4 lists all software modules that might produce system log messages. This document uses "OPENSRC" to represent all open source modules.
Module name representation |
Module name expansion |
AAA |
Authentication, Authorization and Accounting |
ACL |
Access Control List |
ANCP |
Access Node Control Protocol |
APMGR |
Access Point Management |
ARP |
Address Resolution Protocol |
ATK |
Attack Detection and Prevention |
ATM |
|
BFD |
Bidirectional Forwarding Detection |
BGP |
Border Gateway Protocol |
BLS |
Blacklist |
CFD |
Connectivity Fault Detection |
CFGMAN |
Configuration Management |
CONNLMT |
Connection Limit |
DEV |
Device Management |
DHCPR |
IPv4 DHCP Relay |
DHCPS |
DHCP Server |
DHCPS6 |
DHCPv6 Server |
DHCPSP4 |
DHCP Snooping |
DHCPSP6 |
DHCPv6 Snooping |
DIAG |
Diagnosis |
DLDP |
Device Link Detection Protocol |
DOT1X |
802.1X |
DRNI |
Distributed Resilient Network Interconnect |
EDEV |
|
ERPS |
Ethernet Ring Protection Switching |
ETHOAM |
Ethernet Operation, Administration and Maintenance |
EVB |
Edge Virtual Bridging |
EVIISIS |
Ethernet Virtual Interconnect Intermediate System-to-Intermediate System |
FCOE |
Fibre Channel Over Ethernet |
FCLINK |
Fibre Channel Link |
FCZONE |
Fibre Channel Zone |
FIB |
Forwarding Information Base |
FILTER |
Filter |
FIPS |
FIP Snooping |
FS |
File System |
HA |
High Availability |
HQOS |
Hierarchical QoS |
HTTPD |
Hypertext Transfer Protocol Daemon |
IFNET |
Interface Net Management |
IKE |
Internet Key Exchange |
IPSEC |
IP Security |
IRDP |
ICMP Router Discovery Protocol |
IRF (cluster) |
Intelligent Resilient Framework |
ISIS |
Intermediate System-to-Intermediate System |
ISSU |
In-Service Software Upgrade |
L2VPN |
Layer 2 VPN |
LAGG |
Link Aggregation |
LDP |
Label Distribution Protocol |
LLDP |
Link Layer Discovery Protocol |
LOAD |
Load Management |
LOGIN |
Login |
LPDT |
Loopback Detection |
LS |
Local Server |
LSPV |
LSP Verification |
MAC |
Media Access Control |
MACA |
MAC Authentication |
MACSEC |
MAC Security |
MBFD |
MPLS BFD |
MBUF |
Memory buffer |
MDC |
Multitenant Device Context |
MFIB |
Multicast Forwarding Information Base |
MGROUP |
Mirroring group |
MPLS |
Multiprotocol Label Switching |
MTLK |
Monitor Link |
NAT |
Network Address Translation |
NETCONF |
Network Configuration Protocol |
ND |
Neighbor Discovery |
NQA |
Network Quality Analyzer |
NTP |
Network Time Protocol |
OPENSRC |
Open Source |
OFP |
OpenFlow Protocol |
OPTMOD |
Optical Module |
OSPF |
Open Shortest Path First |
OSPFV3 |
Open Shortest Path First Version 3 |
Packet Capture |
Packet Capture |
PBB |
Provider Backbone Bridge |
PBR |
Policy-Based Routing |
PEX |
Port Extender |
PIM |
Protocol Independent Multicast |
PING |
Packet Internet Groper |
PKI |
Public Key Infrastructure |
PKT2CPU |
Packet to CPU |
PORTSEC |
Port Security |
PPP |
Point to Point Protocol |
PORTAL |
Portal |
PWDCTL |
Password Control |
QOS |
Quality of Service |
RADIUS |
Remote Authentication Dial In User Service |
RDDC |
Redundancy |
RESMON |
Resource Monitor |
RIP |
Routing Information Protocol |
RIPNG |
Routing Information Protocol Next Generation |
RM |
Routing Management |
RRPP |
Rapid Ring Protection Protocol |
RTM |
Real-Time Event Manager |
SCM |
Service Control Manager |
SCRLSP |
Static CRLSP |
SESSION |
Session |
SHELL |
Shell |
SLSP |
Static LSP |
SMLK |
Smart Link |
SNMP |
Simple Network Management Protocol |
SSHS |
Secure Shell Server |
STAMGR |
Station Management |
STM |
Stack Topology Management |
STP |
Spanning Tree Protocol |
SYSEVENT |
System Event |
SYSLOG |
System Log |
TACACS |
Terminal Access Controller Access Control System |
TRILL |
Transparent Interconnect of Lots of Links |
VCF |
Vertical Converged Framework |
VLAN |
Virtual Local Area Network |
VRRP |
Virtual Router Redundancy Protocol |
VSRP |
Virtual Service Redundancy Protocol |
WIPS |
Wireless Intrusion Prevention System |
Using this document
This document categorizes system log messages by software module. The modules are ordered alphabetically. Except for OPENSRC, the system log messages for each module are listed in alphabetic order of their mnemonic names. The OPENSRC messages are unordered because they use the same mnemonic name (SYSLOG). For each OPENSRC message, the section title uses a short description instead of the mnemonic name.
This document explains messages in tables. Table 5 describes information provided in these tables.
Table 5 Message explanation table contents
Item |
Content |
Example |
Message text |
Presents the message description. |
ACL [UINT32] [STRING] [UINT64] packet(s). |
Variable fields |
Briefly describes the variable fields in the order that they appear in the message text. The variable fields are numbered in the "$Number" form to help you identify their location in the message text. |
$1: ACL number. $2: ID and content of an ACL rule. $3: Number of packets that matched the rule. |
Severity level |
Provides the severity level of the message. |
6 |
Example |
Provides a real message example. The examples do not include the "<PRI>TIMESTAMP Sysname %%vendor" part or the "Prefix TIMESTAMP Sysname" part, because information in this part varies with system settings. |
ACL/6/ACL_STATIS_INFO: ACL 2000 rule 0 permit source 1.1.1.1 0 logging 10000 packet(s). |
Explanation |
Explains the message, including the event or error cause. |
Number of packets that matched an ACL rule. This message is sent when the packet counter changes. |
Recommended action |
Provides recommended actions. For informational messages, no action is required. |
No action is required. |
AAA messages
This section contains AAA messages.
AAA_FAILURE
Message text |
-AAAType=[STRING]-AAADomain=[STRING]-Service=[STRING]-UserName=[STRING]; AAA failed. |
Variable fields |
$1: AAA type. $2: AAA scheme. $3: Service. $4: User name. |
Severity level |
5 |
Example |
AAA/5/AAA_FAILURE: -AAAType=AUTHOR-AAADomain=domain1-Service=login-UserName=cwf@system; AAA failed. |
Explanation |
An AAA request was rejected. The following are the common reasons: · No response was received from the server. · The user name or password was incorrect. · The service type that the user applied for was incorrect. |
Recommended action |
1. Verify that the device is correctly connected to the server. 2. Enter the correct user name and password. 3. Verify that the server settings are the same as the settings on the device. 4. If the problem persists, contact H3C Support. |
AAA_LAUNCH
Message text |
-AAAType=[STRING]-AAADomain=[STRING]-Service=[STRING]-UserName=[STRING]; AAA launched. |
Variable fields |
$1: AAA type. $2: AAA scheme. $3: Service. $4: User name. |
Severity level |
6 |
Example |
AAA/6/AAA_LAUNCH: -AAAType=AUTHEN-AAADomain=domain1-Service=login-UserName=cwf@system; AAA launched. |
Explanation |
An AAA request was received. |
Recommended action |
No action is required. |
AAA_SUCCESS
Message text |
-AAAType=[STRING]-AAADomain=[STRING]-Service=[STRING]-UserName=[STRING]; AAA succeeded. |
Variable fields |
$1: AAA type. $2: AAA scheme. $3: Service. $4: User name. |
Severity level |
6 |
Example |
AAA/6/AAA_SUCCESS: -AAAType=AUTHOR-AAADomain=domain1-Service=login-UserName=cwf@system; AAA succeeded. |
Explanation |
An AAA request was accepted. |
Recommended action |
No action is required. |
ACL messages
This section contains ACL messages.
ACL_ACCELERATE_NO_RES
Message text |
Failed to accelerate [STRING] ACL [UINT32]. The resources are insufficient. |
Variable fields |
$1: ACL type. $2: ACL number. |
Severity level |
4 |
Example |
ACL/4/ACL_ACCELERATE_NO_RES: Failed to accelerate IPv6 ACL 2001. The resources are insufficient. |
Explanation |
Hardware resources were insufficient for accelerating an ACL. |
Recommended action |
Delete some rules or disabled ACL acceleration for other ACLs to release hardware resources. |
ACL_ACCELERATE_NONCONTIGUOUSMASK
Message text |
Failed to accelerate ACL [UINT32]. ACL acceleration supports only contiguous wildcard masks. |
Variable fields |
$1: ACL number. |
Severity level |
4 |
Example |
ACL/4/ACL_ACCELERATE_NONCONTIGUOUSMASK: Failed to accelerate ACL 2001. ACL acceleration supports only contiguous wildcard masks. |
Explanation |
ACL acceleration failed because rules containing noncontiguous wildcard masks exist in the ACL. |
Recommended action |
Check the ACL rules and delete the unsupported configuration. |
ACL_ACCELERATE_NOT_SUPPORT
Message text |
Failed to accelerate [STRING] ACL [UINT32]. The operation is not supported. |
Variable fields |
$1: ACL type. $2: ACL number. |
Severity level |
4 |
Example |
ACL/4/ACL_ACCELERATE_NOT_SUPPORT: Failed to accelerate IPv6 ACL 2001. The operation is not supported. |
Explanation |
ACL acceleration failed because the system does not support ACL acceleration. |
Recommended action |
No action is required. |
ACL_ACCELERATE_NOT_SUPPORTHOPBYHOP
Message text |
Failed to accelerate IPv6 ACL [UINT32]. ACL acceleration does not support the rules that contain the hop-by-hop keywords. |
Variable fields |
$1: ACL number. |
Severity level |
4 |
Example |
ACL/4/ACL_ACCELERATE_NOT_SUPPORTHOPBYHOP: Failed to accelerate IPv6 ACL 2001. ACL acceleration does not support the rules that contain the hop-by-hop keywords. |
Explanation |
ACL acceleration failed for the IPv6 ACL because rules containing the hop-by-hop keyword exist in the ACL. |
Recommended action |
Check the ACL rules and delete the unsupported configuration. |
ACL_ACCELERATE_NOT_SUPPORTMULTITCPFLAG
Message text |
Failed to accelerate IPv6 ACL [UINT32]. ACL acceleration does not support specifying multiple TCP flags in one rule. |
Variable fields |
$1: ACL number. |
Severity level |
4 |
Example |
ACL/4/ACL_ACCELERATE_NOT_SUPPORTMULTITCPFLAG: Failed to accelerate IPv6 ACL 2001. ACL acceleration does not support specifying multiple TCP flags in one rule. |
Explanation |
ACL acceleration failed for the IPv6 ACL because rules containing multiple TCP flags exist in the ACL. |
Recommended action |
Check the ACL rules and delete the unsupported configuration. |
ACL_ACCELERATE_UNK_ERR
Message text |
Failed to accelerate [STRING] ACL [UINT32]. |
Variable fields |
$1: ACL type. $2: ACL number. |
Severity level |
4 |
Example |
ACL/4/ACL_ACCELERATE_UNK_ERR: Failed to accelerate IPv6 ACL 2001. |
Explanation |
ACL acceleration failed because of an unknown error. |
Recommended action |
No action is required. |
ACL_IPV6_STATIS_INFO
Message text |
IPv6 ACL [UINT32] [STRING] [UINT64] packet(s). |
Variable fields |
$1: ACL number. $2: ID and content of an IPv6 ACL rule. $3: Number of packets that matched the rule. |
Severity level |
6 |
Example |
ACL6/6/ACL_IPV6_STATIS_INFO: IPv6 ACL 2000 rule 0 permit source 1:1::/64 logging 1000 packet(s). |
Explanation |
The number of packets matching the IPv6 ACL rule changed. |
Recommended action |
No action is required. |
ACL_NO_MEM
Message text |
Failed to configure [STRING] ACL [UINT] due to lack of memory. |
Variable fields |
$1: ACL type. $2: ACL number. |
Severity level |
3 |
Example |
ACL/3/ACL_NO_MEM: Failed to configure ACL 2001 due to lack of memory. |
Explanation |
Configuring the ACL failed because memory is insufficient. |
Recommended action |
Use the display memory-threshold command to check the memory usage. |
ACL_STATIS_INFO
Message text |
ACL [UINT32] [STRING] [UINT64] packet(s). |
Variable fields |
$1: ACL number. $2: ID and content of an IPv4 ACL rule. $3: Number of packets that matched the rule. |
Severity level |
6 |
Example |
ACL/6/ACL_STATIS_INFO: ACL 2000 rule 0 permit source 1.1.1.1 0 logging 10000 packet(s). |
Explanation |
The number of packets matching the IPv4 ACL rule changed. |
Recommended action |
No action is required. |
PFILTER_GLB_IPV4_DACT_NO_RES
Message text |
Failed to apply or refresh the IPv4 default action to the [STRING] direction globally. The resources are insufficient. |
Variable fields |
$1: Traffic direction. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_GLB_IPV4_DACT_NO_RES: Failed to apply or refresh the IPv4 default action to the inbound direction globally. The resources are insufficient. |
Explanation |
The system failed to perform one of the following actions because hardware resources are insufficient: · Applying the IPv4 default action to a specific direction globally. · Updating the IPv4 default action applied to a specific direction globally. |
Recommended action |
Use the display qos-acl resource command to check hardware resource usage. |
PFILTER_GLB_IPV4_DACT_UNK_ERR
Message text |
Failed to apply or refresh the IPv4 default action to the [STRING] direction globally. |
Variable fields |
$1: Traffic direction. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_GLB_IPV4_DACT_UNK_ERR: Failed to apply or refresh the IPv4 default action to the inbound direction globally. |
Explanation |
The system failed to perform one of the following actions due to an unknown error: · Applying the IPv4 default action to a specific direction globally. · Updating the IPv4 default action applied to a specific direction globally. |
Recommended action |
No action is required. |
PFILTER_GLB_IPV6_DACT_NO_RES
Message text |
Failed to apply or refresh the IPv6 default action to the [STRING] direction globally. The resources are insufficient. |
Variable fields |
$1: Traffic direction. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_GLB_IPV6_DACT_NO_RES: Failed to apply or refresh the IPv6 default action to the inbound direction globally. The resources are insufficient. |
Explanation |
The system failed to perform one of the following actions because hardware resources are insufficient: · Applying the IPv6 default action to a specific direction globally. · Updating the IPv6 default action applied to a specific direction globally. |
Recommended action |
Use the display qos-acl resource command to check hardware resource usage. |
PFILTER_GLB_IPV6_DACT_UNK_ERR
Message text |
Failed to apply or refresh the IPv6 default action to the [STRING] direction globally. |
Variable fields |
$1: Traffic direction. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_GLB_IPV6_DACT_UNK_ERR: Failed to apply or refresh the IPv6 default action to the inbound direction globally. |
Explanation |
The system failed to perform one of the following actions due to an unknown error: · Applying the IPv6 default action to a specific direction globally. · Updating the IPv6 default action applied to a specific direction globally. |
Recommended action |
No action is required. |
PFILTER_GLB_MAC_DACT_NO_RES
Message text |
Failed to apply or refresh the MAC default action to the [STRING] direction globally. The resources are insufficient. |
Variable fields |
$1: Traffic direction. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_GLB_MAC_DACT_NO_RES: Failed to apply or refresh the MAC default action to the inbound direction globally. The resources are insufficient. |
Explanation |
The system failed to perform one of the following actions because hardware resources are insufficient: · Applying the MAC default action to a specific direction globally. · Updating the MAC default action applied to a specific direction globally. |
Recommended action |
Use the display qos-acl resource command to check hardware resource usage. |
PFILTER_GLB_MAC_DACT_UNK_ERR
Message text |
Failed to apply or refresh the MAC default action to the [STRING] direction globally. |
Variable fields |
$1: Traffic direction. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_GLB_MAC_DACT_UNK_ERR: Failed to apply or refresh the MAC default action to the inbound direction globally. |
Explanation |
The system failed to perform one of the following actions due to an unknown error: · Applying the MAC default action to a specific direction globally. · Updating the MAC default action applied to a specific direction globally. |
Recommended action |
No action is required. |
PFILTER_GLB_NO_RES
Message text |
Failed to apply or refresh [STRING] ACL [UINT] [STRING] to the [STRING] direction globally. The resources are insufficient. |
Variable fields |
$1: ACL type. $2: ACL number. $3: ACL rule ID. $4: Traffic direction. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_GLB_NO_RES: Failed to apply or refresh IPv6 ACL 2000 rule 1 to the inbound direction globally. The resources are insufficient. |
Explanation |
The system failed to perform one of the following actions because hardware resources are insufficient: · Applying an ACL rule to a specific direction globally. · Updating an ACL rule applied to a specific direction globally. |
Recommended action |
Use the display qos-acl resource command to check hardware resource usage. |
PFILTER_GLB_NOT_SUPPORT
Message text |
Failed to apply or refresh [STRING] ACL [UINT] [STRING] to the [STRING] direction globally. The ACL is not supported. |
Variable fields |
$1: ACL type. $2: ACL number. $3: ACL rule ID. $4: Traffic direction. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_GLB_NOT_SUPPORT: Failed to apply or refresh IPv6 ACL 2000 rule 1 to the inbound direction globally. The ACL is not supported. |
Explanation |
The system failed to perform one of the following actions because the ACL rule is not supported: · Applying an ACL rule to a specific direction globally. · Updating an ACL rule applied to a specific direction globally. |
Recommended action |
Verify the ACL configuration and remove the settings that are not supported. |
PFILTER_GLB_ RES_CONFLICT
Message text |
Failed to apply or refresh [STRING] ACL [UINT] to the [STRING] direction globally. [STRING] ACL [UINT] has already been applied globally. |
Variable fields |
$1: ACL type. $2: ACL number. $3: Traffic direction. $4: ACL type. $5: ACL number. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_GLB_RES_CONFLICT: Failed to apply or refresh IPv6 ACL 2000 to the inbound direction globally. IPv6 ACL 3000 has already been applied globally. |
Explanation |
The system failed to perform one of the following actions because an ACL of the same type (IPv4 ACL, IPv6 ACL, or MAC ACL) has already been applied: · Applying the ACL to a specific direction globally. · Updating the ACL applied to a specific direction globally. |
Recommended action |
Remove the ACL of the same type. |
PFILTER_GLB_UNK_ERR
Message text |
Failed to apply or refresh [STRING] ACL [UINT] [STRING] to the [STRING] direction globally. |
Variable fields |
$1: ACL type. $2: ACL number. $3: ACL rule ID. $4: Traffic direction. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_GLB_UNK_ERR: Failed to apply or refresh IPv6 ACL 2000 rule 1 to the inbound direction globally. |
Explanation |
The system failed to perform one of the following actions due to an unknown error: · Applying an ACL rule to a specific direction globally. · Updating an ACL rule applied to a specific direction globally. |
Recommended action |
No action is required. |
PFILTER_IF_IPV4_DACT_NO_RES
Message text |
Failed to apply or refresh the IPv4 default action to the [STRING] direction of interface [STRING]. The resources are insufficient. |
Variable fields |
$1: Traffic direction. $2: Interface name. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_IF_IPV4_DACT_NO_RES: Failed to apply or refresh the IPv4 default action to the inbound direction of interface Ethernet 3/1/2. The resources are insufficient. |
Explanation |
The system failed to perform one of the following actions because hardware resources are insufficient: · Applying the IPv4 default action to a specific direction of an interface. · Updating the IPv4 default action applied to a specific direction of an interface. |
Recommended action |
Use the display qos-acl resource command to check hardware resource usage. |
PFILTER_IF_IPV4_DACT_UNK_ERR
Message text |
Failed to apply or refresh the IPv4 default action to the [STRING] direction of interface [STRING]. |
Variable fields |
$1: Traffic direction. $2: Interface name. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_IF_IPV4_DACT_UNK_ERR: Failed to apply or refresh the IPv4 default action to the inbound direction of interface Ethernet 3/1/2. |
Explanation |
The system failed to perform one of the following actions because an unknown error: · Applying the IPv4 default action to a specific direction of an interface. · Updating the IPv4 default action applied to a specific direction of an interface. |
Recommended action |
No action is required. |
PFILTER_IF_IPV6_DACT_NO_RES
Message text |
Failed to apply or refresh the IPv6 default action to the [STRING] direction of interface [STRING]. The resources are insufficient. |
Variable fields |
$1: Traffic direction. $2: Interface name. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_IF_IPV6_DACT_NO_RES: Failed to apply or refresh the IPv6 default action to the inbound direction of interface Ethernet 3/1/2. The resources are insufficient. |
Explanation |
The system failed to perform one of the following actions because hardware resources are insufficient: · Applying the IPv6 default action to a specific direction of an interface. · Updating the IPv6 default action applied to a specific direction of an interface. |
Recommended action |
Use the display qos-acl resource command to check hardware resource usage. |
PFILTER_IF_IPV6_DACT_UNK_ERR
Message text |
Failed to apply or refresh the IPv6 default action to the [STRING] direction of interface [STRING]. |
Variable fields |
$1: Traffic direction. $2: Interface name. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_IF_IPV6_DACT_UNK_ERR: Failed to apply or refresh the IPv6 default action to the inbound direction of interface Ethernet 3/1/2. |
Explanation |
The system failed to perform one of the following actions due to an unknown error: · Applying the IPv6 default action to a specific direction of an interface. · Updating the IPv6 default action applied to a specific direction of an interface. |
Recommended action |
No action is required. |
PFILTER_IF_MAC_DACT_NO_RES
Message text |
Failed to apply or refresh the MAC default action to the [STRING] direction of interface [STRING]. The resources are insufficient. |
Variable fields |
$1: Traffic direction. $2: Interface name. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_IF_MAC_DACT_NO_RES: Failed to apply or refresh the MAC default action to the inbound direction of interface Ethernet 3/1/2. The resources are insufficient. |
Explanation |
The system failed to perform one of the following actions because hardware resources are insufficient: · Applying the MAC default action to a specific direction of an interface. · Updating the MAC default action applied to a specific direction of an interface. |
Recommended action |
Use the display qos-acl resource command to check hardware resource usage. |
PFILTER_IF_MAC_DACT_UNK_ERR
Message text |
Failed to apply or refresh the MAC default action to the [STRING] direction of interface [STRING]. |
Variable fields |
$1: Traffic direction. $2: Interface name. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_IF_MAC_DACT_UNK_ERR: Failed to apply or refresh the MAC default action to the inbound direction of interface Ethernet 3/1/2. |
Explanation |
The system failed to perform one of the following actions due to an unknown error: · Applying the MAC default action to a specific direction of an interface. · Updating the MAC default action applied to a specific direction of an interface. |
Recommended action |
No action is required. |
PFILTER_IF_NO_RES
Message text |
Failed to apply or refresh [STRING] ACL [UINT] [STRING] to the [STRING] direction of interface [STRING]. The resources are insufficient. |
Variable fields |
$1: ACL type. $2: ACL number. $3: ACL rule ID. $4: Traffic direction. $5: Interface name. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_IF_NO_RES: Failed to apply or refresh IPv6 ACL 2000 rule 1 to the inbound direction of interface Ethernet 3/1/2. The resources are insufficient. |
Explanation |
The system failed to perform one of the following actions because hardware resources are insufficient: · Applying an ACL rule to a specific direction of an interface. · Updating an ACL rule applied to a specific direction of an interface. |
Recommended action |
Use the display qos-acl resource command to check hardware resource usage. |
PFILTER_IF_NOT_SUPPORT
Message text |
Failed to apply or refresh [STRING] ACL [UINT] [STRING] to the [STRING] direction of interface [STRING]. The ACL is not supported. |
Variable fields |
$1: ACL type. $2: ACL number. $3: ACL rule ID. $4: Traffic direction. $5: Interface name. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_IF_NOT_SUPPORT: Failed to apply or refresh IPv6 ACL 2000 rule 1 to the inbound direction of interface Ethernet 3/1/2. The ACL is not supported. |
Explanation |
The system failed to perform one of the following actions because the ACL rule is not supported: · Applying an ACL rule to a specific direction of an interface. · Updating an ACL rule applied to a specific direction of an interface. |
Recommended action |
Verify the ACL configuration and remove the settings that are not supported. |
PFILTER_IF_RES_CONFLICT
Message text |
Failed to apply or refresh [STRING] ACL [UINT] to the [STRING] direction of interface [STRING]. [STRING] ACL [UINT] has already been applied to the interface. |
Variable fields |
$1: ACL type. $2: ACL number. $3: Traffic direction. $4: Interface name. $5: ACL type. $6: ACL number. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_IF_RES_CONFLICT: Failed to apply or refresh IPv6 ACL 2000 to the inbound direction of interface Ethernet 3/1/2. IPv6 ACL 3000 has already been applied to the interface. |
Explanation |
The system failed to perform one of the following actions because an ACL of the same type (IPv4 ACL, IPv6 ACL, or MAC ACL) has already been applied: · Applying the ACL to a specific direction of an interface. · Updating the ACL applied to a specific direction of an interface. |
Recommended action |
Remove the ACL of the same type. |
PFILTER_IF_UNK_ERR
Message text |
Failed to apply or refresh [STRING] ACL [UINT] [STRING] to the [STRING] direction of interface [STRING]. |
Variable fields |
$1: ACL type. $2: ACL number. $3: ACL rule ID. $4: Traffic direction. $5: Interface name. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_IF_UNK_ERR: Failed to apply or refresh IPv6 ACL 2000 rule 1 to the inbound direction of interface Ethernet 3/1/2. |
Explanation |
The system failed to perform one of the following actions due to an unknown error: · Applying an ACL rule to a specific direction of an interface. · Updating an ACL rule applied to a specific direction of an interface. |
Recommended action |
No action is required. |
PFILTER_IPV6_STATIS_INFO
Message text |
[STRING] ([STRING]): Packet-filter IPv6 [UINT32] [STRING] [STRING] [UINT64] packet(s). |
Variable fields |
$1: Destination to which packet filter applies. $2: Traffic direction. $3: ACL number. $4: ID and content of an ACL rule. $5: Number of packets that matched the rule. |
Severity level |
6 |
Example |
ACL/6/PFILTER_IPV6_STATIS_INFO: Ethernet0/4/0 (inbound): Packet-filter IPv6 2000 rule 0 permit source 1:1::/64 logging 1000 packet(s). |
Explanation |
The number of packets matching the packet-filter IPv6 ACL rule changed. |
Recommended action |
No action is required. |
PFILTER_STATIS_INFO
Message text |
[STRING] ([STRING]): Packet-filter [UINT32] [STRING] [UINT64] packet(s). |
Variable fields |
$1: Destination to which packet filter applies. $2: Traffic direction. $3: ACL number. $4: ID and content of an ACL rule. $5: Number of packets that matched the rule. |
Severity level |
6 |
Example |
ACL/6/PFILTER_STATIS_INFO: Ethernet0/4/0 (inbound): Packet-filter 2000 rule 0 permit source 1.1.1.1 0 logging 10000 packet(s). |
Explanation |
The number of packets matching the packet-filter IPv4 ACL rule changed. |
Recommended action |
No action is required. |
PFILTER_VLAN_IPV4_DACT_NO_RES
Message text |
Failed to apply or refresh the IPv4 default action to the [STRING] direction of VLAN [UINT16]. The resources are insufficient. |
Variable fields |
$1: Traffic direction. $2: VLAN ID. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_VLAN_IPV4_DACT_NO_RES: Failed to apply or refresh the IPv4 default action to the inbound direction of VLAN 1. The resources are insufficient. |
Explanation |
The system failed to perform one of the following actions because hardware resources are insufficient: · Applying the IPv4 default action to a specific direction of a VLAN. · Updating the IPv4 default action applied to a specific direction of a VLAN. |
Recommended action |
Use the display qos-acl resource command to check hardware resource usage. |
PFILTER_VLAN_IPV4_DACT_UNK_ERR
Message text |
Failed to apply or refresh the IPv4 default action to the [STRING] direction of VLAN [UINT16]. |
Variable fields |
$1: Traffic direction. $2: VLAN ID. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_VLAN_IPV4_DACT_UNK_ERR: Failed to apply or refresh the IPv4 default action to the inbound direction of VLAN 1. |
Explanation |
The system failed to perform one of the following actions due to an unknown error: · Applying the IPv4 default action to a specific direction of a VLAN. · Updating the IPv4 default action applied to a specific direction of a VLAN. |
Recommended action |
No action is required. |
PFILTER_VLAN_IPV6_DACT_NO_RES
Message text |
Failed to apply or refresh the IPv6 default action to the [STRING] direction of VLAN [UINT16]. The resources are insufficient. |
Variable fields |
$1: Traffic direction. $2: VLAN ID. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_VLAN_IPV6_DACT_NO_RES: Failed to apply or refresh the IPv6 default action to the inbound direction of VLAN 1. The resources are insufficient. |
Explanation |
The system failed to perform one of the following actions because hardware resources are insufficient: · Applying the IPv6 default action to a specific direction of a VLAN. · Updating the IPv6 default action applied to a specific direction of a VLAN. |
Recommended action |
Use the display qos-acl resource command to check hardware resource usage. |
PFILTER_VLAN_IPV6_DACT_UNK_ERR
Message text |
Failed to apply or refresh the IPv6 default action to the [STRING] direction of VLAN [UINT16]. |
Variable fields |
$1: Traffic direction. $2: VLAN ID. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_VLAN_IPV6_DACT_UNK_ERR: Failed to apply or refresh the IPv6 default action to the inbound direction of VLAN 1. |
Explanation |
The system failed to perform one of the following actions due to an unknown error: · Applying the IPv6 default action to a specific direction of a VLAN. · Updating the IPv6 default action applied to a specific direction of a VLAN. |
Recommended action |
No action is required. |
PFILTER_VLAN_MAC_DACT_NO_RES
Message text |
Failed to apply or refresh the MAC default action to the [STRING] direction of VLAN [UINT16]. The resources are insufficient. |
Variable fields |
$1: Traffic direction. $2: VLAN ID. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_VLAN_MAC_DACT_NO_RES: Failed to apply or refresh the MAC default action to the inbound direction of VLAN 1. The resources are insufficient. |
Explanation |
The system failed to perform one of the following actions because hardware resources are insufficient: · Applying the MAC default action to a specific direction of a VLAN. · Updating the MAC default action applied to a specific direction of a VLAN. |
Recommended action |
Use the display qos-acl resource command to check hardware resource usage. |
PFILTER_VLAN_MAC_DACT_UNK_ERR
Message text |
Failed to apply or refresh the MAC default action to the [STRING] direction of VLAN [UINT16]. |
Variable fields |
$1: Traffic direction. $2: VLAN ID. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_VLAN_MAC_DACT_UNK_ERR: Failed to apply or refresh the MAC default action to the inbound direction of VLAN 1. |
Explanation |
The system failed to perform one of the following actions due to an unknown error: · Applying the MAC default action to a specific direction of a VLAN. · Updating the MAC default action applied to a specific direction of a VLAN. |
Recommended action |
No action is required. |
PFILTER_VLAN_NO_RES
Message text |
Failed to apply or refresh [STRING] ACL [UINT] [STRING] to the [STRING] direction of VLAN [UINT16]. The resources are insufficient. |
Variable fields |
$1: ACL type. $2: ACL number. $3: ACL rule ID. $4: Traffic direction. $5: VLAN ID. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_VLAN_NO_RES: Failed to apply or refresh IPv6 ACL 2000 rule 1 to the inbound direction of VLAN 1. The resources are insufficient. |
Explanation |
The system failed to perform one of the following actions because hardware resources are insufficient: · Applying an ACL rule to a specific direction of a VLAN. · Updating an ACL rule applied to a specific direction of a VLAN. |
Recommended action |
Use the display qos-acl resource command to check hardware resource usage. |
PFILTER_VLAN_NOT_SUPPORT
Message text |
Failed to apply or refresh [STRING] ACL [UINT] [STRING] to the [STRING] direction of VLAN [UINT16]. The ACL is not supported. |
Variable fields |
$1: ACL type. $2: ACL number. $3: ACL rule ID. $4: Traffic direction. $5: VLAN ID. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_VLAN_NOT_SUPPORT: Failed to apply or refresh ACL 2000 rule 1 to the inbound direction of VLAN 1. The ACL is not supported. |
Explanation |
The system failed to perform one of the following actions because the ACL rule is not supported: · Applying an ACL rule to a specific direction of a VLAN. · Updating an ACL rule applied to a specific direction of a VLAN. |
Recommended action |
Verify the ACL configuration and remove the settings that are not supported. |
PFILTER_VLAN_RES_CONFLICT
Message text |
Failed to apply or refresh [STRING] ACL [UINT] to the [STRING] direction of VLAN [UINT16]. [STRING] ACL [UINT] has already been applied to the VLAN. |
Variable fields |
$1: ACL type. $2: ACL number. $3: Traffic direction. $4: VLAN ID. $5: ACL type. $6: ACL number. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_VLAN_RES_CONFLICT: Failed to apply or refresh IPv6 ACL 2000 to the inbound direction of VLAN 1. IPv6 ACL 3000 has already been applied to the VLAN. |
Explanation |
The system failed to perform one of the following actions because an ACL of the same type (IPv4 ACL, IPv6 ACL, or MAC ACL) has already been applied: · Applying the ACL to a specific direction of a VLAN. · Updating the ACL applied to a specific direction of a VLAN. |
Recommended action |
Remove the ACL of the same type. |
PFILTER_VLAN_UNK_ERR
Message text |
Failed to apply or refresh [STRING] ACL [UINT] [STRING] to the [STRING] direction of VLAN [UINT16]. |
Variable fields |
$1: ACL type. $2: ACL number. $3: ACL rule ID. $4: Traffic direction. $5: VLAN ID. |
Severity level |
3 |
Example |
PFILTER/3/PFILTER_VLAN_UNK_ERR: Failed to apply or refresh ACL 2000 rule 1 to the inbound direction of VLAN 1. |
Explanation |
The system failed to perform one of the following actions due to an unknown error: · Applying an ACL rule to a specific direction of a VLAN. · Updating an ACL rule applied to a specific direction of a VLAN. |
Recommended action |
No action is required. |
ANCP messages
This section contains ANCP messages.
ANCP_INVALID_PACKET
Message text |
-NeighborName=[STRING]-State=[STRING]-MessageType=[STRING]; The [STRING] value [STRING] is wrong, and the value [STRING] is expected. |
Variable fields |
$1: ANCP neighbor name. $2: Neighbor state. $4: Field: · Sender Instance. · Sender Port. · Sender Name. · Partition ID. · Receiver Instance. · Receiver Port. · Receiver Name. · Version. · Timer. · Pflag. · Capabilities. $5: Wrong value of the field. $6: Expected value of the field. |
Severity level |
6 |
Example |
ANCP/6/ANCP_INVALID_PACKET: -NeighborName=Dslam-State=SYNSENT-MessageType=SYNACK; The Sender Instance value 0 is wrong, and the value 1 is expected. |
Explanation |
The system received an adjacency message that had a field with a wrong value. |
Recommended action |
No action is required. |
APMGR messages
This section contains access point management messages.
APMGR_AC_MEM_ALERT
Message text |
The memory utilization has reached the threshold. |
Variable fields |
N/A |
Severity level |
4 |
Example |
APMGR/4/APMGR_AC_MEM_ALERT: The memory utilization has reached the threshold. |
Explanation |
The AP failed to come online because the memory utilization exceeded the limit. |
Recommended action |
Stop creating manual APs and prevent APs from coming online. |
APMGR_ADD_AP_FAIL
Message text |
AP [STRING] failed to come online using serial ID [STRING]: MAC address [STRING] is being used by AP [STRING]. |
Variable fields |
$1: AP name. $2: Serial ID. $3: MAC address. $4: AP name. |
Severity level |
4 |
Example |
APMGR/4/ APMGR_ADD_AP_FAIL: AP ap1 failed to come online using serial ID 01247ef96: MAC address 0023-7961-5201 is being used by AP ap2. |
Explanation |
The AP failed to come online because a manual AP that has the same MAC address already exists on the AC. |
Recommended action |
Delete either the manual AP that has the MAC address or the serial ID. |
APMGR_ADDBAC_INFO
Message text |
Add BAS AC [STRING]. |
Variable fields |
$1: MAC address of the BAS AC. |
Severity level |
6 |
Example |
APMGR/6/APMGR_ADDBAC_INFO: Add BAS AC 3ce5-a616-28cd. |
Explanation |
The BAS AC was connected to the master AC. |
Recommended action |
No action is required. |
APMGR_AP_OFFLINE
Message text |
AP [STRING] went offline. State changed to Idle. |
Variable fields |
$1: AP name. |
Severity level |
6 |
Example |
APMGR/6/APMGR_AP_OFFLINE: AP ap1 went offline. State changed to Idle. |
Explanation |
The AP went offline. The state of the AP changed to Idle. |
Recommended action |
If the AP went offline abnormally, check the debugging information to locate the issue and resolve it. |
APMGR_AP_ONLINE
Message text |
AP [STRING] went online. State changed to Run. |
Variable fields |
$1: AP name. |
Severity level |
6 |
Example |
APMGR/6/APMGR_AP_ONLINE: AP ap1 went online. State changed to Run. |
Explanation |
The AP came online. The state of the AP changed to Run. |
Recommended action |
No action is required. |
APMGR_CWC_IMG_DOWNLOAD_COMPLETE
Message text |
System software image file [STRING] downloading through the CAPWAP tunnel to AC [STRING] completed. |
Variable fields |
$1: Image file name. $2: AC IP address. |
Severity level |
6 |
Example |
APMGR/6/APMGR_CWC_IMG_DOWNLOAD_COMPLETE: System software image file 5800.ipe downloading through the CAPWAP tunnel to AC 192.168.10.1 completed. |
Explanation |
The AP downloaded the image file from the AC successfully. |
Recommended action |
No action is required. |
APMGR_CWC_IMG_DOWNLOAD_START
Message text |
Started to download the system software image file [STRING] through the CAPWAP tunnel to AC [STRING]. |
Variable fields |
$1: Image file name. $2: AC IP address. |
Severity level |
6 |
Example |
APMGR/6/APMGR_CWC_IMG_DOWNLOAD_START: Started to download the system software image file 5800.ipe through the CAPWAP tunnel to AC 192.168.10.1. |
Explanation |
The AP started to download the image file from the AC. |
Recommended action |
Make sure the AP is correctly connected to the AC. |
APMGR_CWC_IMG_NO_ENOUGH_SPACE
Message text |
Insufficient flash memory space for downloading system software image file [STRING]. |
Variable fields |
$1: Image file name. |
Severity level |
6 |
Example |
APMGR/6/APMGR_CWC_IMG_NO_ENOUGH_SPACE: Insufficient flash memory space for downloading system software image file 5800.ipe. |
Explanation |
The AP failed to download the image file from the AC because of insufficient flash memory. |
Recommended action |
Delete files not in use from the AP. |
APMGR_CWC_LOCAL_AC_DOWN
Message text |
CAPWAP tunnel to Central AC [STRING] went down. Reason: [STRING]. |
Variable fields |
$1: IP address of the central AC. $2: Reason: · Added local AC IP address. · Deleted local AC IP address. · Local AC interface used for CAPWAP tunnel went down. · Local AC config changed. · N/A |
Severity level |
4 |
Example |
APMGR/4/APMGR_CWC_LOCAL_AC_DOWN: CAPWAP tunnel to Central AC 2.2.2.1 went down. Reason: Added local AC IP address. |
Explanation |
The CAPWAP tunnel between the central AC and the local AC was terminated for a specific reason. |
Recommended action |
To resolve the issue: 1. Examine the network connection between the central AC and the local AC. 2. Verify that the central AC is correctly configured. 3. Verify that the local AC is correctly configured. 4. If the issue persists, contact H3C Support. |
APMGR_CWC_LOCAL_AC_UP
Message text |
CAPWAP tunnel to Central AC [STRING] went up. |
Variable fields |
$1: IP address of the central AC. |
Severity level |
6 |
Example |
APMGR/6/APMGR_CWC_LOCAL_AC_UP: CAPWAP tunnel to Central AC 2.2.2.1 went up. |
Explanation |
The central AC has established a CAPWAP tunnel with the local AC. |
Recommended action |
No action is required. |
APMGR_CWC_REBOOT
Message text |
AP in state [STRING] is rebooting. Reason: [STRING] |
Variable fields |
$1: AP state. $2: Reason: · AP was reset. · Image was downloaded successfully. · AP stayed in idle state for a long time. |
Severity level |
6 |
Example |
APMGR/6/APMGR_CWC_REBOOT: AP in State Run is rebooting. Reason: AP was reset. |
Explanation |
The AP rebooted for a specific reason. |
Recommended action |
No action is required. |
APMGR_CWC_RUN_DOWNLOAD_COMPLETE
Message text |
File [STRING] successfully downloaded through the CAPWAP tunnel to AC [STRING]. |
Variable fields |
$1: File name. $2: AC IP address. |
Severity level |
6 |
Example |
APMGR/6/APMGR_CWC_RUN_DOWNLOAD_COMPLETE: File ac.cfg successfully downloaded through the CAPWAP tunnel to AC 192.168.10.1. |
Explanation |
The AP downloaded the file from the AC successfully. |
Recommended action |
No action is required. |
APMGR_CWC_RUN_DOWNLOAD_START
Message text |
Started to download the file [STRING] through the CAPWAP tunnel to AC [STRING]. |
Variable fields |
$1: File name. $2: AC IP address. |
Severity level |
6 |
Example |
APMGR/6/APMGR_CWC_RUN_DOWNLOAD_START: Started to download the file ac.cfg through the CAPWAP tunnel to AC 192.168.10.1. |
Explanation |
The AP started to download the file from the AC. |
Recommended action |
Make sure the AP is correctly connected to the AC. |
APMGR_CWC_RUN_NO_ENOUGH_SPACE
Message text |
Insufficient flash memory space for downloading file [STRING]. |
Variable fields |
$1: File name. |
Severity level |
6 |
Example |
APMGR/6/APMGR_CWC_RUN_NO_ENOUGH_SPACE: Insufficient flash memory space for downloading file ac.cfg. |
Explanation |
The AP failed to download the file from the AC because of insufficient flash memory. |
Recommended action |
Delete files not in use from the AP. |
APMGR_CWC_TUNNEL_DOWN
Message text |
CAPWAP tunnel to AC [STRING] went down. Reason: [STRING]. |
Variable fields |
$1: AC IP address. $2: Reason: · Added AP IP address. · Deleted AP IP address. · AP interface used for CAPWAP tunnel went down. · AP config changed. · AP was reset. · Number of echo retransmission attempts exceeded the limit. · Full retransmission queue. · Data channel timer expired. · Backup AC IP address changed. · Backup tunnel changed to master tunnel. · Failed to change backup tunnel to master tunnel. · Backup method changed. · N/A. |
Severity level |
6 |
Example |
APMGR/6/APMGR_CWC_TUNNEL_DOWN: CAPWAP tunnel to AC 192.168.10.1 went down. Reason: AP was reset. |
Explanation |
The CAPWAP tunnel between the AP and the AC was terminated for a specific reason. |
Recommended action |
Examine the network connection between the AP and the AC. |
APMGR_CWC_TUNNEL_UP
Message text |
[STRING] CAPWAP tunnel to AC [STRING] went up. |
Variable fields |
$1: Tunnel type: · Master. · Backup. $2: AC IP address. |
Severity level |
6 |
Example |
APMGR/6/APMGR_CWC_TUNNEL_UP: Master CAPWAP tunnel to AC 192.168.10.1 went up. |
Explanation |
The AP was connected to the AC successfully and entered Run state. |
Recommended action |
No action is required. |
APMGR_CWS_IMG_DOWNLOAD_COMPLETE
Message text |
System software image file [STRING] downloading through the CAPWAP tunnel for AP [STRING] completed. |
Variable fields |
$1: Image file name. $2: AP name. |
Severity level |
6 |
Example |
APMGR/6/APMGR_ CWS_IMG_DOWNLOAD_COMPLETE: System software image file 5800.ipe downloading through the CAPWAP tunnel for AP ap2 completed. |
Explanation |
The AP downloaded the image file from the AC successfully. |
Recommended action |
No action is required. |
APMGR_CWS_IMG_DOWNLOAD_START
Message text |
AP [STRING] started to download the system software image file [STRING]. |
Variable fields |
$1: AP name. $2: Image file name. |
Severity level |
6 |
Example |
APMGR/6/APMGR_CWS_IMG_DOWNLOAD_START: AP ap1 started to download the system software image file 5800.ipe. |
Explanation |
The AP started to download the image file from the AC. |
Recommended action |
No action is required. |
APMGR_CWS_LOCAL_AC_DOWN
Message text |
CAPWAP tunnel to local AC [STRING] went down. Reason: [STRING]. |
Variable fields |
$1: IP address of the local AC. $2: Reason: · Neighbor dead timer expired. · Local AC was deleted. · Serial number changed. · Processed join request in Run state. · Failed to retransmit message. · N/A |
Severity level |
4 |
Example |
APMGR/4/APMGR_CWS_LOCAL_AC_DOWN: CAPWAP tunnel to local AC 1.1.1.1 went down. Reason: Serial number changed. |
Explanation |
The CAPWAP tunnel between the central AC and the local AC was terminated for a specific reason. |
Recommended action |
To resolve the issue: 1. Examine the network connection between the central AC and the local AC. 2. Verify that the central AC is correctly configured. 3. Verify that the local AC is correctly configured. 4. If the issue persists, contact H3C Support. |
APMGR_CWS_LOCAL_AC_UP
Message text |
CAPWAP tunnel to local AC [STRING] went up. |
Variable fields |
$1: IP address of the local AC. |
Severity level |
6 |
Example |
APMGR/6/APMGR_CWS_LOCAL_AC_UP: CAPWAP tunnel to local AC 1.1.1.1 went up. |
Explanation |
The central AC has established a CAPWAP tunnel with the local AC. |
Recommended action |
No action is required. |
APMGR_CWS_RUN_DOWNLOAD_COMPLETE
Message text |
File [STRING] successfully downloaded through the CAPWAP tunnel for AP [STRING]. |
Variable fields |
$1: File name. $2: AP name. |
Severity level |
6 |
Example |
APMGR/6/APMGR_CWS_RUN_DOWNLOAD_COMPLETE: File ac.cfg successfully downloaded through the CAPWAP tunnel for AP ap2. |
Explanation |
The AP downloaded the file from the AC successfully. |
Recommended action |
No action is required. |
APMGR_CWS_RUN_DOWNLOAD_START
Message text |
AP [STRING] started to download the file [STRING]. |
Variable fields |
$1: AP name. $2: File name. |
Severity level |
6 |
Example |
APMGR/6/APMGR_CWS_RUN_DOWNLOAD_START: AP ap1 started to download the file ac.cfg. |
Explanation |
The AP started to download the file from the AC. |
Recommended action |
No action is required. |
APMGR_CWS_TUNNEL_DOWN
Message text |
CAPWAP tunnel to AP [STRING] went down. Reason: [STRING]. |
Variable fields |
$1: AP name. $2: Reason: · Neighbor dead timer expired. · AP was reset. · AP was deleted. · Serial number changed. · Processed join request in Run state. · Failed to retransmit message. · Received WTP tunnel down event from AP. · Backup AC closed the backup tunnel. · Tunnel switched. · N/A. |
Severity level |
6 |
Example |
APMGR/6/APMGR_CWS_TUNNEL_DOWN: CAPWAP tunnel to AP ap1 went down. Reason: AP was reset. |
Explanation |
The AP went offline for a specific reason. |
Recommended action |
To resolve the issue: 1. Examine the network connection between the AP and the AC. 2. Verify that the AP is correctly configured. 3. Verify that the AC is correctly configured. 4. If the issue persists, contact H3C Support. |
APMGR_CWS_TUNNEL_UP
Message text |
[STRING] CAPWAP tunnel to AP [STRING] went up. |
Variable fields |
$1: Tunnel type: · Master. · Backup. $2: AP name. |
Severity level |
6 |
Example |
APMGR/6/APMGR_CWS_TUNNEL_UP: Backup CAPWAP tunnel to AP ap1 went up. |
Explanation |
The AP came online and entered Run state. |
Recommended action |
No action is required. |
APMGR_DELBAC_INFO
Message text |
Delete BAS AC [STRING]. |
Variable fields |
$1: MAC address of the BAS AC. |
Severity level |
6 |
Example |
APMGR/6/APMGR_DELBAC_INFO: Delete BAS AC 3ce5-a616-28cd. |
Explanation |
The BAS AC was disconnected from the master AC. |
Recommended action |
No action is required. |
APMGR_LOCAL_AC_OFFLINE
Message text |
Local AC [STRING] went offline. State changed to Idle. |
Variable fields |
$1: Name of the local AC. |
Severity level |
6 |
Example |
APMGR/6/APMGR_LOCAL_AC_OFFLINE: Local AC ac1 went offline. State changed to Idle. |
Explanation |
The local AC went offline. The state of the local AC changed to Idle. |
Recommended action |
1. If the local AC went offline abnormally, check the debugging information to locate the issue and resolve it. 2. If the issue persists, contact H3C Support. |
APMGR_LOCAL_AC_ONLINE
Message text |
Local AC [STRING] went online. State changed to Run. |
Variable fields |
$1: Name of the local AC. |
Severity level |
6 |
Example |
APMGR/6/APMGR_LOCAL_AC_ONLINE: Local AC ac1 went online. State changed to Run. |
Explanation |
The local AC came online. The state of the local AC changed to Run. |
Recommended action |
No action is required. |
ARP messages
This section contains ARP messages.
ARP_ACTIVE_ACK_NO_REPLY
Message text |
No ARP reply from IP [STRING] was received on interface [STRING]. |
Variable fields |
$1: IP address. $2: Interface name. |
Severity level |
6 |
Example |
ARP/6/ARP_ACTIVE_ACK_NO_REPLY: No ARP reply from IP 192.168.10.1 was received on interface Ethernet0/1/0. |
Explanation |
The ARP active acknowledgement feature did not receive an ARP reply after it sent an ARP request to the sender IP of an ARP message. This message indicates the risk of attacks. |
Recommended action |
1. Verify that the learned ARP entries on the device are consistent with the existing legal devices. When gateways and servers are on the network, check the ARP entries for these devices first. 2. If the ARP entries are correct and the attack continues, contact H3C Support. |
ARP_ACTIVE_ACK_NOREQUESTED_REPLY
Message text |
Interface [STRING] received from IP [STRING] an ARP reply that was not requested by the device. |
Variable fields |
$1: Interface name. $2: IP address. |
Severity level |
6 |
Example |
ARP/6/ARP_ACTIVE_ACK_NOREQUESTED_REPLY: Interface Ethernet0/1/0 received from IP 192.168.10.1 an ARP reply that was not requested by the device. |
Explanation |
The ARP active acknowledgement feature received an unsolicited ARP reply from a sender IP. This message indicates the risk of attacks. |
Recommended action |
No action is required. The device discards the ARP reply automatically. |
ARP_BINDRULETOHW_FAILED
Message text |
Failed to download binding rule to hardware on the interface [STRING], SrcIP [IPADDR], SrcMAC [MAC], VLAN [UINT16], Gateway MAC [MAC]. |
Variable fields |
$1: Interface name. $2: Source IP address. $3: Source MAC address. $4: VLAN ID. $5: Gateway MAC address. |
Severity level |
5 |
Example |
ARP/5/ARP_BINDRULETOHW_FAILED: Failed to download binding rule to hardware on the interface Ethernet1/0/1, SrcIP 1.1.1.132, SrcMAC 0015-E944-A947, VLAN 1, Gateway MAC 00A1-B812-1108. |
Explanation |
The system failed to set a binding rule to the hardware on an interface. The message is sent in any of the following situations: · The resources are not sufficient for the operation. · The memory is not sufficient for the operation. · A hardware error occurs. |
Recommended action |
To resolve the problem: 1. Execute the display qos-acl resource command to check if the ACL resources for the operation are sufficient. ¡ If yes, proceed to step 2. ¡ If no, delete unnecessary configuration to release ACL resources. If no configuration can be deleted, proceed to step 2. 2. Execute the display memory command to check if the memory for the operation is sufficient. ¡ If yes, proceed to step 3. ¡ If no, delete unnecessary configuration to release memory. If no configuration can be deleted, proceed to step 3. 3. Delete the configuration and perform the operation again. |
ARP_DETECTION_LOG
Message text |
Detected an ARP attack on interface [STRING]: IP [STRING], MAC [STRING], VLAN [STRING]. [UINT32] packet(s) dropped. |
Variable fields |
$1: Interface name. $2: IP address. $3: MAC address. $4: VLAN ID. $5: Number of dropped packets. |
Severity level |
5 |
Example |
ARP/5/ARP_INSPECTION: -MDC=1; Detected an ARP attack on interface GigabitEthernet1/0/1: IP 1.1.1.1, MAC 1-1-1, VLAN 100. 2 packet(s) dropped. |
Explanation |
An ARP attack was detected on an interface and attack packets were dropped. |
Recommended action |
Check the source of the ARP attack. |
ARP_DUPLICATE_IPADDR_DETECT
Message text |
Detected an IP address conflict. The device with MAC address [STRING] connected to interface [STRING] in VSI [STRING] and the device with MAC address [STRING] connected to interface [STRING] in VSI [STRING] were using the same IP address [IPADDR]. |
Variable fields |
$1: MAC address. $2: Interface name. (The interface can be a tunnel interface, Layer 3 interface, or Ethernet service instance.) $3: VSI name. $4: MAC address. $5: Interface name. (The interface can be a tunnel interface, Layer 3 interface, or Ethernet service instance.) $6: VSI name. $7: Conflicting IP address. |
Severity level |
6 |
Example |
Detected an IP address conflict. The device with MAC address 00-00-01 connected to interface Ethernet0/0/1 service-instance 1000 in VSI vpna and the device with MAC address 00-00-02 connected to interface tunnel 10 in VSI vpna were using the same IP address 192.168.1.1. |
Explanation |
This message is sent when an interface receives an ARP message in which the sender information conflicts with an existing ARP entry. The sender IP address is the same as the IP address in the entry, but the MAC addresses are different. |
Recommended action |
Change the IP address on either of the two devices. |
ARP_ENTRY_CONFLICT
Message text |
The software entry for [STRING] on [STRING] and the hardware entry did not have the same [STRING]. |
Variable fields |
$1: IP address. $2: VPN instance name. If the ARP entry belongs to the public network, this field displays the public network. $3: Inconsistent items: ¡ MAC address. ¡ output interface. ¡ output port. ¡ outermost layer VLAN ID. ¡ second outermost layer VLAN ID. ¡ VSI index. ¡ link ID. |
Severity level |
6 |
Example |
ARP/6/ARP_ENTRY_CONFLICT: The software entry for 1.1.1.1 on the VPN a and the hardware entry did not have the same MAC address, output port, VSI index, and link ID. ARP/6/ARP_ENTRY_CONFLICT: The software entry for 1.1.1.2 on the public network and the hardware entry did not have the same MAC address, output port, VSI index, and link ID. |
Explanation |
The software entry for the specified IP address is not the same as the hardware entry. For example, they do not have the same output interface. |
Recommended action |
No action is required. ARP automatically refreshes the hardware entries. |
ARP_HOST_IP_CONFLICT
Message text |
|
Variable fields |
$1: IP address. $2: Interface name. $3: Interface name. |
Severity level |
4 |
Example |
|
Explanation |
The sender IP address in a received ARP message conflicted with the IP address of a host connected to another interface. |
Recommended action |
Check whether the hosts that send the ARP messages are legitimate. Disconnect the illegal host from the network. |
ARP_RATE_EXCEEDED
Message text |
The ARP packet rate ([UINT32] pps) exceeded the rate limit ([UINT32] pps) on interface [STRING] in the last [UINT32] seconds. |
Variable fields |
$1: ARP packet rate. $2: ARP limit rate. $3: Interface name. $4: Interval time. |
Severity level |
4 |
Example |
ARP/4/ARP_RATE_EXCEEDED: The ARP packet rate (100 pps) exceeded the rate limit (80 pps) on interface Ethernet0/1/0 in the last 10 seconds. |
Explanation |
An interface received ARP messages at a higher rate than the rate limit. |
Recommended action |
Verify that the hosts at the sender IP addresses are legitimate. |
ARP_SENDER_IP_INVALID
Message text |
Sender IP [STRING] was not on the same network as the receiving interface [STRING]. |
Variable fields |
$1: IP address. $2: Interface name. |
Severity level |
6 |
Example |
ARP/6/ARP_SENDER_IP_INVALID: Sender IP 192.168.10.2 was not on the same network as the receiving interface Ethernet0/1/0. |
Explanation |
The sender IP of a received ARP message was not on the same network as the receiving interface. |
Recommended action |
Verify that the host at the sender IP address is legitimate. |
ARP_SENDER_MAC_INVALID
Message text |
Sender MAC [STRING] was not identical to Ethernet source MAC [STRING] on interface [STRING]. |
Variable fields |
$1: MAC address. $2: MAC address. $3: Interface name. |
Severity level |
6 |
Example |
ARP/6/ARP_SENDER_MAC_INVALID: Sender MAC 0000-5E14-0E00 was not identical to Ethernet source MAC 0000-5C14-0E00 on interface Ethernet0/1/0. |
Explanation |
An interface received an ARP message. The sender MAC address in the message body was not identical to the source MAC address in the Ethernet header. |
Recommended action |
Verify that the host at the sender MAC address is legitimate. |
ARP_SENDER_SMACCONFLICT
Message text |
Packet was discarded because its sender MAC address was the MAC address of the receiving interface. Interface: [STRING], sender IP: [STRING], target IP: [STRING]. |
Variable fields |
$1: Interface name. $2: Sender IP address. $3: Target IP address. |
Severity level |
6 |
Example |
Packet discarded for the sender MAC address is the same as the receiving interface. Interface: GE1/0/1 sender IP: 1.1.2.2 target IP: 1.1.2.1, |
Explanation |
The sender MAC address of a received ARP packet conflicts with the MAC address of the device. |
Recommended action |
No action is required. |
ARP_SENDER_SMACCONFLICT_VSI
Message text |
Packet was discarded because its sender MAC address was the MAC address of the receiving interface. Interface: [STRING], sender IP: [STRING], target IP: [STRING],VSI index: [UINT32], link ID: [UINT32]. |
Variable fields |
$1: Interface name. $2: Sender IP address. $3: Target IP address. $4: VSI index. $5: Link ID. |
Severity level |
6 |
Example |
Packet discarded for the sender MAC address is the same as the receiving interface. Interface: VSI3 sender IP: 1.1.2.2 target IP: 1.1.2.1, VSI Index: 2, Link ID: 0 |
Explanation |
The sender MAC address of a received ARP packet conflicts with the MAC address of the device. The receiving interface is a VSI interface. |
Recommended action |
No action is required. |
ARP_SRC_MAC_FOUND_ATTACK
Message text |
An attack from MAC [STRING] was detected on interface [STRING]. |
Variable fields |
$1: MAC address. $2: Interface name. |
Severity level |
6 |
Example |
ARP/6/ARP_SRC_MAC_FOUND_ATTACK: An attack from MAC 0000-5E14-0E00 was detected on interface Ethernet0/1/0. |
Explanation |
The source MAC-based ARP attack detection feature received more ARP packets from the same MAC address within 5 seconds than the specified threshold. This message indicates the risk of attacks. |
Recommended action |
Verify that the host at the source MAC address is legitimate. |
ARP_SUP_ENABLE_FAILED
Message text |
Failed to enable ARP flood suppression on VSI [string]. |
Variable fields |
$1: VSI name. |
Severity level |
4 |
Example |
ARP/4/ARP_SUP_ENABLE_FAILED: -MDC=1; Failed to enable ARP flood suppression on VSI vpna. |
Explanation |
This message is sent when the system failed to enable ARP flood suppression for a VSI. The minimum interval between two log messages is 2 seconds. To prevent the system from failing to send the message, wait for a minimum of 2 seconds before you enable ARP flood suppression for another VSI. |
Recommended action |
1. Verify that the device supports ARP flood suppression. 2. Verify that the hardware resources are sufficient. |
ARP_TARGET_IP_INVALID
Message text |
Target IP [STRING] was not the IP of the receiving interface [STRING]. |
Variable fields |
$1: IP address. $2: Interface name. |
Severity level |
6 |
Example |
ARP/6/ARP_TARGET_IP_INVALID: Target IP 192.168.10.2 was not the IP of the receiving interface Ethernet0/1/0. |
Explanation |
The target IP address of a received ARP message was not the IP address of the receiving interface. |
Recommended action |
Verify that the host at the sender IP address is legitimate. |
ARP_THRESHOLD_REACHED
Message text |
The alarm threshold for dynamic ARP entry learning was reached on interface [STRING]. |
Variable fields |
$1: Interface name. |
Severity level |
4 |
Example |
ARP/4/ ARP_THRESHOLD_REACHED: The alarm threshold for dynamic ARP entry learning was reached on interface GigabitEthernet1/0/1. |
Explanation |
This message is sent when the alarm threshold for dynamic ARP learning was reached on an interface. |
Recommended action |
Verify that the number of learned dynamic ARP entries matches the actual number of devices in the network, and no ARP attack sources exist in the network. |
DUPIFIP
Message text |
Duplicate address [STRING] on interface [STRING], sourced from [STRING]. |
Variable fields |
$1: IP address. $2: Interface name. $3: MAC Address. |
Severity level |
6 |
Example |
ARP/6/DUPIFIP: Duplicate address 1.1.1.1 on interface Ethernet1/1/1, sourced from 0015-E944-A947. |
Explanation |
ARP detected a duplicate address. The sender IP in the received ARP packet was being used by the receiving interface. |
Recommended action |
Modify the IP address configuration. |
DUPIP
Message text |
IP address [STRING] conflicted with global or imported IP address, sourced from [STRING]. |
Variable fields |
$1: IP address. $2: MAC Address. |
Severity level |
6 |
Example |
ARP/6/DUPIP: IP address 30.1.1.1 conflicted with global or imported IP address, sourced from 0000-0000-0001. |
Explanation |
The sender IP address of the received ARP packet conflicted with the global or imported IP address. |
Recommended action |
Modify the IP address configuration. |
DUPVRRPIP
Message text |
IP address [STRING] conflicted with VRRP virtual IP address on interface [STRING], sourced from [STRING]. |
Variable fields |
$1: IP address. $2: Interface name. $3: MAC address. |
Severity level |
6 |
Example |
ARP/6/DUPVRRPIP: IP address 1.1.1.1 conflicted with VRRP virtual IP address on interface Ethernet1/1/1, sourced from 0015-E944-A947. |
Explanation |
The sender IP address of the received ARP packet conflicted with the VRRP virtual IP address. |
Recommended action |
Modify the IP address configuration. |
ATK messages
This section contains attack detection and prevention messages.
ATK_ICMP_ADDRMASK_REQ
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
Severity level |
5 |
Example |
ATK/5/ATK_ICMP_ADDRMASK_REQ: IcmpType(1058)=17; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
Explanation |
This message is sent when ICMP address mask request logs are aggregated. |
Recommended action |
No action is required. |
ATK_ICMP_ADDRMASK_REQ_RAW
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
Severity level |
5 |
Example |
ATK/5/ATK_ICMP_ADDRMASK_REQ_RAW: IcmpType(1058)=17; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
Explanation |
If log aggregation is enabled, for ICMP address mask requests of the same attributes, this message is sent only when the first request is received. If log aggregation is disabled, this message is sent every time an ICMP address mask request is received. |
Recommended action |
No action is required. |
ATK_ICMP_ADDRMASK_REQ_RAW_SZ
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
Severity level |
5 |
Example |
ATK/5/ATK_ICMP_ADDRMASK_REQ_RAW_SZ: IcmpType(1058)=17; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
Explanation |
If log aggregation is enabled, for ICMP address mask requests of the same attributes, this message is sent only when the first request is received. If log aggregation is disabled, this message is sent every time an ICMP address mask request is received. |
Recommended action |
No action is required. |
ATK_ICMP_ADDRMASK_REQ_SZ
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
Severity level |
5 |
Example |
ATK/5/ATK_ICMP_ADDRMASK_REQ_SZ: IcmpType(1058)=17; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
Explanation |
This message is sent when ICMP address mask request logs are aggregated. |
Recommended action |
No action is required. |
ATK_ICMP_ADDRMASK_RPL
Message text |
IcmpType( |