Login
- Released At: 27-03-2025
- Page Views:
- Downloads:
- Table of Contents
- Related Documents
-
|
|
|
H3C CR16000-M System Log Messages Reference |
|
|
|
|
|
|
Copyright © 2025 New H3C Technologies Co., Ltd. All rights reserved.
No part of this manual may be reproduced or transmitted in any form or by any means without prior written consent of New H3C Technologies Co., Ltd.
Except for the trademarks of New H3C Technologies Co., Ltd., any trademarks that may be mentioned in this document are the property of their respective owners.
The information in this document is subject to change without notice.
Contents
Managing and obtaining system log messages
Obtaining log messages from the console terminal
Obtaining log messages from a monitor terminal
Obtaining log messages from the log buffer
Obtaining log messages from the log file
Obtaining log messages from a log host
ACL_ACCELERATE_NONCONTIGUOUSMASK
ACL_ACCELERATE_NOT_SUPPORTHOPBYHOP
ACL_ACCELERATE_NOT_SUPPORTMULTITCPFLAG
ARP_ACTIVE_ACK_NOREQUESTED_REPLY
ARP_INTERFACE_THRESHOLD_EXCEED
ARP_USER_DUPLICATE_IPADDR_DETECT
ATK_ICMPV6_DEST_UNREACH_RAW_SZ
ATK_ICMPV6_GROUPREDUCTION_RAW_SZ
ATK_ICMPV6_PACKETTOOBIG_RAW_SZ
ATK_IP4_TCP_INVALIDFLAGS_RAW_SZ
ATK_IP6_TCP_INVALIDFLAGS_RAW_SZ
ATK_IPOPT_LOOSESRCROUTE_RAW_SZ
ATK_IPOPT_STRICTSRCROUTE_RAW_SZ
ATK_IPV6_EXT_HEADER_ABNORMAL_RAW_SZ
ATK_IPV6_EXT_HEADER_ABNORMAL_SZ
CLKM_SOURCE_FREQDEVIATION_ALARM
CLKM_SOURCE_FREQDEVIATION_NORMAL
DHCPS_WARNING_EXHAUSTIONRECOVER
DHCPS6_IP_NET_THRESHOLD_EXCEED
DHCPS6_IP_WARNING_EXHAUSTRECOVER
DHCPS6_PD_NET_THRESHOLD_EXCEED
DHCPS6_PD_WARNING_EXHAUSTRECOVER
DHCPS6_POOLGP_EXHAUSTION_RECOV
DHCPS6_POOLGP_THRESHOLD_EXCEED
DIAG_DMA_MEM_CRITICAL_THRESHOLD
KERNEL_MEMFRAGMT_BELOW_THRESHOLD
KERNEL_MEMFRAGMT_EXCEED_THRESHOLD
DOMAIN_IPV6_WEB_SERVER_NOT_REACH
DOMAIN_IPV6_WEB_SERVER_URL_SWITCH
DOMAIN_ND_PREF_LOWTHR_ALM_REMOVE
DOMAIN_ND_PREF_UPTHR_ALM_REMOVE
DOMAIN_PD_PREF_LOWTHR_ALM_REMOVE
DOMAIN_PD_PREF_UPTHR_ALM_REMOVE
DOT1X_CLEAR_MAX_USER_THRESHOLD
EDEV_FAILOVER_GROUP_STATE_CHANGE
ETH_VLAN_TERMINATION_NOT_SUPPORT
ETHOAM_CONNECTION_FAIL_TIMEOUT
ETHOAM_CONNECTION_FAIL_UNSATISF
ETHOAM_ENTER_LOOPBACK_CTRLLING
ETHOAM_LOCAL_ERROR_FRAME_PERIOD
ETHOAM_LOCAL_ERROR_FRAME_SECOND
ETHOAM_LOOPBACK_EXIT_ERROR_STATU
ETHOAM_REMOTE_ERROR_FRAME_PERIOD
ETHOAM_REMOTE_ERROR_FRAME_SECOND
FLEXE_BANDWIDTH_MISMATCH_RECOVER
FLEXE_BANDWIDTH_REDUCE_RECOVER
FLEXE_CLIENTID_MISMATCH_RECOVER
FLEXE_GROUPMEMBER_FAULT_RECOVER
FLEXE_PHYGROUP_MISMATCH_RECOVER
IP6ADDR_CREATEADDRESS_CONFLICT
IP_ADD_INTERFACE_ANTITCPSYNFLD
IP_DEL_INTERFACE_ANTITCPSYNFLD
IP_INSERT_FAILED_ANTITCPSYNFLD
IP_SETTING_FAILED_ANTITCPSYNFLD
IPFW_FRAGPKTNUM_EXCALARMRESUME
IPOE_DEFENSE_ENTRIES_DRV_FAILED
IPOE_SESSIONS_LOWER_THRESHOLD (non-vBRAS-CPs)
IPOE_SESSIONS_LOWER_THRESHOLD (vBRAS-CPs)
IPOE_SESSIONS_LOWER_RECOVER (non-vBRAS-CPs)
IPOE_SESSIONS_LOWER_RECOVER (vBRAS-CPs)
IPOE_SESSIONS_UPPER_THRESHOLD (non-vBRAS-CPs)
IPOE_SESSIONS_UPPER_THRESHOLD (vBRAS-CPs)
IPOE_SESSIONS_UPPER_RECOVER (non-vBRAS-CPs)
IPOE_SESSIONS_UPPER_RECOVER (vBRAS-CPs)
ISIS_LSP_TOO_LARGE_TO_PROPAGATE
L2TPV2_ADJUST_CFG_DELIVER_FAILED (non-vBRAS-CPs)
L2TPV2_LOSS_RATIO_EXCEED_THRESHOLD (UPs)
L2TPV2_LOSS_RATIO_RECOVER_NORMAL (UPs)
L2TPV2_LOSS_RATIO_EXCEED_THRESHOLD (non-vBRAS-CPs)
L2TPV2_LOSS_RATIO_RECOVER_NORMAL (non-vBRAS-CPs)
L2TPV2_SESSIONS_LOWER_THRESHOLD (non-vBRAS-CPs)
L2TPV2_SESSIONS_LOWER_THRESHOLD (vBRAS-CPs)
L2TPV2_SESSIONS_LOWER_RECOVER (non-vBRAS-CPs)
L2TPV2_SESSIONS_LOWER_RECOVER (vBRAS-CPs)
L2TPV2_SESSIONS_UPPER_THRESHOLD (non-vBRAS-CPs)
L2TPV2_SESSIONS_UPPER_THRESHOLD (vBRAS-CPs)
L2TPV2_SESSIONS_UPPER_RECOVER (non-vBRAS-CPs)
L2TPV2_SESSIONS_UPPER_RECOVER (vBRAS-CPs)
L2TPV2_TUNNEL_ADD_DRIVER_FAILED
LAGG_INACTIVE_DRNI_PRIORITY_WRONG
LAGG_INACTIVE_DRNI_SPEED_WRONG
LAGG_INACTIVE_PARTNER_KEY_WRONG
LAGG_INACTIVE_PARTNER_MAC_WRONG
LAGG_INACTIVE_RESOURCE_INSUFICIE
NAT_EIM_MODE_PORT_USAGE_RECOVER
NAT_PORTBLOCKGRP_MEMORY_WARNING
NAT_SERVICE_CARD_RECOVER_FAILURE
ND_SET_VLAN_REDIRECT_NORESOURCE
NETSLICING_NO_ENOUGH_HARDWARE_RESOURCE
NETSLICING_NOT_SUPPORT_PROTOCOLNUM
NETSLICING_NOTSET_CHANNELBANDWIDTH
NQA_TWAMP_LIGHT_PACKET_INVALID
NQA_TWAMP_LIGHT_SENDER_START_FAILURE
OFC_DATAPATH_CHANNEL_DISCONNECT
OFP_ACTIVE_MAC_LEARN_FORBIDDEN_F
OFP_FLOW_ADD_TABLE_MISS_FAILED
OFP_FLOW_DEL_TABLE_MISS_FAILED
OFP_FLOW_MOD_TABLE_MISS_FAILED
PFILTER_VLAN_IPV4_DACT_UNK_ERR
PFILTER_VLAN_IPV6_DACT_UNK_ERR
PKI_REQUEST_LOCAL_CERT_FAIL_LDAP
PKI_REQUEST_LOCAL_CERT_FAIL_SCEP
PKI_REQUEST_LOCAL_CERT_SUCCESS_LDAP
PKI_REQUEST_LOCAL_CERT_SUCCESS_SCEP
PPP_SESSIONS_LOWER_THRESHOLD (non-vBRAS-CPs)
PPP_SESSIONS_LOWER_THRESHOLD (vBRAS-CPs)
PPP_SESSIONS_LOWER_RECOVER (non-vBRAS-CPs)
PPP_SESSIONS_LOWER_RECOVER (vBRAS-CPs)
PPP_SESSIONS_UPPER_THRESHOLD (non-vBRAS-CPs)
PPP_SESSIONS_UPPER_THRESHOLD (vBRAS-CPs)
PPP_SESSIONS_UPPER_RECOVER (non-vBRAS-CPs)
PPP_SESSIONS_UPPER_RECOVER (vBRAS-CPs)
PPPOES_LOSS_RATIO_EXCEED_THRESHOLD
PPPOES_LOSS_RATIO_RECOVER_NORMAL
PPPOES_SESSION_ADD_DRIVER_FAILED
PPPOES_SESSIONS_LOWER_THRESHOLD
PPPOES_SESSIONS_RECOVER_NORMAL
PPPOES_SESSIONS_UPPER_THRESHOLD
PTP_TIME_OFFSE_EXCEED_THRESHOLD
QOS_QMPROFILE_MODIFYQUEUE_FAIL
PRO_WHITELIST_QUEUE_CONGEST_ATK
SRPV6_SEGLIST_STATE_DOWN_CLEAR
SSHS_SFTP_EXECUTED_REMOVE_OPER
SSHS_SFTP_EXECUTED_RENAME_OPER
STRUNK_DROPPACKET_INCONSISTENCY
UCM_APPLY_PPPOEA_FWD_POLICY_FAIL (non-vBRAS-CPs)
UCM_APPLY_PPPOEA_RELAY_FAIL (non-vBRAS-CPs)
UCM_LOSS_RATIO_EXCEED_THRESHOLD
UCM_PPPOE_AGENCY_LOGON_SUCCESS (non-vBRAS-CPs)
UCM_SESSIONS_LOWER_THRESHOLD (non-vBRAS-CPs)
UCM_SESSIONS_LOWER_THRESHOLD (vBRAS-CPs)
UCM_SESSIONS_LOWER_RECOVER (non-vBRAS-CPs)
UCM_SESSIONS_LOWER_RECOVER (vBRAS-CPs)
UCM_SESSIONS_UPPER_THRESHOLD (non-vBRAS-CPs)
UCM_SESSIONS_UPPER_THRESHOLD (vBRAS-CPs)
UCM_SESSIONS_UPPER_RECOVER (non-vBRAS-CPs)
UCM_SESSIONS_UPPER_RECOVER (vBRAS-CPs)
UCM_UP_SESSIONS_UPPER_THRESHOLD (vBRAS-CPs)
UCM_UP_SESSIONS_RECOVER_NORMAL (vBRAS-CPs)
UCM_USER_RECOVER_NORMAL (non-vBRAS-CPs)
UCM_USER_RECOVER_NORMAL (non-vBRAS-CPs)
UCM_USER_UPPER_THRESHOLD (non-vBRAS-CPs)
UCM_USER_UPPER_THRESHOLD (vBRAS-CPs)
UCM_USER_ONLINE_FAIL_ALARM (vBRAS-CPs)
Introduction
This document includes the following system messages:
· Messages specific to Release R8530P20 of the device.
· Messages for the Comware 7 software platform version based on which Release R8530P20 was produced. Some platform system messages might not be available on the device.
This document is intended only for managing CR16000-M devices. Do not use this document for any other device models.
This document assumes that the readers are familiar with data communications technologies and H3C networking products.
System log message format
By default, the system log messages use one of the following formats depending on the output destination:
· Log host:
<PRI>TIMESTAMP Sysname %%vendorMODULE/severity/MNEMONIC: location; CONTENT
· Destinations except for the log host:
Prefix TIMESTAMP Sysname MODULE/severity/MNEMONIC: CONTENT
|
|
NOTE: Log message examples in this document use the format for destinations except the log host. They do not contain elements available only for the log host, including the location element. |
Table 1 System log message elements
|
Element |
Description |
|
<PRI> |
Priority identifier. It is calculated by using the following formula: Priority identifier=facilityx8+severity Where: · Facility is specified by using the info-center loghost command. A log host uses this parameter to identify log sources and filter log messages. · Severity represents the importance of the message. For more information about severity levels, see Table 2 |
|
Prefix |
Message type identifier. This element is contained in the system log messages sent to non-log-host destinations. The element uses the following symbols to indicate message severity: · Percentage sign (%)—Informational and higher levels. · Asterisk (*)—Debug level. |
|
TIMESTAMP |
Date and time when the event occurred. The following are commands for configuring the timestamp format: · Log host—Use the info-center timestamp loghost command. · Non-log host destinations—Use the info-center timestamp command. |
|
Sysname |
Name or IP address of the device that generated the message. |
|
%%vendor |
Manufacturer flag. This element is %%10 for H3C. This element is contained only in messages sent to the log host. |
|
MODULE |
Name of the module that produced the message. |
|
severity |
Severity level of the message. (For more information about severity levels, see Table 2.) |
|
MNEMONIC |
Text string that uniquely identifies the system message. The maximum length is 32 characters. |
|
location |
Optional. This element identifies where the message occurred. This element is contained only in messages sent to the log host. This element presents location information for the message in the following format: -attribute1=x-attribute2=y…-attributeN=z The following are examples of location attributes: · -MDC=XX, which represents the MDC on which the message occurred. · -DevIp=XXX.XXX.XXX.XXX, which represents the source IP of the message. · -Slot=XX, which represents the slot on which the message occurred. · -Chassis=XX-Slot=XX, which represents the chassis and slot on which the message occurred. This element is separated from the message description by using a semicolon (;). |
|
CONTENT |
Text string that contains detailed information about the event or error. For variable fields in this element, this document uses the representations in Table 3. The CONTENT field in most log messages is represented by one or multiple sentences, for example, VTY logged in from 192.168.1.21. Certain log messages are used only to record parameter values. The CONTENT field for such messages is represented in the format of key info 1;key info 2,..key info n. The key information can be one of the following formats: · Keyword(keyword ID)=Value · Keyword(keyword ID)=(Text ID)Text description The IDs are factory default parameters that enable the log host software (for example, security management system) to parse keyword content: · The keyword ID represents the keyword before the ID. · The text ID represents the text description after the ID. For example, in the key information streamAlarmType(1032)=(42)Too fast speed of TCP session to destination IP, value 1032 represents keyword streamAlarmType, and value 42 represents text description Too fast speed of TCP session to destination IP. |
System log messages are classified into eight severity levels from 0 to 7. The lower the number, the higher the severity, as shown inTable 2.
Table 2 System log message severity levels
|
Level |
Severity |
Description |
|
0 |
Emergency |
The system is unusable. For example, the system authorization has expired. |
|
1 |
Alert |
Action must be taken immediately. For example, traffic on an interface exceeds the upper limit. |
|
2 |
Critical |
Critical condition. For example, the device temperature exceeds the upper limit, the power module fails, or the fan tray fails. |
|
3 |
Error |
Error condition. For example, the link state changes or a storage card is unplugged. |
|
4 |
Warning |
Warning condition. For example, an interface is disconnected, or the memory resources are used up. |
|
5 |
Notification |
Normal but significant condition. For example, a terminal logs in to the device, or the device reboots. |
|
6 |
Informational |
Informational message. For example, a command or a ping operation is executed. |
|
7 |
Debug |
Debugging message. |
For variable fields in the message text, this document uses the representations in Table 3. The values are case insensitive, even though the representations are uppercase letters.
Table 3 Variable field representations
|
Representation |
Information type |
|
INT16 |
Signed 16-bit decimal number. |
|
UINT16 |
Unsigned 16-bit decimal number. |
|
INT32 |
Signed 32-bit decimal number. |
|
UINT32 |
Unsigned 32-bit decimal number. |
|
INT64 |
Signed 64-bit decimal number. |
|
UINT64 |
Unsigned 64-bit decimal number. |
|
DOUBLE |
Two dot-separated signed 32-bit decimal numbers. The format is [INTEGER].[INTEGER]. |
|
HEX |
Hexadecimal number. |
|
CHAR |
Single character. |
|
STRING |
Character string. |
|
IPADDR |
IP address. |
|
MAC |
MAC address. |
|
DATE |
Date. |
|
TIME |
Time. |
Managing and obtaining system log messages
You can manage system log messages by using the information center.
By default, the information center is enabled. Log messages can be output to the console, monitor terminal, log buffer, log host, and log file.
To filter log messages, use the info-center source command to specify log output rules. A log output rule specifies the source modules and the lowest severity level of log messages that can be output to a destination. A log message is output if its severity level is higher than or equal to the specified level. For example, if you specify a severity level of 6 (informational), log messages that have a severity level from 0 to 6 are output.
For more information about using the information center, see the network management and monitoring configuration guide for the product.
Obtaining log messages from the console terminal
Access the device through the console port. Real-time log messages are displayed on the console terminal.
Obtaining log messages from a monitor terminal
Monitor terminals refer to terminals that access the device through the AUX, VTY, or TTY lines (for example, Telnet). To obtain log messages from a monitor terminal, use the following guidelines:
· To display log messages on the monitor terminal, you must configure the terminal monitor command.
· For monitor terminals, the lowest level of log messages that can be displayed is determined by both the terminal logging level and info-center source commands.
|
|
NOTE: Settings for the terminal monitor and terminal logging level commands take effect only on the current login session. The default settings for the commands restore at a relogin. |
Obtaining log messages from the log buffer
Use the display logbuffer command to display history log messages in the log buffer.
Obtaining log messages from the log file
By default, the log file feature automatically saves logs from the log file buffer to the log file every 24 hours. You can use the info-center logfile frequency command to change the automatic saving internal.
To manually save logs to the log file, use the logfile save command. The log file buffer is cleared each time a save operation is performed.
By default, you can obtain the log file from the cfa0:/logfile/ path if the CF card is not partitioned. If the CF card is partitioned, the file path is cfa1:/logfile/.
To view the contents of the log file on the device, use the more command.
Obtaining log messages from a log host
Use the info-center loghost command to specify the service port number and IP address of a log host. To specify multiple log hosts, repeat the command.
For a successful log message transmission, make sure the specified port number is the same as the port number used on the log host. The default service port number is 514.
Software module list
Table 4 lists all software modules that might produce system log messages. This document uses "OPENSRC" to represent all open source modules.
|
Module name representation |
Module name expansion |
|
AAA |
Authentication, Authorization and Accounting |
|
ACL |
Access Control List |
|
ANCP |
Access Node Control Protocol |
|
ARP |
Address Resolution Protocol |
|
ATK |
Attack Detection and Prevention |
|
ATM |
|
|
BFD |
Bidirectional Forwarding Detection |
|
BGP |
Border Gateway Protocol |
|
BIER |
Bit Index Explicit Replication |
|
CFGMAN |
Configuration Management |
|
CLKM |
Clock Monitoring |
|
CONNLMT |
Connection Limit |
|
DEV |
Device Management |
|
DHCPR |
IPv4 DHCP Relay |
|
DHCPS |
DHCP Server |
|
DHCPS6 |
DHCPv6 Server |
|
DHCPSP4 |
DHCP Snooping |
|
DHCPSP6 |
DHCPv6 Snooping |
|
DIAG |
Diagnosis |
|
DLDP |
Device Link Detection Protocol |
|
DOT1X |
802.1X |
|
EDEV |
|
|
EIGRP |
Enhanced Interior Gateway Routing Protocol |
|
ETH |
Ethernet |
|
ETHOAM |
Ethernet Operation, Administration and Maintenance |
|
FIB |
Forwarding Information Base |
|
FILTER |
Filter |
|
gRPC |
Google Remote Procedure Call |
|
HA |
High Availability |
|
HQOS |
Hierarchical QoS |
|
iFIT |
In-situ Flow Information Telemetry |
|
IFMON |
Interface Monitor |
|
IFNET |
Interface Net Management |
|
IGMP |
Internet Group Management Protocol |
|
IKE |
Internet Key Exchange |
|
IP6ADDR |
IPv6 Addressing |
|
IP6FW |
IPv6 Forwarding |
|
IPADDR |
IP Addressing |
|
IPFW |
IP Forwarding |
|
IPOE |
IP over Ethernet |
|
IPSEC |
IP Security |
|
IRDP |
ICMP Router Discovery Protocol |
|
IRF |
Intelligent Resilient Framework |
|
ISIS |
Intermediate System-to-Intermediate System |
|
L2TPV2 |
Layer 2 Tunneling Protocol Version 2 |
|
L2VPN |
Layer 2 VPN |
|
LAGG |
Link Aggregation |
|
LDP |
Label Distribution Protocol |
|
LIPC |
Leopard Inter-process Communication |
|
LLDP |
Link Layer Discovery Protocol |
|
LOAD |
Load Management |
|
LOCAL |
Local |
|
LOGIN |
Login |
|
LPDT |
Loopback Detection |
|
LS |
Local Server |
|
LSM |
Label Switch Management |
|
LSPV |
LSP Verification |
|
MAC |
Media Access Control |
|
MBFD |
MPLS BFD |
|
MBUF |
Memory Buffer |
|
MFIB |
Multicast Forwarding Information Base |
|
MGROUP |
Mirroring group |
|
MPLS |
Multiprotocol Label Switching |
|
MTLK |
Monitor Link |
|
MTP |
Maintenance Probe |
|
NAT |
Network Address Translation |
|
ND |
Neighbor Discovery |
|
NETCONF |
Network Configuration Protocol |
|
NQA |
Network Quality Analyzer |
|
NTP |
Network Time Protocol |
|
OFP |
OpenFlow Protocol |
|
OPTMOD |
Optical Module |
|
OSPF |
Open Shortest Path First |
|
OSPFV3 |
Open Shortest Path First Version 3 |
|
PBR |
Policy-Based Routing |
|
PFILTER |
Packet Filter |
|
PIM |
Protocol Independent Multicast |
|
PING |
Packet Internet Groper |
|
PKI |
Public Key Infrastructure |
|
PKT2CPU |
Packet to CPU |
|
PKTCPT |
Packet Capture |
|
PORTAL |
Portal |
|
PPP |
Point to Point Protocol |
|
PTP |
Precision Time Protocol |
|
PWDCTL |
Password Control |
|
QOS |
Quality of Service |
|
RADIUS |
Remote Authentication Dial In User Service |
|
RESMON |
Resource Monitor |
|
RIP |
Routing Information Protocol |
|
RIPNG |
Routing Information Protocol Next Generation |
|
RM |
Routing Management |
|
RSVP |
Resource Reservation Protocol |
|
RTM |
Real-Time Event Manager |
|
SAVA |
Source Address Validation Architecture |
|
SCRLSP |
Static CRLSP |
|
SESSION |
Session |
|
SHELL |
Shell |
|
SLSP |
Static LSP |
|
SNMP |
Simple Network Management Protocol |
|
SRPV6 |
SRv6-TE Policy |
|
SRV6 |
SRv6 |
|
SSHC |
Secure Shell Client |
|
SSHS |
Secure Shell Server |
|
STM |
Stack Topology Management |
|
STP |
Spanning Tree Protocol |
|
STRUNK |
Smart Trunk |
|
SYSEVENT |
System Event |
|
SYSLOG |
System Log |
|
TACACS |
Terminal Access Controller Access Control System |
|
TE |
Traffic Engineering |
|
UCM |
User Connection Management |
|
URPF |
Unicast Reverse Path Forwarding |
|
VLAN |
Virtual Local Area Network |
|
VRRP |
Virtual Router Redundancy Protocol |
|
VSRP |
Virtual Service Redundancy Protocol |
|
VXLAN |
Virtual eXtensible LAN |
Using this document
This document categorizes system log messages by software module. The modules are ordered alphabetically. Except for OPENSRC, the system log messages for each module are listed in alphabetic order of their mnemonic names. The OPENSRC messages are unordered because they use the same mnemonic name (SYSLOG). For each OPENSRC message, the section title uses a short description instead of the mnemonic name.
This document explains messages in tables. Table 5 describes information provided in these tables.
Table 5 Message explanation table contents
|
Item |
Content |
Example |
|
Message text |
Presents the message description. |
ACL [UINT32] [STRING] [UINT64] packet(s). |
|
Variable fields |
Briefly describes the variable fields in the order that they appear in the message text. The variable fields are numbered in the "$Number" form to help you identify their location in the message text. |
$1: ACL number. $2: ID and content of an ACL rule. $3: Number of packets that matched the rule. |
|
Severity level |
Provides the severity level of the message. |
6 |
|
Example |
Provides a real message example. The examples do not include the "<PRI>TIMESTAMP Sysname %%vendor" part or the "Prefix TIMESTAMP Sysname" part, because information in this part varies with system settings. |
ACL/6/ACL_STATIS_INFO: ACL 2000 rule 0 permit source 1.1.1.1 0 logging 10000 packet(s). |
|
Explanation |
Explains the message, including the event or error cause. |
Number of packets that matched an ACL rule. This message is sent when the packet counter changes. |
|
Recommended action |
Provides recommended actions. For informational messages, no action is required. |
No action is required. |
AAA messages
This section contains AAA messages.
AAA_ADMIN_LOGIN_FAILED_ACTIVE
|
Message text |
Administrative user login failed too frequently. Failures=[UINT32], statistics period=[UINT32] min. |
|
Variable fields |
$1: Number of login failures. $2: Statistics collection period in minutes. |
|
Severity level |
4 |
|
Example |
AAA/4/AAA_ADMIN_LOGIN_FAILED_ACTIVE: Administrative user login failed too frequently. Failures=[35], statistics period=[10] min. |
|
Explanation |
The number of administrative user login failures reached the alarm threshold during a statistics collection period or increased from a value below the recovery threshold to the alarm threshold. |
|
Recommended action |
1. The system may be under login attacks. Contact the system administrator. 2. The user forgot the username or password. Contact the system administrator to retrieve the correct username or password. |
AAA_ADMIN_LOGIN_FAILED_CLEAR
|
Message text |
Number of administrative user login failures dropped below the alarm clearing threshold. Failures=[UINT32], statistics period=[UINT32] min. |
|
Variable fields |
$1: Number of login failures. $2: Statistics collection period in minutes. |
|
Severity level |
5 |
|
Example |
AAA/5/AAA_ADMIN_LOGIN_FAILED_CLEAR: Number of administrative user login failures dropped below the alarm clearing threshold. Failures=[14], statistics period=[10] min. |
|
Explanation |
The number of administrative user login failures dropped below the recovery threshold during a statistics collection period. |
|
Recommended action |
No action is required. |
AAA_FAILURE
|
Message text |
-AAAType=[STRING]-AAADomain=[STRING]-Service=[STRING]-UserName=[STRING]; AAA failed. |
|
Variable fields |
$1: AAA type. $2: AAA scheme. $3: Service. $4: Username. |
|
Severity level |
5 |
|
Example |
AAA/5/AAA_FAILURE: -AAAType=AUTHOR-AAADomain=domain1-Service=login-UserName=cwf@system; AAA failed. |
|
Explanation |
An AAA request was rejected. The following are the common reasons: · No response was received from the server. · The username or password was incorrect. · The service type that the user applied for was incorrect. |
|
Recommended action |
1. Verify that the device is correctly connected to the server. 2. Enter the correct username and password. 3. Verify that the server settings are the same as the settings on the device. 4. If the problem persists, contact H3C Support. |
AAA_LAUNCH
|
Message text |
-AAAType=[STRING]-AAADomain=[STRING]-Service=[STRING]-UserName=[STRING]; AAA launched. |
|
Variable fields |
$1: AAA type. $2: AAA scheme. $3: Service. $4: Username. |
|
Severity level |
6 |
|
Example |
AAA/6/AAA_LAUNCH: -AAAType=AUTHEN-AAADomain=domain1-Service=login-UserName=cwf@system; AAA launched. |
|
Explanation |
An AAA request was received. |
|
Recommended action |
No action is required. |
AAA_SUCCESS
|
Message text |
-AAAType=[STRING]-AAADomain=[STRING]-Service=[STRING]-UserName=[STRING]; AAA succeeded. |
|
Variable fields |
$1: AAA type. $2: AAA scheme. $3: Service. $4: Username. |
|
Severity level |
6 |
|
Example |
AAA/6/AAA_SUCCESS: -AAAType=AUTHOR-AAADomain=domain1-Service=login-UserName=cwf@system; AAA succeeded. |
|
Explanation |
An AAA request was accepted. |
|
Recommended action |
No action is required. |
ACL messages
This section contains ACL messages.
ACL_ACCELERATE_NO_RES
|
Message text |
Failed to accelerate [STRING] ACL [UINT32]. The resources are insufficient. |
|
Variable fields |
$1: ACL type. $2: ACL number. |
|
Severity level |
4 |
|
Example |
ACL/4/ACL_ACCELERATE_NO_RES: Failed to accelerate IPv6 ACL 2001. The resources are insufficient. |
|
Explanation |
Hardware resources were insufficient for accelerating an ACL. |
|
Recommended action |
Delete some rules or disabled ACL acceleration for other ACLs to release hardware resources. |
ACL_ACCELERATE_NONCONTIGUOUSMASK
|
Message text |
Failed to accelerate ACL [UINT32]. ACL acceleration supports only contiguous wildcard masks. |
|
Variable fields |
$1: ACL number. |
|
Severity level |
4 |
|
Example |
ACL/4/ACL_ACCELERATE_NONCONTIGUOUSMASK: Failed to accelerate ACL 2001. ACL acceleration supports only contiguous wildcard masks. |
|
Explanation |
ACL acceleration failed because rules containing noncontiguous wildcard masks exist in the ACL. |
|
Recommended action |
Check the ACL rules and delete the unsupported configuration. |
ACL_ACCELERATE_NOT_SUPPORT
|
Message text |
Failed to accelerate [STRING] ACL [UINT32]. The operation is not supported. |
|
Variable fields |
$1: ACL type. $2: ACL number. |
|
Severity level |
4 |
|
Example |
ACL/4/ACL_ACCELERATE_NOT_SUPPORT: Failed to accelerate IPv6 ACL 2001. The operation is not supported. |
|
Explanation |
ACL acceleration failed because the system does not support ACL acceleration. |
|
Recommended action |
No action is required. |
ACL_ACCELERATE_NOT_SUPPORTHOPBYHOP
|
Message text |
Failed to accelerate IPv6 ACL [UINT32]. ACL acceleration does not support the rules that contain the hop-by-hop keywords. |
|
Variable fields |
$1: ACL number. |
|
Severity level |
4 |
|
Example |
ACL/4/ACL_ACCELERATE_NOT_SUPPORTHOPBYHOP: Failed to accelerate IPv6 ACL 2001. ACL acceleration does not support the rules that contain the hop-by-hop keywords. |
|
Explanation |
ACL acceleration failed for the IPv6 ACL because rules containing the hop-by-hop keyword exist in the ACL. |
|
Recommended action |
Check the ACL rules and delete the unsupported configuration. |
ACL_ACCELERATE_NOT_SUPPORTMULTITCPFLAG
|
Message text |
Failed to accelerate IPv6 ACL [UINT32]. ACL acceleration does not support specifying multiple TCP flags in one rule. |
|
Variable fields |
$1: ACL number. |
|
Severity level |
4 |
|
Example |
ACL/4/ACL_ACCELERATE_NOT_SUPPORTMULTITCPFLAG: Failed to accelerate IPv6 ACL 2001. ACL acceleration does not support specifying multiple TCP flags in one rule. |
|
Explanation |
ACL acceleration failed for the IPv6 ACL because rules containing multiple TCP flags exist in the ACL. |
|
Recommended action |
Check the ACL rules and delete the unsupported configuration. |
ACL_ACCELERATE_UNK_ERR
|
Message text |
Failed to accelerate [STRING] ACL [UINT32]. |
|
Variable fields |
$1: ACL type. $2: ACL number. |
|
Severity level |
4 |
|
Example |
ACL/4/ACL_ACCELERATE_UNK_ERR: Failed to accelerate IPv6 ACL 2001. |
|
Explanation |
ACL acceleration failed because of an unknown error. |
|
Recommended action |
No action is required. |
ACL_IPV6_STATIS_INFO
|
Message text |
IPv6 ACL [UINT32] [STRING] [UINT64] packet(s). |
|
Variable fields |
$1: ACL number. $2: ID and content of an IPv6 ACL rule. $3: Number of packets that matched the rule. |
|
Severity level |
6 |
|
Example |
ACL/6/ACL_IPV6_STATIS_INFO: IPv6 ACL 2000 rule 0 permit source 1:1::/64 logging 1000 packet(s). |
|
Explanation |
The number of packets matching the IPv6 ACL rule changed. |
|
Recommended action |
No action is required. |
ACL_NO_MEM
|
Message text |
Failed to configure [STRING] ACL [UINT] due to lack of memory. |
|
Variable fields |
$1: ACL type. $2: ACL number. |
|
Severity level |
3 |
|
Example |
ACL/3/ACL_NO_MEM: Failed to configure ACL 2001 due to lack of memory. |
|
Explanation |
Configuring the ACL failed because memory is insufficient. |
|
Recommended action |
Use the display memory-threshold command to check the memory usage. |
ACL_STATIS_INFO
|
Message text |
ACL [UINT32] [STRING] [UINT64] packet(s). |
|
Variable fields |
$1: ACL number. $2: ID and content of an IPv4 ACL rule. $3: Number of packets that matched the rule. |
|
Severity level |
6 |
|
Example |
ACL/6/ACL_STATIS_INFO: ACL 2000 rule 0 permit source 1.1.1.1 0 logging 10000 packet(s). |
|
Explanation |
The number of packets matching the IPv4 ACL rule changed. |
|
Recommended action |
No action is required. |
AFT messages
This section contains AFT messages.
AFT_ADDRESS_CONFLICT
|
Message text |
Address range (StartIp=[ IPADDR];EndIp=[ IPADDR]) assigned by the CP conflicts with an existing address group. |
|
Variable fields |
$1: Start IPv4 address. $2: End IPv4 address. |
|
Severity level |
6 |
|
Example |
AFT/6/AFT_ADDRESS_CONFLICT: Address range (StartIp=1.1.0.0;EndIp=1.1.0.255) assigned by the CP conflicts with an existing address group. |
|
Explanation |
On the control-/user-plane separated network, the address range that the CP assigned to the UP conflicts with an existing AFT address group on the UP. |
|
Recommended action |
Modify the AFT address group configuration on the UP. |
AFT_ADDRGRP_EXHAUST
|
Message text |
Address group resources were exhausted, GroupID=[UINT 16]. |
|
Variable fields |
$1: Address group ID. |
|
Severity level |
4 |
|
Example |
AFT/4/AFT_ADDRGRP_EXHAUST: Address group resources were exhausted, GroupID=1. |
|
Explanation |
This message is sent when resources in the AFT address group run out. |
|
Recommended action |
Add resources to the AFT address group. |
AFT_ADDRGRP_EXHAUST_RECOVER
|
Message text |
Address group resources recover, GroupID=[UINT 16]. |
|
Variable fields |
$1: Address group ID. |
|
Severity level |
5 |
|
Example |
AFT/5/AFT_ADDRGRP_EXHAUST_RECOVER: Address group resources recover, GroupID=1. |
|
Explanation |
This message is sent when the usage of resources in the AFT address group reaches or drops below 87.5%. |
|
Recommended action |
No action is required. |
AFT_EIM
|
Message text |
Protocol(1001)=[STRING];SrcIPv6Addr(1036)= [IPADDR];SrcPort(1004)= [UINT16];NatSrcIPAddr(1005)= [IPADDR];NatSrcPort(1006)= [UINT16]; AFTDstTrans(1216)=[STRING];RcvVPNInstance(1042)=[STRING];SndVPNInstance(1043)=[STRING];BeginTime_e(1013)=[STRING];EndTime_e(1014)=[STRING];Event(1048)=[STRING]; |
|
Variable fields |
$1: Protocol type. $2: Source IPv6 address. $3: Source port number. $4: Source IP address after translation. $5: Source port number after translation. $6: IPv6 prefix. $7: Source VPN instance name. $8: Destination VPN instance name. $9: Time when the EIM entry was created. $10: Time when the EIM entry was removed. $11: Event description: ¡ AFT EIM entry created. ¡ AFT EIM entry deleted. |
|
Severity level |
6 |
|
Example |
AFT/6/AFT_EIM: Protocol(1001)=UDP; SrcIPv6Addr(1036)=2001::1;SrcPort(1004)= 2000;NatSrcIPAddr(1005)=2.2.1.1;NatSrcPort(1006)=100; AFTDstTrans (1216)=2013:: 96;RcvVPNInstance(1042)=;SndVPNInstance(1043)=;BeginTime_e(1013)=10261971001739;EndTime_e(1014)=;Event(1048)=AFT EIM entry created; |
|
Explanation |
This message is sent when an AFT EIM entry is created or removed. |
|
Recommended action |
No action is required. |
AFT_LOG_FLOW
|
Message text |
AFT PORTBLOCK was [STRING]: IPv6addr=[IPADDR]; VPNNameV6=[STRING]; ipv4addr=[IPADDR]; VPNNameV4=[STRING]; PortBlockSize=[UINT16]-[UINT16]; BeginTime_e=[STRING]; EndTime_e=[STRING]. |
|
Variable fields |
$1: Event type: ¡ allocated—Port block assignment. ¡ free—Port block release. $2: IPv6 address. $3: Name of the VPN instance to which the IPv6 address belongs. $4: IPv4 address. $5: Name of the VPN instance to which the IPv4 address belongs.. $6: Start port number of a port block that is assigned. $7: End port number of a port block that is assigned. $8: Time when the port block is assigned. $9: Time when the port block is released. |
|
Severity level |
6 |
|
Example |
AFT/6/AFT_LOG_FLOW: AFT PORTBLOCK was free: IPv6addr=1000::1b; VPNNameV6=-; IPv4addr=10.0.0.140; VPNNameV4=-; PortBlockSize=1024-1535; BeginTime_e=03232017053558; EndTime_e=03232017065040. |
|
Explanation |
This message is generated when the port block is released or allocated. |
|
Recommended action |
No action is required. |
AFT_PORT_ALLOC_FAILED
|
Message text |
Port allocation failed, Protocol=[STRING]; OrigSrcIP=[IPADDR]; VPNInstance=[STRING]; AFTIP=[IPADDR]; VPNInstance=[STRING]. |
|
Variable fields |
$1: Protocol type. ¡ UDP: UDP protocol. ¡ TCP: TCP protocol. ¡ ICMP: ICMP protocol. ¡ TOTAL: All protocols. $2: Source IPv6 address. $3: Source IPv6 VPN name. $4: Source IP address after translation. $5: VPN instance after translation. |
|
Severity level |
4 |
|
Example |
AFT/4/AFT_PORT_ALLOC_FAILED: Port allocation failed, Protocol=UDP; OrigSrcIP=2001::1; VPNInstance=-; AFTIP =2.2.1.1; VPNInstance=-;. |
|
Explanation |
This message is sent when port allocation fails for port block-based AFT. |
|
Recommended action |
No port blocks are available for assignment. Add port block resources. |
AFT_PORT_EXHAUST_ALARM
|
Message text |
Usertable port resources were exhausted, Protocol=[STRING]; OrigSrcIP=[IPADDR]; VPNInstance=[STRING]; AFTIP=[IPADDR]; VPNInstance=[STRING]. |
|
Variable fields |
$1: Protocol type. ¡ UDP: UDP protocol. ¡ TCP: TCP protocol. ¡ ICMP: ICMP protocol. ¡ TOTAL: All protocols. $2: Source IPv6 address. $3: Source IPv6 VPN instance name. $4: Source IP address after translation. $5: VPN instance after translation. |
|
Severity level |
4 |
|
Example |
AFT/4/AFT_PORT_EXHAUST_ALARM: Usertable port resources were exhausted, Protocol=UDP; OrigSrcIP=2001::1; VPNInstance=-; AFTIP=2.2.1.1; VPNInstance=-. |
|
Explanation |
This message is sent in the following conditions: · The IPv4 port resources are used up. · The Endpoint-Independent Mapping mode is applied. |
|
Recommended action |
Add port resources. |
AFT_PORT_EXHAUST_RECOVER
|
Message text |
Usertable port resources recover, Protocol=[STRING]; OrigSrcIP=[IPADDR]; VPNInstance=[STRING]; AFTIP=[IPADDR]; VPNInstance=[STRING]. |
|
Variable fields |
$1: Protocol type. ¡ UDP: UDP protocol. ¡ TCP: TCP protocol. ¡ ICMP: ICMP protocol. ¡ TOTAL: All protocols. $2: Source IPv6 address. $3: Source IPv6 VPN instance name. $4: Source IP address after translation. $5: VPN instance after translation. |
|
Severity level |
5 |
|
Example |
AFT/5/AFT_PORT_EXHAUST_RECOVER: Usertable port resources recover, Protocol=UDP; OrigSrcIP=2001::1; VPNInstance=-; AFTIP=2.2.1.1; VPNInstance=-. |
|
Explanation |
This message is sent in the following conditions: · The IPv4 port resource usage drops below 87.5%. · The Endpoint-Independent Mapping mode is applied. |
|
Recommended action |
No action is required. |
AFT_V6TOV4_FLOW
|
Message text |
Protocol(1001)= [STRING];SrcIPv6Addr(1036)= [IPADDR];SrcPort(1004)= [UINT16];NatSrcIPAddr(1005)= [IPADDR];NatSrcPort(1006)= [UINT16];DstIPv6Addr(1037)= [IPADDR];DstPort(1008)= [UINT16];NatDstIPAddr(1009)= [IPADDR];NatDstPort(1010)= [UINT16];InitPktCount(1044)= [UINT32];InitByteCount(1046)= [UINT32];RplyPktCount(1045)= [UINT32];RplyByteCount(1047)= [UINT32];RcvVPNInstance(1042)= [STRING];SndVPNInstance(1043)= [STRING];BeginTime_e(1013)= [STRING];EndTime_e(1014)= [STRING];Event(1048)= ([UNIT16])[STRING]. |
|
Variable fields |
$1: Protocol type. $2: Source IPv6 address. $3: Source port number. $4: Source IP address after translation. $5: Source port number after translation. S6: Destination IPv6 address. $7: Destination port number. $8: Destination IP address after translation. $9: Destination port number after translation. $10: Total number of incoming packets. $11: Total number of incoming bytes. $12: Total number of outgoing packets. $13: Total number of outgoing bytes. $14: Source VPN instance name. $15: Destination VPN instance name. $16: Time when the session is established. $17: Time when the session is removed. $18: Event type. $19: Event description: ¡ Session created. ¡ Session ended. ¡ Session aged out. ¡ Session deleted through configuration. ¡ Other. |
|
Severity level |
6 |
|
Example |
AFT/6/AFT_V6TOV4_FLOW: Protocol(1001)=IPv6-ICMP;SrcI Pv6Addr(1036)=1000::10;SrcPort(1004)=1;NatSrcIPAddr(1005)=9.9.9.9;NatSrcPort(100 6)=1027;DstIPv6Addr(1037)=2000::201:102;DstPort(1008)=32768;NatDstIPAddr(1009)=2 .1.1.2;NatDstPort(1010)=2048;InitPktCount(1044)=177411959;InitByteCount(1046)=21 22604543;RplyPktCount(1045)=1895856127;RplyByteCount(1047)=30720;RcvVPNInstance( 1042)=;SndVPNInstance(1043)=;BeginTime_e(1013)=05052017134514;EndTime_e(1014)=;E vent(1048)=(8)Session created. |
|
Explanation |
This message is generated when an IPv6-initiated session is established or deleted. |
|
Recommended action |
No action is required. |
AFT_V4TOV6_FLOW
|
Message text |
Protocol(1001)= [STRING]; SrcIPAddr(1003)= [IPADDR];SrcPort(1004)= [UINT16]; NatSrcIPv6Addr(1038)= [IPADDR];NatSrcPort(1006)= [UINT16]; DstIPAddr(1003)= [IPADDR];DstPort(1008)= [UINT16]; NatDstIPv6Addr(1039)= [IPADDR];NatDstPort(1010)= [UINT16];InitPktCount(1044)= [UINT32];InitByteCount(1046)= [UINT32];RplyPktCount(1045)= [UINT32];RplyByteCount(1047)= [UINT32];RcvVPNInstance(1042)= [STRING];SndVPNInstance(1043)= [STRING];BeginTime_e(1013)= [STRING];EndTime_e(1014)= [STRING];Event(1048)= ([UNIT16])[STRING]. |
|
Variable fields |
$1: Protocol type. $2: Source IPv6 address. $3: Source port number. $4: Source IP address after translation. $5: Source port number after translation. S6: Destination IPv6 address. $7: Destination port number. $8: Destination IP address after translation. $9: Destination port number after translation. $10: Total number of incoming packets. $11: Total number of incoming bytes. $12: Total number of outgoing packets. $13: Total number of outgoing bytes. $14: Source VPN instance name. $15: Destination VPN instance name. $16: Time when the session is established. $17: Time when the session is removed. $18: Event type. $19: Event description: ¡ Session created. ¡ Session ended. ¡ Session aged out. ¡ Session deleted through configuration. ¡ Other. |
|
Severity level |
6 |
|
Example |
AFT/6/AFT_V4TOV6_FLOW: Protocol(1001)=ICMP;SrcIPAddr(1003 )=2.1.1.4;SrcPort(1004)=197;NatSrcIPv6Addr(1038)=2000::201:104;NatSrcPort(1006)= 197;DstIPAddr(1003)=5.5.5.5;DstPort(1008)=2048;NatDstIPv6Addr(1039)=1000::;NatDs tPort(1010)=32768;InitPktCount(1044)=2092588805;InitByteCount(1046)=1166331903;R plyPktCount(1045)=1895856127;RplyByteCount(1047)=30720;RcvVPNInstance(1042)=;Snd VPNInstance(1043)=;BeginTime_e(1013)=05052017152731;EndTime_e(1014)=;Event(1048) =(8)Session created. |
|
Explanation |
This message is generated when an IPv4-initiated session is established or deleted. |
|
Recommended action |
No action is required. |
ANCP messages
This section contains ANCP messages.
ANCP_INVALID_PACKET
|
Message text |
-NeighborName=[STRING]-State=[STRING]-MessageType=[STRING]; The [STRING] value [STRING] is wrong, and the value [STRING] is expected. |
|
Variable fields |
$1: ANCP neighbor name. $2: Neighbor state. $4: Field. $5: Wrong value of the field. $6: Expected value of the field. |
|
Severity level |
6 |
|
Example |
ANCP/6/ANCP_INVALID_PACKET: -NeighborName=Dslam-State=SYNSENT-MessageType=SYNACK; The Sender Instance value 0 is wrong, and the value 1 is expected. |
|
Explanation |
The system received an adjacency message that had a field with a wrong value. |
|
Recommended action |
No action is required. |
ARP messages
This section contains ARP messages.
ARP_ACTIVE_ACK_NO_REPLY
|
Message text |
No ARP reply from IP [STRING] was received on interface [STRING]. |
|
Variable fields |
$1: IP address. $2: Interface name. |
|
Severity level |
6 |
|
Example |
ARP/6/ARP_ACTIVE_ACK_NO_REPLY: No ARP reply from IP 192.168.10.1 was received on interface GigabitEthernet1/0/1. |
|
Explanation |
The ARP active acknowledgement feature did not receive an ARP reply after it sent an ARP request to the sender IP of an ARP message. This message indicates the risk of attacks. |
|
Recommended action |
1. Verify that the learned ARP entries on the device are consistent with the existing legal devices. When gateways and servers are on the network, check the ARP entries for these devices first. 2. If the ARP entries are correct and the attack continues, contact H3C Support. |
ARP_ACTIVE_ACK_NOREQUESTED_REPLY
|
Message text |
Interface [STRING] received from IP [STRING] an ARP reply that was not requested by the device. |
|
Variable fields |
$1: Interface name. $2: IP address. |
|
Severity level |
4 |
|
Example |
ARP/4/ARP_ACTIVE_ACK_NOREQUESTED_REPLY: Interface GigabitEthernet1/0/1 received from IP 192.168.10.1 an ARP reply that was not requested by the device. |
|
Explanation |
The ARP active acknowledgement feature received an unsolicited ARP reply from a sender IP. This message indicates the risk of attacks. |
|
Recommended action |
No action is required. The device discards the ARP reply automatically. |
ARP_ALARM_CLEAR
|
Message text |
The number of ARP entries dropped below the threshold. Threshold=[UINT32]; Number of dynamic ARP entries=[UINT32]; Number of static ARP entries=[UINT32]; Other ARP entries=[UINT32]. |
|
Variable fields |
$1: Security threshold for global ARP entries. $2: Number of dynamic ARP entries. $3: Number of static ARP entries. $4: Number of other ARP entries. |
|
Severity level |
5 |
|
Example |
ARP/5/ARP_ALARM_CLEAR: The number of ARP entries dropped below the threshold. Threshold=100; Number of dynamic ARP entries=59; Number of static ARP entries=0; Other ARP entries = 0. |
|
Explanation |
The number of global ARP entries (static and dynamic ARP entries) dropped below the global security threshold. The global security threshold is 60 percent of the customized system entry specification for the product. |
|
Recommended action |
No action is required. |
ARP_BINDRULETOHW_FAILED
|
Message text |
Failed to download binding rule to hardware on the interface [STRING], SrcIP [IPADDR], SrcMAC [MAC], VLAN [UINT16], Gateway MAC [MAC]. |
|
Variable fields |
$1: Interface name. $2: Source IP address. $3: Source MAC address. $4: VLAN ID. $5: Gateway MAC address. |
|
Severity level |
5 |
|
Example |
ARP/5/ARP_BINDRULETOHW_FAILED: Failed to download binding rule to hardware on the interface Ethernet1/0/1, SrcIP 1.1.1.132, SrcMAC 0015-E944-A947, VLAN 1, Gateway MAC 00A1-B812-1108. |
|
Explanation |
The system failed to set a binding rule to the hardware on an interface. The message is sent in any of the following situations: · The resources are not sufficient for the operation. · The memory is not sufficient for the operation. · A hardware error occurs. |
|
Recommended action |
To resolve the problem: 1. Execute the display qos-acl resource command to check if the ACL resources for the operation are sufficient. ¡ If yes, proceed to step 2. ¡ If no, delete unnecessary configuration to release ACL resources. If no configuration can be deleted, proceed to step 2. 2. Execute the display memory command to check if the memory for the operation is sufficient. ¡ If yes, proceed to step 3. ¡ If no, delete unnecessary configuration to release memory. If no configuration can be deleted, proceed to step 3. 3. Delete the configuration and perform the operation again. |
ARP_DUPLICATE_IPADDR_DETECT
|
Message text |
Detected an IP address conflict. The device with MAC address [STRING] connected to interface [STRING] in VSI [STRING] and the device with MAC address [STRING] connected to interface [STRING] in VSI [STRING] were using the same IP address [IPADDR]. |
|
Variable fields |
$1: MAC address. $2: Interface name. (The interface can be a tunnel interface, Layer 3 interface, or Ethernet service instance.) $3: VSI name. $4: MAC address. $5: Interface name. (The interface can be a tunnel interface, Layer 3 interface, or Ethernet service instance.) $6: VSI name. $7: Conflicting IP address. |
|
Severity level |
6 |
|
Example |
ARP/6/ARP_DUPLICATE_IPADDR_DETECT: Detected an IP address conflict. The device with MAC address 00-00-01 connected to interface Ethernet0/0/1 service-instance 1000 in VSI vpna and the device with MAC address 00-00-02 connected to interface tunnel 10 in VSI vpna were using the same IP address 192.168.1.1. |
|
Explanation |
This message is sent when an interface receives an ARP message in which the sender information conflicts with an existing ARP entry. The sender IP address is the same as the IP address in the entry, but the MAC addresses are different. |
|
Recommended action |
Change the IP address on either of the two devices. |
ARP_DYNAMIC
|
Message text |
The maximum number of dynamic ARP entries for the device reached. |
|
Variable fields |
N/A |
|
Severity level |
3 |
|
Example |
ARP/3/ARP_DYNAMIC: The maximum number of dynamic ARP entries for the device reached. |
|
Explanation |
The maximum number of dynamic ARP entries for the device was reached. |
|
Recommended action |
No action is required. |
ARP_DYNAMIC_IF
|
Message text |
The maximum number of dynamic ARP entries for interface [STRING] reached. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
3 |
|
Example |
ARP/3/ARP_DYNAMIC_IF: The maximum number of dynamic ARP entries for interface GigabitEthernet3/0/1 reached. |
|
Explanation |
The maximum number of dynamic ARP entries for the specified interface was reached. |
|
Recommended action |
No action is required. |
ARP_DYNAMIC_SLOT
|
Message text |
Pattern 1: The maximum number of dynamic ARP entries for slot [INT32] reached. Pattern 2: The maximum number of dynamic ARP entries for chassis [INT32] slot [INT32] reached. |
|
Variable fields |
Pattern 1: $1: Slot number. Pattern 2: $1: Slot number. $2: Chassis number. |
|
Severity level |
3 |
|
Example |
ARP/3/ARP_DYNAMIC_SLOT: The maximum number of dynamic ARP entries for slot 2 reached. ARP/3/ARP_DYNAMIC_SLOT: The maximum number of dynamic ARP entries for chassis 1 slot 2 reached. |
|
Explanation |
Pattern 1: The maximum number of dynamic ARP entries for the slot was reached. Pattern 2: The maximum number of dynamic ARP entries for the slot on the chassis was reached. |
|
Recommended action |
Delete useless dynamic ARP entries. |
ARP_ENTRY_CONFLICT
|
Message text |
The software entry for [STRING] on [STRING] and the hardware entry did not have the same [STRING]. |
|
Variable fields |
$1: IP address. $2: VPN instance name. If the ARP entry belongs to the public network, this field displays the public network. $3: Inconsistent items: ¡ MAC address. ¡ output interface. ¡ output port. ¡ outermost layer VLAN ID. ¡ second outermost layer VLAN ID. ¡ VSI index. ¡ link ID. |
|
Severity level |
6 |
|
Example |
ARP/6/ARP_ENTRY_CONFLICT: The software entry for 1.1.1.1 on the VPN a and the hardware entry did not have the same MAC address, output port, VSI index, and link ID. ARP/6/ARP_ENTRY_CONFLICT: The software entry for 1.1.1.2 on the public network and the hardware entry did not have the same MAC address, output port, VSI index, and link ID. |
|
Explanation |
The software entry for the specified IP address was not the same as the hardware entry. For example, they did not have the same output interface. |
|
Recommended action |
No action is required. ARP automatically refreshes the hardware entries. |
ARP_FEATURE_ENABLE_FAILED
|
Message text |
Failed to enable the feature on interface [STRING]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
6 |
|
Example |
ARP/6/ARP_FEATURE_ENABLE_FAILED: Failed to enable the feature on interface GE1/0/1. |
|
Explanation |
Failed to issue the arp rate-limit, arp filter binding, or arp filter source commands on the specified interface. |
|
Recommended action |
If the feature fails to enable on the specified interface, contact H3C Support. |
ARP_HOST_IP_CONFLICT
|
Message text |
|
|
Variable fields |
$1: IP address. $2: Interface name. $3: Interface name. |
|
Severity level |
4 |
|
Example |
|
|
Explanation |
The sender IP address in a received ARP message conflicted with the IP address of a host connected to another interface. |
|
Recommended action |
Check whether the hosts that send the ARP messages are legitimate. Disconnect the illegal host from the network. |
ARP_IP_CONFLICT
|
Message text |
Received an ARP packet with a duplicate IP address. ConflictInterface=[STRING]; Conflict IP address=[STRING]; ConflictMac=[STRING]; SVlan=[UINT32]; CVlan=[ UINT32]. |
|
Variable fields |
$1: Name of the interface that received the ARP packet with a duplicate IP address. $2: Sender IP address in the ARP packet. $3: Sender MAC address in the ARP packet. $4: Outer VLAN ID for the ARP packet. $5: Inner VLAN ID for the ARP packet. |
|
Severity level |
4 |
|
Example |
ARP/4/ARP_IP_CONFLICT: Received an ARP packet with a duplicate IP address. ConflictInterface=GigabitEthernet2/0/1; Conflict IP address=192.168.56.2; ConflictMac=0300-1602-00e0; SVlan=0, CVlan=0. |
|
Explanation |
The sender IP address in the ARP packet conflicted with the IP address of the local device after you enable recording conflicts between the endpoints and local device by using the arp local-conflict record enable command. |
|
Recommended action |
Check whether an ARP attack or a loop exists on the network. |
ARP_IP_CONFLICT_RESOLVED
|
Message text |
IP address conflicts were resolved. ConflictInterface=[STRING]; Conflict IP address=[STRING]; ConflictMac=[STRING]; SVlan=[UINT32]; CVlan=[UINT32]. |
|
Variable fields |
$1: Name of the interface that received the ARP packet with a duplicate IP address. $2: Sender IP address in the ARP packet. $3: Sender MAC address in the ARP packet. $4: Outer VLAN ID for the ARP packet. $5: Inner VLAN ID for the ARP packet. |
|
Severity level |
5 |
|
Example |
ARP/5/ARP_IP_CONFLICT_RESOLVED: IP address conflicts were resolved. ConflictInterface=vlan-interface 10; Conflict IP address=192.168.56.100; ConflictMac=0300-1602-00e1; SVlan=0; CVlan=0. |
|
Explanation |
No new conflict occurs within three minutes after an endpoint and local device conflict occurred when you enable recording conflicts between the endpoints and local device by using the arp local-conflict record enable command. |
|
Recommended action |
No action is required. |
ARP_INTERFACE_ALARM_CLEAR
|
Message text |
The number of ARP entries dropped below the threshold of interface [STRING]. Threshold=[UINT32]; Number of dynamic ARP entries=[UINT32]. |
|
Variable fields |
$1: Interface name. $2: Dynamic security threshold for the interface. $3: Number of dynamic ARP entries on the interface. |
|
Severity level |
5 |
|
Example |
ARP/5/ARP_INTERFACE_ALARM_CLEAR: The number of ARP entries dropped below the threshold of interface GigabitEthernet1/0/1. Threshold=100; Number of dynamic ARP entries=59. |
|
Explanation |
The number of dynamic ARP entries on the interface dropped below the dynamic security threshold. The dynamic alarm threshold for an interface is 60 percent of the dynamic ARP learning limit set by the arp max-learning-num command. |
|
Recommended action |
No action is required. |
ARP_INTERFACE_THRESHOLD_EXCEED
|
Message text |
The number of ARP entries exceeded the threshold of interface [STRING]. Threshold=[UINT32]; Number of dynamic ARP entries=[UINT32]. |
|
Variable fields |
$1: Interface name. $2: Dynamic alarm threshold for the interface. $3: Number of dynamic ARP entries on the interface. |
|
Severity level |
4 |
|
Example |
ARP/4/ARP_INTERFACE_THRESHOLD_EXCEED: The number of ARP entries exceeded the threshold of interface GigabitEthernet1/0/1. Threshold=100;, Number of dynamic ARP entries=81. |
|
Explanation |
The number of dynamic ARP entries exceeded the dynamic alarm threshold for the interface. The dynamic alarm threshold for an interface is 80 percent of the dynamic ARP learning limit set by the arp max-learning-num command. |
|
Recommended action |
Delete the useless dynamic ARP entries on the interface or raise the alarm threshold. |
ARP_MAC_CONFLICT
|
Message text |
A MAC address conflict occurred. ConflictInterface=[STRING]; ConflictMac=[STRING]; Source IP address=[STRING], SVlan=[UINT32], CVlan=[UINT32], InputInterface=[STRING]. |
|
Variable fields |
$1: Name of the interface that received the ARP packet with a duplicate MAC address. $2: Sender MAC address in the ARP packet. $3: Sender IP address in the ARP packet. $4: Outer VLAN ID for the ARP packet. $5: Inner VLAN ID for the ARP packet. |
|
Severity level |
4 |
|
Example |
ARP/4/ARP_MAC_CONFLICT: A MAC address conflict occurs. ConflictInterface=vlan-interface 10; ConflictMac=0300-1602-00e0; Source IP address=2002::2; SVlan=0; CVlan=0; InputInterface=GigabitEthernet1/0/1. |
|
Explanation |
The sender MAC address in the ARP packet conflicted with the MAC address of the local device after you enable recording conflicts between the endpoints and local device by using the arp local-conflict record enable command. |
|
Recommended action |
Check whether an ARP attack or a loop exists on the network. |
ARP_MAC_CONFLICT_RESOLVED
|
Message text |
The MAC address conflict was removed. ConflictInterface=[STRING]; ConflictMac=[STRING]; Source IP address=[STRING], SVlan=[UINT32], CVlan=[UINT32], InputInterface=[STRING]. |
|
Variable fields |
$1: Name of the interface that received the ARP packet with a duplicate MAC address. $2: Sender MAC address in the ARP packet. $3: Sender IP address in the ARP packet. $4: Outer VLAN ID for the ARP packet. $5: Inner VLAN ID for the ARP packet. |
|
Severity level |
5 |
|
Example |
ARP/5/ARP_MAC_CONFLICT_RESOLVED:The MAC address conflict is removed. ConflictInterface=vlan-interface 10; ConflictMac=0300-1602-00e0; Source IP address=2002::2; SVlan=0; CVlan=0; InputInterface=GigabitEthernet1/0/1 |
|
Explanation |
No new conflict occurs within three minutes after a MAC address conflict occurred when you enable recording conflicts between the endpoints and local device by using the arp local-conflict record enable command. |
|
Recommended action |
No action is required. |
ARP_MAC_IP_CONFLICT
|
Message text |
A MAC and IP address conflicts occurred. ConflictInterface=[STRING]; ConflictMac=[STRING]; Conflict IP address=[STRING]; Received packet's destination MAC address=[STRING]; Received packet's destination IP address=[STRING]; SVlan=[UINT32]; CVlan=[UINT32]; InputInterface=[STRING]. |
|
Variable fields |
$1: Name of the interface that received the ARP packet with duplicate MAC and IP addresses. $2: Sender MAC address in the ARP packet. $3: Sender IP address in the ARP packet. $4: Target MAC address in the ARP packet. $5: Target IP address in the ARP packet. $6: Outer VLAN ID for the ARP packet. $7: Inner VLAN ID for the ARP packet. $8: Name of the physical interface corresponding to the VLAN interface that received the ARP packet. |
|
Severity level |
4 |
|
Example |
ARP/4/ ARP_MAC_IP_CONFLICT: MAC and IP address conflict. ConflictInterface= vlan-interface 10; ConflictMac=0300-1602-00e0; Conflict IP address=192.168.56.100; Received packet's destination MAC address=0300-1602-00e1; Received packet's destination IP address=192.168.56.2; SVlan=0; CVlan=0; InputInterface= GigabitEthernet2/0/1. |
|
Explanation |
The sender MAC and IP addresses in the ARP packet conflicted with the MAC and IP addresses of the local device after you enable recording conflicts between the endpoints and local device by using the arp local-conflict record enable command. |
|
Recommended action |
Check whether an ARP attack or a loop exists on the network. |
ARP_MAC_IP_CONFLICT_RESOLVED
|
Message text |
The MAC and IP address conflicts were resolved. ConflictInterface=[STRING], ConflictMac=[STRING]; Conflict IP address=[STRING]; Received packet's destination MAC address=[STRING]; Received packet's destination IP address=[STRING]; SVlan=[UINT32], CVlan=[UINT32]; InputInterface=[STRING]. |
|
Variable fields |
$1: Name of the interface that received the ARP packet with duplicate MAC and IP addresses. $2: Sender MAC address in the ARP packet. $3: Sender IP address in the ARP packet. $4: Target MAC address in the ARP packet. $5: Target IP address in the ARP packet. $6: Outer VLAN ID for the ARP packet. $7: Inner VLAN ID for the ARP packet. $8: Name of the physical interface corresponding to the VLAN interface that received the ARP packet. |
|
Severity level |
5 |
|
Example |
ARP/5/ARP_MAC_IP_CONFLICT_RESOLVED: The MAC and IP address confliction resolved. ConflictInterface= vlan-interface 10; ConflictMac=0300-1602-00e0; Conflict IP address=192.168.56.100; Received packet's destination MAC address=0300-1602-00e1; Received packet's destination IP address=192.168.56.2; SVlan=0; CVlan=0; InputInterface= GigabitEthernet2/0/1. |
|
Explanation |
No new conflict occurs within three minutes after a MAC and IP address conflict occurred when you enable recording conflicts between the endpoints and local device by using the arp local-conflict record enable command. |
|
Recommended action |
No action is required. |
ARP_RATE_EXCEEDED
|
Message text |
The ARP packet rate ([UINT32] pps) exceeded the rate limit ([UINT32] pps) on interface [STRING] in the last [UINT32] seconds. |
|
Variable fields |
$1: ARP packet rate. $2: ARP limit rate. $3: Interface name. $4: Interval time. |
|
Severity level |
4 |
|
Example |
ARP/4/ARP_RATE_EXCEEDED: The ARP packet rate (100 pps) exceeded the rate limit (80 pps) on interface Ethernet0/1/0 in the last 10 seconds. |
|
Explanation |
An interface received ARP messages at a higher rate than the rate limit. |
|
Recommended action |
Verify that the hosts at the sender IP addresses are legitimate. |
ARP_RATELIMIT_NOTSUPPORTED
|
Message text |
Pattern 1: The ARP packet rate limit feature is not supported on interface [STRING] in slot [INT32]. Pattern 2: The ARP packet rate limit feature is not supported on interface [STRING] in chassis [INT32] slot [INT32]. |
|
Variable fields |
Pattern 1: $1: Interface name. $2: Slot number. Pattern 2: $1: Interface name. $2: Chassis number. $3: Slot number. |
|
Severity level |
6 |
|
Example |
ARP/6/ARP_RATELIMIT_NOTSUPPORTED: The ARP packet rate limit feature is not supported on interface GE2/0/1 in slot 2. |
|
Explanation |
Pattern 1: ARP packet rate limit was not supported on a specific interface in the slot. Pattern 2: ARP packet rate limit was not supported on a specific interface in the slot of the chassis was reached. |
|
Recommended action |
No action is required. |
ARP_SENDER_IP_INVALID
|
Message text |
Sender IP [STRING] was not on the same network as the receiving interface [STRING]. |
|
Variable fields |
$1: IP address. $2: Interface name. |
|
Severity level |
6 |
|
Example |
ARP/6/ARP_SENDER_IP_INVALID: Sender IP 192.168.10.2 was not on the same network as the receiving interface GigabitEthernet1/0/1. |
|
Explanation |
The sender IP of a received ARP message was not on the same network as the receiving interface. |
|
Recommended action |
Verify that the host at the sender IP address is legitimate. |
ARP_SENDER_MAC_INVALID
|
Message text |
Sender MAC [STRING] was not identical to Ethernet source MAC [STRING] on interface [STRING]. |
|
Variable fields |
$1: MAC address. $2: MAC address. $3: Interface name. |
|
Severity level |
4 |
|
Example |
ARP/4/ARP_SENDER_MAC_INVALID: Sender MAC 0000-5E14-0E00 was not identical to Ethernet source MAC 0000-5C14-0E00 on interface GigabitEthernet1/0/1. |
|
Explanation |
An interface received an ARP message. The sender MAC address in the message body was not identical to the source MAC address in the Ethernet header. |
|
Recommended action |
Verify that the host at the sender MAC address is legitimate. |
ARP_SLOT_ALARM_CLEAR
|
Message text |
Pattern 1: The number of ARP entries dropped below the threshold of slot [UINT16]. Threshold=[ UINT32]; Number of dynamic ARP entries=[UINT32]; Pattern 2: The number of ARP entries dropped below the threshold of chassis [UINT16] slot [UINT16]. Threshold=[ UINT32]; Number of dynamic ARP entries=[UINT32]; |
|
Variable fields |
Pattern 1: $1: Slot number. $2: Dynamic security threshold for the card. $3: Number of dynamic ARP entries on the card. Pattern 2: $1: Chassis number. $2: Slot number. $3: Security threshold for the card. $4: Number of dynamic ARP entries for the card. |
|
Severity level |
5 |
|
Example |
Pattern 1: ARP/5/ARP_SLOT_ALARM_CLEAR: The number of ARP entries dropped below the threshold of slot 1. Threshold=60; Number of dynamic ARP entries=59. Pattern 2: ARP/5/ARP_SLOT_ALARM_CLEAR: The number of ARP entries dropped below the threshold of chassis 1 slot 1. Threshold=60; Number of dynamic ARP entries=59; |
|
Explanation |
The number of dynamic ARP entries on the card dropped below the dynamic security threshold for the card. The dynamic security threshold for a card is 60 percent of the dynamic ARP learning limit set by the arp max-learning-number command. |
|
Recommended action |
No action is required. |
ARP_SLOT_THRESHOLD_EXCEED
|
Message text |
Pattern 1: The number of ARP entries exceeded the threshold of slot [UINT16]. Threshold=[UINT32]; Number of dynamic ARP entries=[UINT32]; Pattern 2: The number of ARP entries exceeded the threshold of chassis [UINT16] slot [UINT16]. Threshold=[UINT32]; Number of dynamic ARP entries=[UINT32]; |
|
Variable fields |
Pattern 1: $1: Slot number. $2: Dynamic alarm threshold for the card. $3: Number of dynamic ARP entries on the card. Pattern 2: $1: Chassis number. $2: Slot number. $3: Alarm threshold for the card. $4: Number of dynamic ARP entries on the card. |
|
Severity level |
4 |
|
Example |
Pattern 1: ARP/4/ARP_SLOT_THRESHOLD_EXCEED: The number of ARP entries exceeded the threshold of slot 1. Threshold=80; Number of dynamic ARP entries=81. Pattern 2: ARP/4/ARP_SLOT_THRESHOLD_EXCEED: The number of ARP entries exceeded the threshold of chassis 1 slot 1. Threshold=80; Number of dynamic ARP entries=81; |
|
Explanation |
The number of dynamic ARP entries on the card exceeded the dynamic alarm threshold for the card. The dynamic alarm threshold for a card is 80 percent of the dynamic ARP learning limit set by the arp max-learning-number command. |
|
Recommended action |
Delete the useless dynamic ARP entries on the card or raise the alarm threshold. |
ARP_SPEEDLIMIT_ALARM
|
Message text |
Packet rate exceeded the rate limit. ThresholdRate =[UINT32]; CurrentRate=[UINT32]; SuppressType=[STRING]; |
|
Variable fields |
$1: Alarm threshold for ARP packets or ARP Miss messages sent per second. $2: The current peak number of ARP packets or ARP Miss messages sent per second. $3: Limit object, including ARP packets or ARP Miss messages. |
|
Severity level |
4 |
|
Example |
ARP/4/ARP_SPEEDLIMIT_ALARM: Packet speed exceeded the speed limit. ThresholdRate =50; CurrentRate =60; SuppressType=ARP. |
|
Explanation |
The sending rate of ARP packets or ARP Miss messages exceeded the alarm threshold. |
|
Recommended action |
Check whether the network has packet attacks. |
ARP_SPEEDLIMIT_ALARM_CLEAR
|
Message text |
Packet rate dropped below the rate limit. ThresholdRate =[UINT32]; CurrentRate=[UINT32]; SuppressType=[STRING]. |
|
Variable fields |
$1: Alarm threshold for ARP packets or ARP Miss messages sent per second. $2: The current peak number of ARP packets or ARP Miss messages sent per second. $3: Limit object, including ARP packets or ARP Miss messages. |
|
Severity level |
5 |
|
Example |
ARP/4/ARP_SPEEDLIMIT_ALARM: Packet rate dropped below the rate limit. hresholdRate =50; CurrentRate =60; SuppressType=ARP. |
|
Explanation |
The sending rate of ARP packets or ARP Miss messages dropped below the alarm threshold. To avoid frequent alarm notifications or alarm recovery notifications, the device does not output notifications within one minute after the alarm recovers. |
|
Recommended action |
No action is required. |
ARP_SRC_MAC_FOUND_ATTACK
|
Message text |
An attack from MAC [STRING] was detected on interface [STRING]. |
|
Variable fields |
$1: MAC address. $2: Interface name. |
|
Severity level |
6 |
|
Example |
ARP/6/ARP_SRC_MAC_FOUND_ATTACK: An attack from MAC 0000-5E14-0E00 was detected on interface GigabitEthernet1/0/1. |
|
Explanation |
The source MAC-based ARP attack detection feature received more ARP packets from the same MAC address within 5 seconds than the specified threshold. This message indicates the risk of attacks. |
|
Recommended action |
Verify that the host at the source MAC address is legitimate. |
ARP_SUPPR_ALARM_CLEAR
|
Message text |
The number of ARP suppression entries dropped below the threshold. (Threshold=[ UINT32], Number of Suppression ARP entries=[UINT32]) |
|
Variable fields |
$1: Security threshold for ARP suppression entries. $2: Number of ARP suppression entries on the device. |
|
Severity level |
5 |
|
Example |
ARP/5/ARP_SUPPR_ALARM_CLEAR: The number of ARP suppression entries dropped below the threshold. Threshold=100; Number of Suppression ARP entries=59. |
|
Explanation |
The number of ARP suppression entries on the device dropped below the security threshold. The security threshold for ARP suppression entries is 60 percent of the customized ARP suppression entry specification for the product. |
|
Recommended action |
No action is required. |
ARP_SUPPR_THRESHOLD_EXCEED
|
Message text |
The number of ARP suppression entries exceeded the threshold. Threshold=[UINT32]; Number of ARP Suppression entries=[UINT32]. |
|
Variable fields |
$1: Alarm threshold for ARP suppression entries. $2: Number of ARP suppression entries on the device. |
|
Severity level |
4 |
|
Example |
ARP/4/ARP_SUPPR_THRESHOLD_EXCEED: The number of ARP suppression entries exceeded the threshold. Threshold=100; Number of ARP Suppression entries=81. |
|
Explanation |
The number of ARP suppression entries on the device exceeded the alarm threshold. The alarm threshold for ARP suppression entries is 80 percent of the customized ARP suppression entry specification for the product. |
|
Recommended action |
Delete the useless ARP suppression entries or raise the alarm threshold. |
ARP_TARGET_IP_INVALID
|
Message text |
Target IP [STRING] was not the IP of the receiving interface [STRING]. |
|
Variable fields |
$1: IP address. $2: Interface name. |
|
Severity level |
6 |
|
Example |
ARP/6/ARP_TARGET_IP_INVALID: Target IP 192.168.10.2 was not the IP of the receiving interface Ethernet0/1/0. |
|
Explanation |
The target IP address of a received ARP message was not the IP address of the receiving interface. |
|
Recommended action |
Verify that the host at the sender IP address is legitimate. |
ARP_THRESHOLD_EXCEED
|
Message text |
The number of ARP entries exceeded the threshold. Threshold=[UINT32]; Number of dynamic ARP entries=[UINT32]; Number of static ARP entries=[UINT32]; Other ARP entries=[UINT32]. |
|
Variable fields |
$1: Alarm threshold for global ARP entries. $2: Number of dynamic ARP entries. $3: Number of static ARP entries. $4: Number of other ARP entries. |
|
Severity level |
4 |
|
Example |
ARP/4/ARP_THRESHOLD_EXCEED: The number of ARP entries exceeded the threshold. Threshold=100; Number of dynamic ARP entries=81; Number of static ARP entries=0; Other ARP entries = 0. |
|
Explanation |
The number of global ARP entries (static ARP entries and dynamic ARP entries) exceeded the global alarm threshold. The global alarm threshold is 80 percent of the customized ARP entry specification for the product. |
|
Recommended action |
Delete the useless ARP entries or raise the alarm threshold. |
ARP_USER_DUPLICATE_IPADDR_DETECT
|
Message text |
Detected a user IP address conflict. New user (MAC [STRING], SVLAN [STRING], CVLAN [STRING]) on interface [STRING] and old user (MAC [STRING], SVLAN [STRING], CVLAN [STRING]) on interface [STRING] were using the same IP address [IPADDR]. |
|
Variable fields |
$1: MAC address of a new user. $2: Outer VLAN to which the new user belongs. $3: Inner VLAN to which the new user belongs. $4: Name of the interface connecting to the new user. $5: MAC address of an old user. $6: Outer VLAN to which the old user belongs. $7: Inner VLAN to which the old user belongs. $8: Name of the interface connecting to the old user. $9: IP address. |
|
Severity level |
6 |
|
Example |
ARP/6/ARP_USER_DUPLICATE_IPADDR_DETECT: Detected a user IP address conflict. New user (MAC 0010-2100-01e1, SVLAN 100, CVLAN 10) on interface GigabitEthernet1/0/1 and old user (MAC 0120-1e00-0102, SVLAN 100, CVLAN 10) on interface GigabitEthernet1/0/1 were using the same IP address 192.168.1.1. |
|
Explanation |
ARP detected a user IP address conflict. The IP address of a new user is the same as the IP address of an old user. |
|
Recommended action |
Verify that all users have different IP addresses. |
ARP_USER_MOVE_DETECT
|
Message text |
Detected a user (IP address [IPADDR], MAC address [STRING]) moved to another interface. Before user move: interface [STRING], SVLAN [STRING], CVLAN [STRING]. After user move: interface [STRING], SVLAN [STRING], CVLAN [STRING]. |
|
Variable fields |
$1: IP address of the user. $2: MAC address of the user. $3: Interface name before the migration. $4: Outer VLAN ID to which the user belongs before the migration. $5: Inner VLAN ID to which the user belongs before the migration. $6: Interface name after the migration. $7: Outer VLAN ID to which the user belongs after the migration. $8: Inner VLAN ID to which the user belongs after the migration. |
|
Severity level |
6 |
|
Example |
ARP/6/ARP_USER_MOVE_DETECT: Detected a user (IP address 192.168.1.1, MAC address 0010-2100-01e1) moved to another interface. Before user move: interface GigabitEthernet1/0/1, SVLAN 100, CVLAN 10. After user move: interface GigabitEthernet1/0/2, SVLAN 100, CVLAN 10. |
|
Explanation |
ARP detected a user accesses the network through another port. |
|
Recommended action |
Use the display arp user-move record command to verify that the migration is legitimate. |
DUPIFIP
|
Message text |
Duplicate address [STRING] on interface [STRING], sourced from [STRING]. |
|
Variable fields |
$1: IP address. $2: Interface name. $3: MAC Address. |
|
Severity level |
6 |
|
Example |
ARP/6/DUPIFIP: Duplicate address 1.1.1.1 on interface Ethernet1/1/1, sourced from 0015-E944-A947. |
|
Explanation |
ARP detected a duplicate address. The sender IP in the received ARP packet was being used by the receiving interface. |
|
Recommended action |
Modify the IP address configuration. |
DUPIP
|
Message text |
IP address [STRING] conflicted with global or imported IP address, sourced from [STRING]. |
|
Variable fields |
$1: IP address. $2: MAC Address. |
|
Severity level |
6 |
|
Example |
ARP/6/DUPIP: IP address 30.1.1.1 conflicted with global or imported IP address, sourced from 0000-0000-0001. |
|
Explanation |
The sender IP address of the received ARP packet conflicted with the global or imported IP address. |
|
Recommended action |
Modify the IP address configuration. |
DUPVRRPIP
|
Message text |
IP address [STRING] conflicted with VRRP virtual IP address on interface [STRING], sourced from [STRING]. |
|
Variable fields |
$1: IP address. $2: Interface name. $3: MAC address. |
|
Severity level |
6 |
|
Example |
ARP/6/DUPVRRPIP: IP address 1.1.1.1 conflicted with VRRP virtual IP address on interface Ethernet1/1/1, sourced from 0015-E944-A947. |
|
Explanation |
The sender IP address of the received ARP packet conflicted with the VRRP virtual IP address. |
|
Recommended action |
Modify the IP address configuration. |
L3_COMMON
|
Message text |
Pattern 1: The Board on slot [INT32] doesn't support the ARP safe-guard function. Pattern 2: The Board on chassis t [INT32] slot [INT32] doesn't support the ARP safe-guard function. |
|
Variable fields |
Pattern 1: $1: Slot number. Pattern 2: $1: Slot number. $2: Chassis number. |
|
Severity level |
4 |
|
Example |
L3/4/L3_COMMON: -MDC=1-Slot=5; The Board on slot 5 doesn't support the ARP safe-guard function. |
|
Explanation |
Pattern 1: The slot did not support the ARP safe-guard feature. Pattern 2: The slot of the chassis did not support the ARP safe-guard feature. |
|
Recommended action |
Use a card that supports the ARP safe-guard feature. |
ATK messages
This section contains attack detection and prevention messages.
ATK_ICMP_ADDRMASK_REQ
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_ADDRMASK_REQ: IcmpType(1058)=17; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP address mask request logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_ADDRMASK_REQ_RAW
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_ADDRMASK_REQ_RAW: IcmpType(1058)=17; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP address mask requests of the same attributes, this message is sent only when the first request is received. If log aggregation is disabled, this message is sent every time an ICMP address mask request is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_ADDRMASK_REQ_RAW_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_ADDRMASK_REQ_RAW_SZ: IcmpType(1058)=17; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP address mask requests of the same attributes, this message is sent only when the first request is received. If log aggregation is disabled, this message is sent every time an ICMP address mask request is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_ADDRMASK_REQ_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_ADDRMASK_REQ_SZ: IcmpType(1058)=17; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP address mask request logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_ADDRMASK_RPL
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_ADDRMASK_RPL: IcmpType(1058)=18; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP address mask reply logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_ADDRMASK_RPL_RAW
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_ADDRMASK_RPL_RAW: IcmpType(1058)=18; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP address mask replies of the same attributes, this message is sent only when the first reply is received. If log aggregation is disabled, this message is sent every time an ICMP address mask reply is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_ADDRMASK_RPL_RAW_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_ADDRMASK_RPL_RAW_SZ: IcmpType(1058)=18; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP address mask replies of the same attributes, this message is sent only when the first reply is received. If log aggregation is disabled, this message is sent every time an ICMP address mask reply is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_ADDRMASK_RPL_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_ADDRMASK_RPL_SZ: IcmpType(1058)=18; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP address mask reply logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_ECHO_REQ
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_ECHO_REQ: IcmpType(1058)=8; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP echo request logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_ECHO_REQ_RAW
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; DstPort(1004)=[UINT16]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Destination port number. $7: Name of the receiving VPN instance. $8: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_ECHO_REQ_RAW: IcmpType(1058)=8; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DstPort(1004)=22; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP echo requests of the same attributes, this message is sent only when the first request is received. If log aggregation is disabled, this message is sent every time an ICMP echo request is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_ECHO_REQ_RAW_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; DstPort(1004)=[UINT16]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Destination port number. $7: Name of the receiving VPN instance. $8: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_ECHO_REQ_RAW_SZ: IcmpType(1058)=8; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DstPort(1004)=22; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP echo requests of the same attributes, this message is sent only when the first request is received. If log aggregation is disabled, this message is sent every time an ICMP echo request is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_ECHO_REQ_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_ECHO_REQ_SZ: IcmpType(1058)=8; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP echo request logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_ECHO_RPL
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_ECHO_RPL: IcmpType(1058)=0; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP echo reply logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_ECHO_RPL_RAW
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_ECHO_RPL_RAW: IcmpType(1058)=0; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP echo replies of the same attributes, this message is sent only when the first reply is received. If log aggregation is disabled, this message is sent every time an ICMP echo reply is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_ECHO_RPL_RAW_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_ECHO_RPL_RAW_SZ: IcmpType(1058)=0; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP echo replies of the same attributes, this message is sent only when the first reply is received. If log aggregation is disabled, this message is sent every time an ICMP echo reply is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_ECHO_RPL_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_ECHO_RPL_SZ: IcmpType(1058)=0; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP echo reply logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_FLOOD
|
Message text |
RcvIfName(1023)=[STRING]; DstIPAddr(1007)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Destination IP address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMP_FLOOD: RcvIfName(1023)=Ethernet0/0/2; DstIPAddr(1007)=6.1.1.5; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009093351. |
|
Explanation |
This message is sent when the number of ICMP packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_ICMP_FLOOD_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; DstIPAddr(1007)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Destination IP address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMP_FLOOD_SZ: SrcZoneName(1025)=Trust; DstIPAddr(1007)=6.1.1.5; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009093351. |
|
Explanation |
This message is sent when the number of ICMP packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_ICMP_INFO_REQ
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_INFO_REQ: IcmpType(1058)=15; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP information request logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_INFO_REQ_RAW
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_INFO_REQ_RAW: IcmpType(1058)=15; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP information requests of the same attributes, this message is sent only when the first request is received. If log aggregation is disabled, this message is sent every time an ICMP information request is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_INFO_REQ_RAW_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_INFO_REQ_RAW_SZ: IcmpType(1058)=15; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP information requests of the same attributes, this message is sent only when the first request is received. If log aggregation is disabled, this message is sent every time an ICMP information request is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_INFO_REQ_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_INFO_REQ_SZ: IcmpType(1058)=15; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP information request logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_INFO_RPL
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_INFO_RPL: IcmpType(1058)=16; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP information reply logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_INFO_RPL_RAW
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_INFO_RPL_RAW: IcmpType(1058)=16; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP information replies of the same attributes, this message is sent only when the first reply is received. If log aggregation is disabled, this message is sent every time an ICMP information reply is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_INFO_RPL_RAW_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_INFO_RPL_RAW_SZ: IcmpType(1058)=16; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP information replies of the same attributes, this message is sent only when the first reply is received. If log aggregation is disabled, this message is sent every time an ICMP information reply is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_INFO_RPL_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_INFO_RPL_SZ: IcmpType(1058)=16; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP information reply logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_LARGE
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMP_LARGE: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when large ICMP packet logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_LARGE_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMP_LARGE_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for large ICMP packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a large ICMP packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_LARGE_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMP_LARGE_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for large ICMP packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a large ICMP packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_LARGE_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_LARGE_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when large ICMP packet logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_PARAPROBLEM
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_PARAPROBLEM: IcmpType(1058)=12; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP parameter problem logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_PARAPROBLEM_RAW
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_PARAPROBLEM_RAW: IcmpType(1058)=12; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP parameter problem packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMP parameter problem packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_PARAPROBLEM_RAW_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_PARAPROBLEM_RAW_SZ: IcmpType(1058)=12; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP parameter problem packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMP parameter problem packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_PARAPROBLEM_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_PARAPROBLEM_SZ: IcmpType(1058)=12; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP parameter problem logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_PINGOFDEATH
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMP_PINGOFDEATH: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for ICMP packets larger than 65535 bytes with the MF flag set to 0. |
|
Recommended action |
No action is required. |
ATK_ICMP_PINGOFDEATH_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMP_PINGOFDEATH_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for the ping of death attack. The attack uses ICMP packets larger than 65535 bytes with the MF flag set to 0. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_PINGOFDEATH_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMP_PINGOFDEATH_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for the ping of death attack. The attack uses ICMP packets larger than 65535 bytes with the MF flag set to 0. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_PINGOFDEATH_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMP_PINGOFDEATH_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for ICMP packets larger than 65535 bytes with the MF flag set to 0. |
|
Recommended action |
No action is required. |
ATK_ICMP_REDIRECT
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_REDIRECT: IcmpType(1058)=5; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP redirect logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_REDIRECT_RAW
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_REDIRECT_RAW: IcmpType(1058)=5; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP redirect packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMP redirect packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_REDIRECT_RAW_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_REDIRECT_RAW_SZ: IcmpType(1058)=5; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP redirect packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMP redirect packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_REDIRECT_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_REDIRECT_SZ: IcmpType(1058)=5; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP redirect logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_SMURF
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMP_SMURF: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for ICMP echo requests whose destination IP address is one of the following addresses: · A broadcast or network address of A, B, or C class. · An IP address of D or E class. · The broadcast or network address of the network where the receiving interface resides. |
|
Recommended action |
No action is required. |
ATK_ICMP_SMURF_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMP_SMURF_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for the smurf attack. The attack uses ICMP echo requests with the destination IP address being one of the following addresses: · A broadcast or network address of A, B, or C class. · An IP address of D or E class. · The broadcast or network address of the network where the receiving interface resides. If log aggregation is enabled, for requests of the same attributes, this message is sent only when the first request is received. If log aggregation is disabled, this message is sent every time a request is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_SMURF_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMP_SMURF_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for the smurf attack. The attack uses ICMP echo requests with the destination IP address being one of the following addresses: · A broadcast or network address of A, B, or C class. · An IP address of D or E class. · The broadcast or network address of the network where the receiving interface resides. If log aggregation is enabled, for requests of the same attributes, this message is sent only when the first request is received. If log aggregation is disabled, this message is sent every time a request is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_SMURF_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMP_SMURF_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for ICMP echo requests whose destination IP address is one of the following addresses: · A broadcast or network address of A, B, or C class. · An IP address of D or E class. · The broadcast or network address of the network where the receiving interface resides. |
|
Recommended action |
No action is required. |
ATK_ICMP_SOURCEQUENCH
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_SOURCEQUENCH: IcmpType(1058)=4; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP source quench logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_SOURCEQUENCH_RAW
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_SOURCEQUENCH_RAW: IcmpType(1058)=4; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP source quench packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMP source quench packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_SOURCEQUENCH_RAW_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_SOURCEQUENCH_RAW_SZ: IcmpType(1058)=4; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP source quench packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMP source quench packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_SOURCEQUENCH_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_SOURCEQUENCH_SZ: IcmpType(1058)=4; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP source quench logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_TIMEEXCEED
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_TIMEEXCEED: IcmpType(1058)=11; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP time exceeded logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_TIMEEXCEED_RAW
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_TIMEEXCEED_RAW: IcmpType(1058)=11; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP time exceeded packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMP time exceeded packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_TIMEEXCEED_RAW_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_TIMEEXCEED_RAW_SZ: IcmpType(1058)=11; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP time exceeded packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMP time exceeded packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_TIMEEXCEED_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_TIMEEXCEED_SZ: IcmpType(1058)=11; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP time exceeded logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_TRACEROUTE
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMP_TRACEROUTE: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for ICMP time exceeded packets of code 0. |
|
Recommended action |
No action is required. |
ATK_ICMP_TRACEROUTE_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMP_TRACEROUTE_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP time exceeded packets of code 0 of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMP time exceeded packet of code 0 is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_TRACEROUTE_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMP_TRACEROUTE_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP time exceeded packets of code 0 of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMP time exceeded packet of code 0 is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_TRACEROUTE_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMP_TRACEROUTE_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for ICMP time exceeded packets of code 0. |
|
Recommended action |
No action is required. |
ATK_ICMP_TSTAMP_REQ
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_TSTAMP_REQ: IcmpType(1058)=13; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP timestamp logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_TSTAMP_REQ_RAW
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_TSTAMP_REQ_RAW: IcmpType(1058)=13; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP timestamp packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMP timestamp packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_TSTAMP_REQ_RAW_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_TSTAMP_REQ_RAW_SZ: IcmpType(1058)=13; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP timestamp packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMP timestamp packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_TSTAMP_REQ_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_TSTAMP_REQ_SZ: IcmpType(1058)=13; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP timestamp logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_TSTAMP_RPL
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_TSTAMP_RPL: IcmpType(1058)=14; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP timestamp reply logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_TSTAMP_RPL_RAW
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_TSTAMP_RPL_RAW: IcmpType(1058)=14; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP timestamp replies of the same attributes, this message is sent only when the first reply is received. If log aggregation is disabled, this message is sent every time an ICMP timestamp reply is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_TSTAMP_RPL_RAW_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_TSTAMP_RPL_RAW_SZ: IcmpType(1058)=14; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP timestamp replies of the same attributes, this message is sent only when the first reply is received. If log aggregation is disabled, this message is sent every time an ICMP timestamp reply is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_TSTAMP_RPL_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_TSTAMP_RPL_SZ: IcmpType(1058)=14; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP timestamp reply logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_TYPE
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_TYPE: IcmpType(1058)=38; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for user-defined ICMP packets. |
|
Recommended action |
No action is required. |
ATK_ICMP_TYPE_RAW
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_TYPE_RAW: IcmpType(1058)=38; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for user-defined ICMP packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a user-defined ICMP packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_TYPE_RAW_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_TYPE_RAW_SZ: IcmpType(1058)=38; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for user-defined ICMP packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a user-defined ICMP packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_TYPE_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_TYPE_SZ: IcmpType(1058)=38; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for user-defined ICMP packets. |
|
Recommended action |
No action is required. |
ATK_ICMP_UNREACHABLE
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_UNREACHABLE: IcmpType(1058)=3; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP destination unreachable logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMP_UNREACHABLE_RAW
|
Message text |
IcmpType(1058)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_UNREACHABLE_RAW: IcmpType(1058)=3; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP destination unreachable packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMP destination unreachable packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_UNREACHABLE_RAW_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_UNREACHABLE_RAW_SZ: IcmpType(1058)=3; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMP destination unreachable packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMP destination unreachable packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMP_UNREACHABLE_SZ
|
Message text |
IcmpType(1058)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMP message type. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMP_UNREACHABLE_SZ: IcmpType(1058)=3; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011091319; EndTime_c(1012)=20131011091819; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMP destination unreachable logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_DEST_UNREACH
|
Message text |
Icmpv6Type(1059)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Receiving interface name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_DEST_UNREACH: Icmpv6Type(1059)=133; RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMPv6 destination unreachable logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_DEST_UNREACH_RAW
|
Message text |
Icmpv6Type(1059)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Receiving interface name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_DEST_UNREACH_RAW: Icmpv6Type(1059)=133; RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMPv6 destination unreachable packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMPv6 destination unreachable packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_DEST_UNREACH_RAW_SZ
|
Message text |
Icmpv6Type(1059)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Source security zone name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_DEST_UNREACH_RAW_SZ: Icmpv6Type(1059)=133; SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMPv6 destination unreachable packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMPv6 destination unreachable packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_DEST_UNREACH_SZ
|
Message text |
Icmpv6Type(1059)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Source security zone name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_DEST_UNREACH_SZ: Icmpv6Type(1059)=133; SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMPv6 destination unreachable logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_ECHO_REQ
|
Message text |
Icmpv6Type(1059)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Receiving interface name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_ECHO_REQ: Icmpv6Type(1059)=128; RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMPv6 echo request logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_ECHO_REQ_RAW
|
Message text |
Icmpv6Type(1059)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Receiving interface name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_ECHO_REQ_RAW: Icmpv6Type(1059)=128; RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMPv6 echo requests of the same attributes, this message is sent only when the first request is received. If log aggregation is disabled, this message is sent every time an ICMPv6 echo request is received. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_ECHO_REQ_RAW_SZ
|
Message text |
Icmpv6Type(1059)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Source security zone name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_ECHO_REQ_RAW_SZ: Icmpv6Type(1059)=128; SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMPv6 echo requests of the same attributes, this message is sent only when the first request is received. If log aggregation is disabled, this message is sent every time an ICMPv6 echo request is received. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_ECHO_REQ_SZ
|
Message text |
Icmpv6Type(1059)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Source security zone name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_ECHO_REQ_SZ: Icmpv6Type(1059)=128; SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMPv6 echo request logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_ECHO_RPL
|
Message text |
Icmpv6Type(1059)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Receiving interface name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_ECHO_RPL: Icmpv6Type(1059)=129; RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMPv6 echo reply logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_ECHO_RPL_RAW
|
Message text |
Icmpv6Type(1059)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Receiving interface name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_ECHO_RPL_RAW: Icmpv6Type(1059)=129; RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMPv6 echo replies of the same attributes, this message is sent only when the first reply is received. If log aggregation is disabled, this message is sent every time an ICMPv6 echo reply is received. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_ECHO_RPL_RAW_SZ
|
Message text |
Icmpv6Type(1059)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Source security zone name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_ECHO_RPL_RAW_SZ: Icmpv6Type(1059)=129; SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMPv6 echo replies of the same attributes, this message is sent only when the first reply is received. If log aggregation is disabled, this message is sent every time an ICMPv6 echo reply is received. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_ECHO_RPL_SZ
|
Message text |
Icmpv6Type(1059)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Source security zone name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_ECHO_RPL_SZ: Icmpv6Type(1059)=129; SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMPv6 echo reply logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_FLOOD
|
Message text |
RcvIfName(1023)=[STRING]; DstIPv6Addr(1037)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Destination IPv6 address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMPV6_FLOOD: RcvIfName(1023)=Ethernet0/0/2; DstIPv6Addr(1007)=2002::2; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009093351. |
|
Explanation |
This message is sent when the number of ICMPv6 packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_FLOOD_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; DstIPv6Addr(1037)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Destination IPv6 address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMPV6_FLOOD_SZ: SrcZoneName(1025)=Trust; DstIPv6Addr(1007)=2002::2; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009093351. |
|
Explanation |
This message is sent when the number of ICMPv6 packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_GROUPQUERY
|
Message text |
Icmpv6Type(1059)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Receiving interface name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_GROUPQUERY: Icmpv6Type(1059)=130; RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMPv6 multicast listener query logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_GROUPQUERY_RAW
|
Message text |
Icmpv6Type(1059)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Receiving interface name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_GROUPQUERY_RAW: Icmpv6Type(1059)=130; RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMPv6 multicast listener queries of the same attributes, this message is sent only when the first query is received. If log aggregation is disabled, this message is sent every time an ICMPv6 multicast listener query is received. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_GROUPQUERY_RAW_SZ
|
Message text |
Icmpv6Type(1059)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Source security zone name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_GROUPQUERY_RAW_SZ: Icmpv6Type(1059)=130; SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMPv6 multicast listener queries of the same attributes, this message is sent only when the first query is received. If log aggregation is disabled, this message is sent every time an ICMPv6 multicast listener query is received. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_GROUPQUERY_SZ
|
Message text |
Icmpv6Type(1059)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Source security zone name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_GROUPQUERY_SZ: Icmpv6Type(1059)=130; SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMPv6 multicast listener query logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_GROUPREDUCTION
|
Message text |
Icmpv6Type(1059)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Receiving interface name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_GROUPREDUCTION: Icmpv6Type(1059)=132; RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMPv6 multicast listener done logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_GROUPREDUCTION_RAW
|
Message text |
Icmpv6Type(1059)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Receiving interface name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_GROUPREDUCTION_RAW: Icmpv6Type(1059)=132; RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMPv6 multicast listener done packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMPv6 multicast listener done packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_GROUPREDUCTION_RAW_SZ
|
Message text |
Icmpv6Type(1059)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Source security zone name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_GROUPREDUCTION_RAW_SZ: Icmpv6Type(1059)=132; SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMPv6 multicast listener done packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMPv6 multicast listener done packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_GROUPREDUCTION_SZ
|
Message text |
Icmpv6Type(1059)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Source security zone name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_GROUPREDUCTION_SZ: Icmpv6Type(1059)=132; SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMPv6 multicast listener done logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_GROUPREPORT
|
Message text |
Icmpv6Type(1059)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Receiving interface name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_GROUPREPORT: Icmpv6Type(1059)=131; RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMPv6 multicast listener report logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_GROUPREPORT_RAW
|
Message text |
Icmpv6Type(1059)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Receiving interface name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_GROUPREPORT_RAW: Icmpv6Type(1059)=131; RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMPv6 multicast listener reports of the same attributes, this message is sent only when the first report is received. If log aggregation is disabled, this message is sent every time an ICMPv6 multicast listener report is received. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_GROUPREPORT_RAW_SZ
|
Message text |
Icmpv6Type(1059)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Source security zone name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_GROUPREPORT_RAW_SZ: Icmpv6Type(1059)=131; SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMPv6 multicast listener reports of the same attributes, this message is sent only when the first report is received. If log aggregation is disabled, this message is sent every time an ICMPv6 multicast listener report is received. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_GROUPREPORT_SZ
|
Message text |
Icmpv6Type(1059)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Source security zone name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_GROUPREPORT_SZ: Icmpv6Type(1059)=131; SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMPv6 multicast listener report logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_LARGE
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. $7: End time of the attack. $8: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMPV6_LARGE: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when large ICMPv6 packet logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_LARGE_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMPV6_LARGE_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for large ICMPv6 packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a large ICMPv6 packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_LARGE_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMPV6_LARGE_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for large ICMPv6 packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a large ICMPv6 packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_LARGE_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. $7: End time of the attack. $8: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMPV6_LARGE_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when large ICMPv6 packet logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_PACKETTOOBIG
|
Message text |
Icmpv6Type(1059)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Receiving interface name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_PACKETTOOBIG: Icmpv6Type(1059)=136; RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMPv6 packet too big logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_PACKETTOOBIG_RAW
|
Message text |
Icmpv6Type(1059)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Receiving interface name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_PACKETTOOBIG_RAW: Icmpv6Type(1059)=136; RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMPv6 packet too big packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMPv6 packet too big packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_PACKETTOOBIG_RAW_SZ
|
Message text |
Icmpv6Type(1059)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Source security zone name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_PACKETTOOBIG_RAW_SZ: Icmpv6Type(1059)=136; SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMPv6 packet too big packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMPv6 packet too big packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_PACKETTOOBIG_SZ
|
Message text |
Icmpv6Type(1059)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Source security zone name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_PACKETTOOBIG_SZ: Icmpv6Type(1059)=136; SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMPv6 packet too big logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_PARAPROBLEM
|
Message text |
Icmpv6Type(1059)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Receiving interface name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_PARAPROBLEM: Icmpv6Type(1059)=135; RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMPv6 parameter problem logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_PARAPROBLEM_RAW
|
Message text |
Icmpv6Type(1059)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Receiving interface name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_PARAPROBLEM_RAW: Icmpv6Type(1059)=135; RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMPv6 parameter problem packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMPv6 parameter problem packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_PARAPROBLEM_RAW_SZ
|
Message text |
Icmpv6Type(1059)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Source security zone name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_PARAPROBLEM_RAW_SZ: Icmpv6Type(1059)=135; SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMPv6 parameter problem packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMPv6 parameter problem packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_PARAPROBLEM_SZ
|
Message text |
Icmpv6Type(1059)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Source security zone name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_PARAPROBLEM_SZ: Icmpv6Type(1059)=135; SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMPv6 parameter problem logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_TIMEEXCEED
|
Message text |
Icmpv6Type(1059)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Receiving interface name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_TIMEEXCEED: Icmpv6Type(1059)=134; RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMPv6 time exceeded logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_TIMEEXCEED_RAW
|
Message text |
Icmpv6Type(1059)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Receiving interface name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_TIMEEXCEED_RAW: Icmpv6Type(1059)=134; RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMPv6 time exceeded packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMPv6 time exceeded packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_TIMEEXCEED_RAW_SZ
|
Message text |
Icmpv6Type(1059)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Source security zone name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_TIMEEXCEED_RAW_SZ: Icmpv6Type(1059)=134; SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for ICMPv6 time exceeded packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMPv6 time exceeded packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_TIMEEXCEED_SZ
|
Message text |
Icmpv6Type(1059)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Source security zone name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_TIMEEXCEED_SZ: Icmpv6Type(1059)=134; SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when ICMPv6 time exceeded logs are aggregated. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_TRACEROUTE
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. $7: End time of the attack. $8: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMPV6_TRACEROUTE: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for ICMPv6 time exceeded packets of code 0. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_TRACEROUTE_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. $7: End time of the attack. $8: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMPV6_TRACEROUTE_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435. |
|
Explanation |
If log aggregation is enabled, for ICMPv6 time exceeded packets of code 0 of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMPv6 time exceeded packet of code 0 is received. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_TRACEROUTE_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. $7: End time of the attack. $8: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMPV6_TRACEROUTE_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435. |
|
Explanation |
If log aggregation is enabled, for ICMPv6 time exceeded packets of code 0 of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an ICMPv6 time exceeded packet of code 0 is received. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_TRACEROUTE_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. $7: End time of the attack. $8: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_ICMPV6_TRACEROUTE_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for ICMPv6 time exceeded packets of code 0. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_TYPE
|
Message text |
Icmpv6Type(1059)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Receiving interface name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_TYPE: Icmpv6Type(1059)=38; RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for user-defined ICMPv6 packets. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_TYPE _RAW_SZ
|
Message text |
Icmpv6Type(1059)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Source security zone name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_TYPE_RAW_SZ: Icmpv6Type(1059)=38; SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for user-defined ICMPv6 packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a user-defined ICMPv6 packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_TYPE_RAW
|
Message text |
Icmpv6Type(1059)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Receiving interface name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_TYPE_RAW: Icmpv6Type(1059)=38; RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for user-defined ICMPv6 packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a user-defined ICMPv6 packet is received. |
|
Recommended action |
No action is required. |
ATK_ICMPV6_TYPE_SZ
|
Message text |
Icmpv6Type(1059)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: ICMPv6 message type. $2: Source security zone name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_ICMPV6_TYPE_SZ: Icmpv6Type(1059)=38; SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=5600::12; DstIPv6Addr(1037)=1200:0:3400:0:5600:0:7800:0; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011100935; EndTime_c(1012)=20131011101435; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for user-defined ICMPv6 packets. |
|
Recommended action |
No action is required. |
ATK_IP_OPTION
|
Message text |
IPOptValue(1057)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: IP option value. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. $9: Start time of the attack. $10: End time of the attack. $11: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IP_OPTION: IPOptValue(1057)=38; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging; BeginTime_c(1011)=20131011063123; EndTime_c(1012)=20131011063623; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for packets with a user-defined IP option. |
|
Recommended action |
No action is required. |
ATK_IP_OPTION_RAW
|
Message text |
IPOptValue(1057)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: IP option value. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IP_OPTION_RAW: IPOptValue(1057)=38; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for packets with a user-defined IP option and of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet with a user-defined IP option is received. |
|
Recommended action |
No action is required. |
ATK_IP_OPTION_RAW_SZ
|
Message text |
IPOptValue(1057)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: IP option value. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IP_OPTION_RAW_SZ: IPOptValue(1057)=38; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for packets with a user-defined IP option and of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet with a user-defined IP option is received. |
|
Recommended action |
No action is required. |
ATK_IP_OPTION_SZ
|
Message text |
IPOptValue(1057)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: IP option value. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. $9: Start time of the attack. $10: End time of the attack. $11: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IP_OPTION_SZ: IPOptValue(1057)=38; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging; BeginTime_c(1011)=20131011063123; EndTime_c(1012)=20131011063623; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for packets with a user-defined IP option. |
|
Recommended action |
No action is required. |
ATK_IP4_ACK_FLOOD
|
Message text |
RcvIfName(1023)=[STRING]; DstIPAddr(1007)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Destination IP address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_ACK_FLOOD: RcvIfName(1023)=Ethernet0/0/2; DstIPAddr(1007)=6.1.1.5; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009093351. |
|
Explanation |
This message is sent when the number of IPv4 ACK packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP4_ACK_FLOOD_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; DstIPAddr(1007)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Destination IP address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_ACK_FLOOD_SZ: SrcZoneName(1025)=Trust; DstIPAddr(1007)=6.1.1.5; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009093351. |
|
Explanation |
This message is sent when the number of IPv4 ACK packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP4_DIS_PORTSCAN
|
Message text |
RcvIfName(1023)=[STRING]; Protocol(1001)=[STRING]; TcpFlag(1074)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Protocol name. $3: TCP packet type. (This field is available only for TCP packets.) $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_DIS_PORTSCAN: RcvIfName(1023)=Ethernet0/0/2; Protocol(1001)=TCP; TcpFlag(1074)=[SYN]; DstIPAddr(1007)=6.1.1.5; RcvVPNInstance(1041)=vpn1; Action(1049)=logging,block-source; BeginTime_c(1011)=20131009052955. |
|
Explanation |
This message is sent when an IPv4 distributed port scan attack is detected. |
|
Recommended action |
No action is required. |
ATK_IP4_DIS_PORTSCAN_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; Protocol(1001)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Protocol name. $3: Destination IP address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_DIS_PORTSCAN_SZ: SrcZoneName(1025)=Trust; Protocol(1001)=TCP; DstIPAddr(1007)=6.1.1.5; RcvVPNInstance(1041)=vpn1; Action(1049)=logging,block-source; BeginTime_c(1011)=20131009052955. |
|
Explanation |
This message is sent when an IPv4 distributed port scan attack is detected. |
|
Recommended action |
No action is required. |
ATK_IP4_DNS_FLOOD
|
Message text |
RcvIfName(1023)=[STRING]; DstIPAddr(1007)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Destination IP address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_DNS_FLOOD: RcvIfName(1023)=Ethernet0/0/2; DstIPAddr(1007)=6.1.1.5; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009093351. |
|
Explanation |
This message is sent when the number of IPv4 DNS queries sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP4_DNS_FLOOD_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; DstIPAddr(1007)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Destination IP address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_DNS_FLOOD_SZ: SrcZoneName(1025)=Trust; DstIPAddr(1007)=6.1.1.5; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009093351. |
|
Explanation |
This message is sent when the number of IPv4 DNS queries sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP4_FIN_FLOOD
|
Message text |
RcvIfName(1023)=[STRING]; DstIPAddr(1007)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Destination IP address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_FIN_FLOOD: RcvIfName(1023)=Ethernet0/0/2; DstIPAddr(1007)=6.1.1.5; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009093351. |
|
Explanation |
This message is sent when the number of IPv4 FIN packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP4_FIN_FLOOD_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; DstIPAddr(1007)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Destination IP address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_FIN_FLOOD_SZ: SrcZoneName(1025)=Trust; DstIPAddr(1007)=6.1.1.5; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009093351. |
|
Explanation |
This message is sent when the number of IPv4 FIN packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP4_FRAGMENT
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Protocol type. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_FRAGMENT: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=TCP; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 packets with an offset smaller than 5 but bigger than 0. |
|
Recommended action |
No action is required. |
ATK_IP4_FRAGMENT_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Protocol type. $7: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_FRAGMENT_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=TCP; Action(1049)=logging. |
|
Explanation |
This message is for the IPv4 fragment attack. The attack uses IPv4 packets with an offset smaller than 5 but bigger than 0. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_FRAGMENT_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Protocol type. $7: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_FRAGMENT_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=TCP; Action(1049)=logging. |
|
Explanation |
This message is for the IPv4 fragment attack. The attack uses IPv4 packets with an offset smaller than 5 but bigger than 0. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_FRAGMENT_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Protocol type. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_FRAGMENT_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=TCP; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 packets with an offset smaller than 5 but bigger than 0. |
|
Recommended action |
No action is required. |
ATK_IP4_HTTP_FLOOD
|
Message text |
RcvIfName(1023)=[STRING]; DstIPAddr(1007)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Destination IP address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_HTTP_FLOOD: RcvIfName(1023)=Ethernet0/0/2; DstIPAddr(1007)=6.1.1.5; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009093351. |
|
Explanation |
This message is sent when the number of IPv4 HTTP Get packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP4_HTTP_FLOOD_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; DstIPAddr(1007)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Destination IP address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_HTTP_FLOOD_SZ: SrcZoneName(1025)=Trust; DstIPAddr(1007)=6.1.1.5; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009093351. |
|
Explanation |
This message is sent when the number of IPv4 HTTP Get packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP4_IMPOSSIBLE
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Protocol type. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_IMPOSSIBLE: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=TCP; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 packets whose source IPv4 address is the same as the destination IPv4 address. |
|
Recommended action |
No action is required. |
ATK_IP4_IMPOSSIBLE_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Protocol type. $7: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_IMPOSSIBLE_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=TCP; Action(1049)=logging. |
|
Explanation |
This message is for the IPv4 impossible packet attack. The attack uses IPv4 packets whose source IPv4 address is the same as the destination IPv4 address. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_IMPOSSIBLE_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Protocol type. $7: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_IMPOSSIBLE_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=TCP; Action(1049)=logging. |
|
Explanation |
This message is for the IPv4 impossible packet attack. The attack uses IPv4 packets whose source IPv4 address is the same as the destination IPv4 address. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_IMPOSSIBLE_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Protocol type. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_IMPOSSIBLE_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=TCP; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 packets whose source IPv4 address is the same as the destination IPv4 address. |
|
Recommended action |
No action is required. |
ATK_IP4_IPSWEEP
|
Message text |
RcvIfName(1023)=[STRING]; Protocol(1001)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Protocol name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_IPSWEEP: RcvIfName(1023)=Ethernet0/0/2; Protocol(1001)=TCP; SrcIPAddr(1003)=9.1.1.5; DSLiteTunnelPeer(1040)=--; RcvVPNInstance(1041)=vpn1; Action(1049)=logging,block-source; BeginTime_c(1011)=20131009060657. |
|
Explanation |
This message is sent when an IPv4 sweep attack is detected. |
|
Recommended action |
No action is required. |
ATK_IP4_IPSWEEP_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; Protocol(1001)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Protocol name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_IPSWEEP_SZ: SrcZoneName(1025)=Trust; Protocol(1001)=TCP; SrcIPAddr(1003)=9.1.1.5; DSLiteTunnelPeer(1040)=--; RcvVPNInstance(1041)=vpn1; Action(1049)=logging,block-source; BeginTime_c(1011)=20131009060657. |
|
Explanation |
This message is sent when an IPv4 sweep attack is detected. |
|
Recommended action |
No action is required. |
ATK_IP4_PORTSCAN
|
Message text |
RcvIfName(1023)=[STRING]; Protocol(1001)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; RcvVPNInstance(1041)=[STRING]; DstIPAddr(1007)=[IPADDR]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Protocol name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Name of the receiving VPN instance. $6: Destination IP address. $7: Actions against the attack. $8: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_PORTSCAN: RcvIfName(1023)=Ethernet0/0/2; Protocol(1001)=TCP; SrcIPAddr(1003)=9.1.1.5; DSLiteTunnelPeer(1040)=--; RcvVPNInstance(1041)=vpn1; DstIPAddr(1007)=6.1.1.5; Action(1049)=logging,block-source; BeginTime_c(1011)=20131009052955. |
|
Explanation |
This message is sent when an IPv4 port scan attack is detected. |
|
Recommended action |
No action is required. |
ATK_IP4_PORTSCAN_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; Protocol(1001)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; RcvVPNInstance(1041)=[STRING]; DstIPAddr(1007)=[IPADDR]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Protocol name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Name of the receiving VPN instance. $6: Destination IP address. $7: Actions against the attack. $8: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_PORTSCAN_SZ: SrcZoneName(1025)=Trust; Protocol(1001)=TCP; SrcIPAddr(1003)=9.1.1.5; DSLiteTunnelPeer(1040)=--; RcvVPNInstance(1041)=vpn1; DstIPAddr(1007)=6.1.1.5; Action(1049)=logging,block-source; BeginTime_c(1011)=20131009052955. |
|
Explanation |
This message is sent when an IPv4 port scan attack is detected. |
|
Recommended action |
No action is required. |
ATK_IP4_RST_FLOOD
|
Message text |
RcvIfName(1023)=[STRING]; DstIPAddr(1007)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Destination IP address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_RST_FLOOD: RcvIfName(1023)=Ethernet0/0/2; DstIPAddr(1007)=6.1.1.5; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009093351. |
|
Explanation |
This message is sent when the number of IPv4 RST packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP4_RST_FLOOD_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; DstIPAddr(1007)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Destination IP address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_RST_FLOOD_SZ: SrcZoneName(1025)=Trust; DstIPAddr(1007)=6.1.1.5; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009093351. |
|
Explanation |
This message is sent when the number of IPv4 RST packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP4_SYN_FLOOD
|
Message text |
RcvIfName(1023)=[STRING]; DstIPAddr(1007)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Destination IP address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_SYN_FLOOD: RcvIfName(1023)=Ethernet0/0/2; DstIPAddr(1007)=6.1.1.5; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009093351. |
|
Explanation |
This message is sent when the number of IPv4 SYN packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP4_SYN_FLOOD_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Destination IP address. $3: Name of the receiving VPN instance. $4: Rate limit. $5: Actions against the attack. $6: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_SYN_FLOOD_SZ: SrcZoneName(1025)=Trust; DstIPAddr(1007)=6.1.1.5; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009093351. |
|
Explanation |
This message is sent when the number of IPv4 SYN packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP4_SYNACK_FLOOD
|
Message text |
RcvIfName(1023)=[STRING]; DstIPAddr(1007)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Destination IP address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_SYNACK_FLOOD: RcvIfName(1023)=Ethernet0/0/2; DstIPAddr(1007)=6.1.1.5; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009093351. |
|
Explanation |
This message is sent when the number of IPv4 SYN-ACK packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP4_SYNACK_FLOOD_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; DstIPAddr(1007)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Destination IP address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_SYNACK_FLOOD_SZ: SrcZoneName(1025)=Trust; DstIPAddr(1007)=6.1.1.5; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009093351. |
|
Explanation |
This message is sent when the number of IPv4 SYN-ACK packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_ALLFLAGS
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_ALLFLAGS: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 TCP packets that have all flags set. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_ALLFLAGS_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_ALLFLAGS_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv4 TCP packets that have all flags set. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_ALLFLAGS_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_ALLFLAGS_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv4 TCP packets that have all flags set. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_ALLFLAGS_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_ALLFLAGS_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 TCP packets that have all flags set. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_FINONLY
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_FINONLY: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 TCP packets that have only the FIN flag set. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_FINONLY_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_FINONLY_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv4 TCP packets that have only the FIN flag set. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_FINONLY_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_FINONLY_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv4 TCP packets that have only the FIN flag set. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_FINONLY_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_FINONLY_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 TCP packets that have only the FIN flag set. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_INVALIDFLAGS
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_INVALIDFLAGS: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 TCP packets that have invalid flag settings. Invalid flag settings include: · The RST and FIN flags are both set. · The RST and SYN flags are both set. · The RST, FIN, and SYN flags are all set. · The PSH, RST, and FIN flags are all set. · The PSH, RST, and SYN flags are all set. · The PSH, RST, SYN, and FIN flags are all set. · The ACK, RST, and FIN flags are all set. · The ACK, RST, and SYN flags are all set. · The ACK, RST, SYN, and FIN flags are all set. · The ACK, PSH, SYN, and FIN flags are all set. · The ACK, PSH, RST, and FIN flags are all set. · The ACK, PSH, RST, and SYN flags are all set. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_INVALIDFLAGS_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_INVALIDFLAGS_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv4 TCP packets that have invalid flag settings. Invalid flag settings include: · The RST and FIN flags are both set. · The RST and SYN flags are both set. · The RST, FIN, and SYN flags are all set. · The PSH, RST, and FIN flags are all set. · The PSH, RST, and SYN flags are all set. · The PSH, RST, SYN, and FIN flags are all set. · The ACK, RST, and FIN flags are all set. · The ACK, RST, and SYN flags are all set. · The ACK, RST, SYN, and FIN flags are all set. · The ACK, PSH, SYN, and FIN flags are all set. · The ACK, PSH, RST, and FIN flags are all set. · The ACK, PSH, RST, and SYN flags are all set. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_INVALIDFLAGS_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_INVALIDFLAGS_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv4 TCP packets that have invalid flag settings. Invalid flag settings include: · The RST and FIN flags are both set. · The RST and SYN flags are both set. · The RST, FIN, and SYN flags are all set. · The PSH, RST, and FIN flags are all set. · The PSH, RST, and SYN flags are all set. · The PSH, RST, SYN, and FIN flags are all set. · The ACK, RST, and FIN flags are all set. · The ACK, RST, and SYN flags are all set. · The ACK, RST, SYN, and FIN flags are all set. · The ACK, PSH, SYN, and FIN flags are all set. · The ACK, PSH, RST, and FIN flags are all set. · The ACK, PSH, RST, and SYN flags are all set. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_INVALIDFLAGS_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_INVALIDFLAGS_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 TCP packets that have invalid flag settings. Invalid flag settings include: · The RST and FIN flags are both set. · The RST and SYN flags are both set. · The RST, FIN, and SYN flags are all set. · The PSH, RST, and FIN flags are all set. · The PSH, RST, and SYN flags are all set. · The PSH, RST, SYN, and FIN flags are all set. · The ACK, RST, and FIN flags are all set. · The ACK, RST, and SYN flags are all set. · The ACK, RST, SYN, and FIN flags are all set. · The ACK, PSH, SYN, and FIN flags are all set. · The ACK, PSH, RST, and FIN flags are all set. · The ACK, PSH, RST, and SYN flags are all set. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_LAND
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_LAND: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 TCP packets whose source IP address is the same as the destination IP address. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_LAND_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_LAND_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for the IPv4 land attack. The attack uses IPv4 TCP packets whose source IP address is the same as the destination IP address. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_LAND_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_LAND_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for the IPv4 land attack. The attack uses IPv4 TCP packets whose source IP address is the same as the destination IP address. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_LAND_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_LAND_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 TCP packets whose source IP address is the same as the destination IP address. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_NULLFLAG
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_NULLFLAG: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=4. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 TCP packets that have no flag set. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_NULLFLAG_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_NULLFLAG_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv4 TCP packets that have no flag set. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_NULLFLAG_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_NULLFLAG_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv4 TCP packets that have no flag set. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_NULLFLAG_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_NULLFLAG_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=4. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 TCP packets that have no flag set. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_SYNFIN
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_SYNFIN: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 TCP packets that have SYN and FIN flags set. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_SYNFIN_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_SYNFIN_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv4 TCP packets that have SYN and FIN flags set. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_SYNFIN_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_SYNFIN_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv4 TCP packets that have SYN and FIN flags set. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_SYNFIN_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_SYNFIN_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 TCP packets that have SYN and FIN flags set. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_WINNUKE
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_WINNUKE: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=5. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 TCP packets with destination port 139, the URG flag set, and a nonzero Urgent Pointer. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_WINNUKE_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_WINNUKE_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for the IPv4 WinNuke attack. The attack uses IPv4 TCP packets with destination port 139, the URG flag set, and a nonzero Urgent Pointer. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_WINNUKE_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_WINNUKE_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for the IPv4 WinNuke attack. The attack uses IPv4 TCP packets with destination port 139, the URG flag set, and a nonzero Urgent Pointer. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_TCP_WINNUKE_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TCP_WINNUKE_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=5. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 TCP packets with destination port 139, the URG flag set, and a nonzero Urgent Pointer. |
|
Recommended action |
No action is required. |
ATK_IP4_TEARDROP
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Protocol type. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TEARDROP: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=TCP; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 overlapping fragments. |
|
Recommended action |
No action is required. |
ATK_IP4_TEARDROP_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Protocol type. $7: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TEARDROP_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=TCP; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for IPv4 overlapping fragments of the same attributes, this message is sent only when the first overlapping fragment is received. If log aggregation is disabled, this message is sent every time an IPv4 overlapping fragment is received. |
|
Recommended action |
No action is required. |
ATK_IP4_TEARDROP_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Protocol type. $7: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TEARDROP_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=TCP; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for IPv4 overlapping fragments of the same attributes, this message is sent only when the first overlapping fragment is received. If log aggregation is disabled, this message is sent every time an IPv4 overlapping fragment is received. |
|
Recommended action |
No action is required. |
ATK_IP4_TEARDROP_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Protocol type. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TEARDROP_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=TCP; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 overlapping fragments. |
|
Recommended action |
No action is required. |
ATK_IP4_TINY_FRAGMENT
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Protocol type. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TINY_FRAGMENT: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=TCP; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=6. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 packets with a datagram smaller than 68 bytes and the MF flag set. |
|
Recommended action |
No action is required. |
ATK_IP4_TINY_FRAGMENT_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Protocol type. $7: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TINY_FRAGMENT_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=TCP; Action(1049)=logging. |
|
Explanation |
This message is for the IPv4 tiny fragment attack. The attack uses IPv4 packets with a datagram smaller than 68 bytes and the MF flag set. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_TINY_FRAGMENT_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Protocol type. $7: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TINY_FRAGMENT_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=TCP; Action(1049)=logging. |
|
Explanation |
This message is for the IPv4 tiny fragment attack. The attack uses IPv4 packets with a datagram smaller than 68 bytes and the MF flag set. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_TINY_FRAGMENT_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Protocol type. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_TINY_FRAGMENT_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=TCP; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=6. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 packets with a datagram smaller than 68 bytes and the MF flag set. |
|
Recommended action |
No action is required. |
ATK_IP4_UDP_BOMB
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_UDP_BOMB: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 UDP packets in which the length value in the IP header is larger than the IP header length plus the length in the UDP header. |
|
Recommended action |
No action is required. |
ATK_IP4_UDP_BOMB_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_UDP_BOMB_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv4 UDP bomb attack. The attack uses IPv4 UDP packets in which the length value in the IP header is larger than the IP header length plus the length in the UDP header. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_UDP_BOMB_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_UDP_BOMB_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv4 UDP bomb attack. The attack uses IPv4 UDP packets in which the length value in the IP header is larger than the IP header length plus the length in the UDP header. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_UDP_BOMB_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_UDP_BOMB_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 UDP packets in which the length value in the IP header is larger than the IP header length plus the length in the UDP header. |
|
Recommended action |
No action is required. |
ATK_IP4_UDP_FLOOD
|
Message text |
RcvIfName(1023)=[STRING]; DstIPAddr(1007)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Destination IP address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_UDP_FLOOD: RcvIfName(1023)=Ethernet0/0/2; DstIPAddr(1007)=6.1.1.5; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009093351. |
|
Explanation |
This message is sent when the number of IPv4 UDP packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP4_UDP_FLOOD_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; DstIPAddr(1007)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Destination IP address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_UDP_FLOOD_SZ: SrcZoneName(1025)=Trust; DstIPAddr(1007)=6.1.1.5; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009093351. |
|
Explanation |
This message is sent when the number of IPv4 UDP packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP4_UDP_FRAGGLE
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_UDP_FRAGGLE: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=11. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 UDP packets with source port 7 and destination port 19. |
|
Recommended action |
No action is required. |
ATK_IP4_UDP_FRAGGLE_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_UDP_FRAGGLE_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv4 UDP fraggle attack. The attack uses IPv4 UDP packets with source port 7 and destination port 19. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_UDP_FRAGGLE_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_UDP_FRAGGLE_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv4 UDP fraggle attack. The attack uses IPv4 UDP packets with source port 7 and destination port 19. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_UDP_FRAGGLE_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_UDP_FRAGGLE_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=11. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 UDP packets with source port 7 and destination port 19. |
|
Recommended action |
No action is required. |
ATK_IP4_UDP_SNORK
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_UDP_SNORK: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 UDP packets with source port 7, 19, or 135, and destination port 135. |
|
Recommended action |
No action is required. |
ATK_IP4_UDP_SNORK_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_UDP_SNORK_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv4 UDP snork attack. The attack uses IPv4 UDP packets with source port 7, 19, or 135, and destination port 135. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_UDP_SNORK_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_UDP_SNORK_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv4 UDP snork attack. The attack uses IPv4 UDP packets with source port 7, 19, or 135, and destination port 135. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP4_UDP_SNORK_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP4_UDP_SNORK_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131011074913; EndTime_c(1012)=20131011075413; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv4 UDP packets with source port 7, 19, or 135, and destination port 135. |
|
Recommended action |
No action is required. |
ATK_IP6_ACK_FLOOD
|
Message text |
RcvIfName(1023)=[STRING]; DstIPv6Addr(1037)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Destination IPv6 address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_ACK_FLOOD: RcvIfName(1023)=Ethernet0/0/2; DstIPv6Addr(1037)=2::2; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009100434. |
|
Explanation |
This message is sent when the number of IPv6 ACK packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP6_ACK_FLOOD_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; DstIPv6Addr(1037)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Destination IPv6 address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_ACK_FLOOD_SZ: SrcZoneName(1025)=Trust; DstIPv6Addr(1037)=2::2; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009100434. |
|
Explanation |
This message is sent when the number of IPv6 ACK packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP6_DIS_PORTSCAN
|
Message text |
RcvIfName(1023)=[STRING]; Protocol(1001)=[STRING]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Protocol name. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_DIS_PORTSCAN: RcvIfName(1023)=Ethernet0/0/2; Protocol(1001)=UDP; DstIPv6Addr(1037)=2::2; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131009100928. |
|
Explanation |
This message is sent when an IPv6 distributed port scan attack is detected. |
|
Recommended action |
No action is required. |
ATK_IP6_DIS_PORTSCAN_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; Protocol(1001)=[STRING]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Protocol name. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_DIS_PORTSCAN_SZ: SrcZoneName(1025)=Trust; Protocol(1001)=TCP; DstIPv6Addr(1037)=2::2; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131009100928. |
|
Explanation |
This message is sent when an IPv6 distributed port scan attack is detected. |
|
Recommended action |
No action is required. |
ATK_IP6_DNS_FLOOD
|
Message text |
RcvIfName(1023)=[STRING]; DstIPv6Addr(1037)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Destination IPv6 address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_DNS_FLOOD: RcvIfName(1023)=Ethernet0/0/2; DstIPv6Addr(1037)=2::2; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009100434. |
|
Explanation |
This message is sent when the number of IPv6 DNS queries sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP6_DNS_FLOOD_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; DstIPv6Addr(1037)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Destination IPv6 address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_DNS_FLOOD_SZ: SrcZoneName(1025)=Trust; DstIPv6Addr(1037)=2::2; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009100434. |
|
Explanation |
This message is sent when the number of IPv6 DNS queries sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP6_FIN_FLOOD
|
Message text |
RcvIfName(1023)=[STRING]; DstIPv6Addr(1037)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Destination IPv6 address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_FIN_FLOOD: RcvIfName(1023)=Ethernet0/0/2; DstIPv6Addr(1037)=2::2; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009100434. |
|
Explanation |
This message is sent when the number of IPv6 FIN packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP6_FIN_FLOOD_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; DstIPv6Addr(1037)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Destination IPv6 address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_FIN_FLOOD_SZ: SrcZoneName(1025)=Trust; DstIPv6Addr(1037)=2::2; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009100434. |
|
Explanation |
This message is sent when the number of IPv6 FIN packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP6_FRAGMENT
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Protocol type. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_FRAGMENT: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=1::1; RcvVPNInstance(1041)=--; Protocol(1001)=IPv6-ICMP; Action(1049)=logging; BeginTime_c(1011)=20131011103335; EndTime_c(1012)=20131011103835; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv6 packets with an offset smaller than 5 but bigger than 0. |
|
Recommended action |
No action is required. |
ATK_IP6_FRAGMENT_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Protocol type. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_FRAGMENT_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=1::1; RcvVPNInstance(1041)=--; Protocol(1001)=IPv6-ICMP; Action(1049)=logging. |
|
Explanation |
This message is for the IPv6 fragment attack. The attack uses IPv6 packets with an offset smaller than 5 but bigger than 0. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP6_FRAGMENT_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Protocol type. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_FRAGMENT_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=1::1; RcvVPNInstance(1041)=--; Protocol(1001)=IPv6-ICMP; Action(1049)=logging. |
|
Explanation |
This message is for the IPv6 fragment attack. The attack uses IPv6 packets with an offset smaller than 5 but bigger than 0. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP6_FRAGMENT_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Protocol type. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_FRAGMENT_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=1::1; RcvVPNInstance(1041)=--; Protocol(1001)=IPv6-ICMP; Action(1049)=logging; BeginTime_c(1011)=20131011103335; EndTime_c(1012)=20131011103835; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv6 packets with an offset smaller than 5 but bigger than 0. |
|
Recommended action |
No action is required. |
ATK_IP6_HTTP_FLOOD
|
Message text |
RcvIfName(1023)=[STRING]; DstIPv6Addr(1037)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Destination IPv6 address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_HTTP_FLOOD: RcvIfName(1023)=Ethernet0/0/2; DstIPv6Addr(1037)=2::2; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009100434. |
|
Explanation |
This message is sent when the number of IPv6 HTTP Get packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP6_HTTP_FLOOD_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; DstIPv6Addr(1037)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Destination IPv6 address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_HTTP_FLOOD_SZ: SrcZoneName(1025)=Trust; DstIPv6Addr(1037)=2::2; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009100434. |
|
Explanation |
This message is sent when the number of IPv6 HTTP Get packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP6_IMPOSSIBLE
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Protocol type. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_IMPOSSIBLE: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=1::1; RcvVPNInstance(1041)=--; Protocol(1001)=IPv6-ICMP; Action(1049)=logging; BeginTime_c(1011)=20131011103335; EndTime_c(1012)=20131011103835; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv6 packets whose source IPv6 address is the same as the destination IPv6 address. |
|
Recommended action |
No action is required. |
ATK_IP6_IMPOSSIBLE_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Protocol type. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_IMPOSSIBLE_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=1::1; RcvVPNInstance(1041)=--; Protocol(1001)=IPv6-ICMP; Action(1049)=logging. |
|
Explanation |
This message is for the IPv6 impossible packet attack. The attack uses IPv6 packets whose source IPv6 address is the same as the destination IPv6 address. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP6_IMPOSSIBLE_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Protocol type. $6: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_IMPOSSIBLE_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=1::1; RcvVPNInstance(1041)=--; Protocol(1001)=IPv6-ICMP; Action(1049)=logging. |
|
Explanation |
This message is for the IPv6 impossible packet attack. The attack uses IPv6 packets whose source IPv6 address is the same as the destination IPv6 address. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP6_IMPOSSIBLE_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Protocol type. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_IMPOSSIBLE_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=1::1; RcvVPNInstance(1041)=--; Protocol(1001)=IPv6-ICMP; Action(1049)=logging; BeginTime_c(1011)=20131011103335; EndTime_c(1012)=20131011103835; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv6 packets whose source IPv6 address is the same as the destination IPv6 address. |
|
Recommended action |
No action is required. |
ATK_IP6_IPSWEEP
|
Message text |
RcvIfName(1023)=[STRING]; Protocol(1001)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Protocol name. $3: Source IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_IPSWEEP: RcvIfName(1023)=Ethernet0/0/2; Protocol(1001)=UDP; SrcIPv6Addr(1036)=1::5; RcvVPNInstance(1041)=--; Action(1049)=logging,block-source; BeginTime_c(1011)=20131009100639. |
|
Explanation |
This message is sent when an IPv6 sweep attack is detected. |
|
Recommended action |
No action is required. |
ATK_IP6_IPSWEEP_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; Protocol(1001)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Protocol name. $3: Source IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_IPSWEEP_SZ: SrcZoneName(1025)=Trust; Protocol(1001)=TCP; SrcIPv6Addr(1036)=1::5; RcvVPNInstance(1041)=--; Action(1049)=logging,block-source; BeginTime_c(1011)=20131009100639. |
|
Explanation |
This message is sent when an IPv6 sweep attack is detected. |
|
Recommended action |
No action is required. |
ATK_IP6_PORTSCAN
|
Message text |
RcvIfName(1023)=[STRING]; Protocol(1001)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; DstIPv6Addr(1037)=[IPADDR]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Protocol name. $3: Source IPv6 address. $4: Name of the receiving VPN instance. $5: Destination IPv6 address. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_PORTSCAN: RcvIfName(1023)=Ethernet0/0/2; Protocol(1001)=UDP; SrcIPv6Addr(1036)=1::5; RcvVPNInstance(1041)=--; DstIPv6Addr(1037)=2::2; Action(1049)=logging,block-source; BeginTime_c(1011)=20131009100455. |
|
Explanation |
This message is sent when an IPv6 port scan attack is detected. |
|
Recommended action |
No action is required. |
ATK_IP6_PORTSCAN_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; Protocol(1001)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; DstIPv6Addr(1037)=[IPADDR]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Protocol name. $3: Source IPv6 address. $4: Name of the receiving VPN instance. $5: Destination IPv6 address. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_PORTSCAN_SZ: SrcZoneName(1025)=Trust; Protocol(1001)=TCP; SrcIPv6Addr(1036)=1::5; RcvVPNInstance(1041)=--; DstIPv6Addr(1037)=2::2; Action(1049)=logging,block-source; BeginTime_c(1011)=20131009100455. |
|
Explanation |
This message is sent when an IPv6 port scan attack is detected. |
|
Recommended action |
No action is required. |
ATK_IP6_RST_FLOOD
|
Message text |
RcvIfName(1023)=[STRING]; DstIPv6Addr(1037)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Destination IPv6 address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_RST_FLOOD: RcvIfName(1023)=Ethernet0/0/2; DstIPv6Addr(1037)=2::2; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009100434. |
|
Explanation |
This message is sent when the number of IPv6 RST packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP6_RST_FLOOD_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; DstIPv6Addr(1037)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Destination IPv6 address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_RST_FLOOD_SZ: SrcZoneName(1025)=Trust; DstIPv6Addr(1037)=2::2; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009100434. |
|
Explanation |
This message is sent when the number of IPv6 RST packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP6_SYN_FLOOD
|
Message text |
RcvIfName(1023)=[STRING]; DstIPv6Addr(1037)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Destination IPv6 address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_SYN_FLOOD: RcvIfName(1023)=Ethernet0/0/2; DstIPv6Addr(1037)=2::2; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009100434. |
|
Explanation |
This message is sent when the number of IPv6 SYN packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP6_SYN_FLOOD_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; DstIPv6Addr(1037)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Destination IPv6 address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_SYN_FLOOD_SZ: SrcZoneName(1025)=Trust; DstIPv6Addr(1037)=2::2; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009100434. |
|
Explanation |
This message is sent when the number of IPv6 SYN packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP6_SYNACK_FLOOD
|
Message text |
RcvIfName(1023)=[STRING]; DstIPv6Addr(1037)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Destination IPv6 address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_SYNACK_FLOOD: RcvIfName(1023)=Ethernet0/0/2; DstIPv6Addr(1037)=2::2; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009100434. |
|
Explanation |
This message is sent when the number of IPv6 SYN-ACK packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP6_SYNACK_FLOOD_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; DstIPv6Addr(1037)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Destination IPv6 address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_SYNACK_FLOOD_SZ: SrcZoneName(1025)=Trust; DstIPv6Addr(1037)=2::2; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009100434. |
|
Explanation |
This message is sent when the number of IPv6 SYN-ACK packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_ALLFLAGS
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. $7: End time of the attack. $8: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_ALLFLAGS: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131009103631; EndTime_c(1012)=20131009104131; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv6 TCP packets that have all flags set. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_ALLFLAGS_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_ALLFLAGS_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=2000::1; DstIPv6Addr(1037)=2003::200; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv6 TCP packets that have all flags set. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_ALLFLAGS_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_ALLFLAGS_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=2000::1; DstIPv6Addr(1037)=2003::200; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv6 TCP packets that have all flags set. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_ALLFLAGS_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. $7: End time of the attack. $8: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_ALLFLAGS_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131009103631; EndTime_c(1012)=20131009104131; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv6 TCP packets that have all flags set. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_FINONLY
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. $7: End time of the attack. $8: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_FINONLY: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131009103631; EndTime_c(1012)=20131009104131; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv6 TCP packets that have only the FIN flag set. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_FINONLY_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_FINONLY_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=2000::1; DstIPv6Addr(1037)=2003::200; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv6 TCP packets that have only the FIN flag set. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_FINONLY_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_FINONLY_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=2000::1; DstIPv6Addr(1037)=2003::200; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv6 TCP packets that have only the FIN flag set. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_FINONLY_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. $7: End time of the attack. $8: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_FINONLY_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131009103631; EndTime_c(1012)=20131009104131; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv6 TCP packets that have only the FIN flag set. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_INVALIDFLAGS
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. $7: End time of the attack. $8: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_INVALIDFLAGS: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131009103631; EndTime_c(1012)=20131009104131; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv6 TCP packets that have invalid flag settings. Invalid flag settings include: · The RST and FIN flags are both set. · The RST and SYN flags are both set. · The RST, FIN, and SYN flags are all set. · The PSH, RST, and FIN flags are all set. · The PSH, RST, and SYN flags are all set. · The PSH, RST, SYN, and FIN flags are all set. · The ACK, RST, and FIN flags are all set. · The ACK, RST, and SYN flags are all set. · The ACK, RST, SYN, and FIN flags are all set. · The ACK, PSH, SYN, and FIN flags are all set. · The ACK, PSH, RST, and FIN flags are all set. · The ACK, PSH, RST, and SYN flags are all set. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_INVALIDFLAGS_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_INVALIDFLAGS_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=2000::1; DstIPv6Addr(1037)=2003::200; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv6 TCP packets that have invalid flag settings. Invalid flag settings include: · The RST and FIN flags are both set. · The RST and SYN flags are both set. · The RST, FIN, and SYN flags are all set. · The PSH, RST, and FIN flags are all set. · The PSH, RST, and SYN flags are all set. · The PSH, RST, SYN, and FIN flags are all set. · The ACK, RST, and FIN flags are all set. · The ACK, RST, and SYN flags are all set. · The ACK, RST, SYN, and FIN flags are all set. · The ACK, PSH, SYN, and FIN flags are all set. · The ACK, PSH, RST, and FIN flags are all set. · The ACK, PSH, RST, and SYN flags are all set. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_INVALIDFLAGS_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_INVALIDFLAGS_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=2000::1; DstIPv6Addr(1037)=2003::200; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv6 TCP packets that have invalid flag settings. Invalid flag settings include: · The RST and FIN flags are both set. · The RST and SYN flags are both set. · The RST, FIN, and SYN flags are all set. · The PSH, RST, and FIN flags are all set. · The PSH, RST, and SYN flags are all set. · The PSH, RST, SYN, and FIN flags are all set. · The ACK, RST, and FIN flags are all set. · The ACK, RST, and SYN flags are all set. · The ACK, RST, SYN, and FIN flags are all set. · The ACK, PSH, SYN, and FIN flags are all set. · The ACK, PSH, RST, and FIN flags are all set. · The ACK, PSH, RST, and SYN flags are all set. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_INVALIDFLAGS_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. $7: End time of the attack. $8: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_INVALIDFLAGS_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131009103631; EndTime_c(1012)=20131009104131; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv6 TCP packets that have invalid flag settings. Invalid flag settings include: · The RST and FIN flags are both set. · The RST and SYN flags are both set. · The RST, FIN, and SYN flags are all set. · The PSH, RST, and FIN flags are all set. · The PSH, RST, and SYN flags are all set. · The PSH, RST, SYN, and FIN flags are all set. · The ACK, RST, and FIN flags are all set. · The ACK, RST, and SYN flags are all set. · The ACK, RST, SYN, and FIN flags are all set. · The ACK, PSH, SYN, and FIN flags are all set. · The ACK, PSH, RST, and FIN flags are all set. · The ACK, PSH, RST, and SYN flags are all set. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_LAND
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. $7: End time of the attack. $8: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_LAND: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131009103631; EndTime_c(1012)=20131009104131; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv6 TCP packets whose source IPv6 address is the same as the destination IPv6 address. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_LAND_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_LAND_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=2000::1; DstIPv6Addr(1037)=2003::200; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for the IPv6 land attack. The attack uses IPv6 TCP packets whose source IPv6 address is the same as the destination IPv6 address. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_LAND_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_LAND_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=2000::1; DstIPv6Addr(1037)=2003::200; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for the IPv6 land attack. The attack uses IPv6 TCP packets whose source IPv6 address is the same as the destination IPv6 address. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_LAND_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. $7: End time of the attack. $8: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_LAND_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131009103631; EndTime_c(1012)=20131009104131; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv6 TCP packets whose source IPv6 address is the same as the destination IPv6 address. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_NULLFLAG
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. $7: End time of the attack. $8: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_NULLFLAG: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131009103631; EndTime_c(1012)=20131009104131; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv6 TCP packets that have no flag set. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_NULLFLAG_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_NULLFLAG_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=2000::1; DstIPv6Addr(1037)=2003::200; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv6 TCP packets that have no flag set. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_NULLFLAG_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_NULLFLAG_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=2000::1; DstIPv6Addr(1037)=2003::200; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv6 TCP packets that have no flag set. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_NULLFLAG_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. $7: End time of the attack. $8: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_NULLFLAG_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131009103631; EndTime_c(1012)=20131009104131; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv6 TCP packets that have no flag set. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_SYNFIN
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. $7: End time of the attack. $8: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_SYNFIN: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131009103631; EndTime_c(1012)=20131009104131; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv6 TCP packets that have SYN and FIN flags set. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_SYNFIN_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_SYNFIN_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=2000::1; DstIPv6Addr(1037)=2003::200; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv6 TCP packets that have SYN and FIN flags set. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_SYNFIN_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_SYNFIN_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=2000::1; DstIPv6Addr(1037)=2003::200; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv6 TCP packets that have SYN and FIN flags set. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_SYNFIN_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. $7: End time of the attack. $8: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_SYNFIN_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131009103631; EndTime_c(1012)=20131009104131; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv6 TCP packets that have SYN and FIN flags set. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_WINNUKE
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. $7: End time of the attack. $8: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_WINNUKE: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131009103631; EndTime_c(1012)=20131009104131; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv6 TCP packets with destination port 139, the URG flag set, and a nonzero Urgent Pointer. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_WINNUKE_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_WINNUKE_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for the IPv6 WinNuke attack. The attack uses IPv6 TCP packets with destination port 139, the URG flag set, and a nonzero Urgent Pointer. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_WINNUKE_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_WINNUKE_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for the IPv6 WinNuke attack. The attack uses IPv6 TCP packets with destination port 139, the URG flag set, and a nonzero Urgent Pointer. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP6_TCP_WINNUKE_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. $7: End time of the attack. $8: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_TCP_WINNUKE_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131009103631; EndTime_c(1012)=20131009104131; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv6 TCP packets with destination port 139, the URG flag set, and a nonzero Urgent Pointer. |
|
Recommended action |
No action is required. |
ATK_IP6_UDP_FLOOD
|
Message text |
RcvIfName(1023)=[STRING]; DstIPv6Addr(1037)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Destination IPv6 address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_UDP_FLOOD: RcvIfName(1023)=Ethernet0/0/2; DstIPv6Addr(1037)=2::2; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009100434. |
|
Explanation |
This message is sent when the number of IPv6 UDP packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP6_UDP_FLOOD_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; DstIPv6Addr(1037)=[IPADDR]; DstPort(1008)=[UINT16]; RcvVPNInstance(1041)=[STRING]; UpperLimit(1048)=[UINT32]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Destination IPv6 address. $3: Destination port number. $4: Name of the receiving VPN instance. $5: Rate limit. $6: Actions against the attack. $7: Start time of the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_UDP_FLOOD_SZ: SrcZoneName(1025)=Trust; DstIPv6Addr(1037)=2::2; DstPort(1008)=22; RcvVPNInstance(1041)=--; UpperLimit(1048)=10; Action(1049)=logging; BeginTime_c(1011)=20131009100434. |
|
Explanation |
This message is sent when the number of IPv6 UDP packets sent to a destination per second exceeds the rate limit. |
|
Recommended action |
No action is required. |
ATK_IP6_UDP_FRAGGLE
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. $7: End time of the attack. $8: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_UDP_FRAGGLE: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131009103631; EndTime_c(1012)=20131009104131; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv6 UDP packets with source port 7 and destination port 19. |
|
Recommended action |
No action is required. |
ATK_IP6_UDP_FRAGGLE_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_UDP_FRAGGLE_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv6 UDP fraggle attack. The attack uses IPv6 UDP packets with source port 7 and destination port 19. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP6_UDP_FRAGGLE_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_UDP_FRAGGLE_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv6 UDP fraggle attack. The attack uses IPv6 UDP packets with source port 7 and destination port 19. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP6_UDP_FRAGGLE_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. $7: End time of the attack. $8: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_UDP_FRAGGLE_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131009103631; EndTime_c(1012)=20131009104131; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv6 UDP packets with source port 7 and destination port 19. |
|
Recommended action |
No action is required. |
ATK_IP6_UDP_SNORK
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. $7: End time of the attack. $8: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_UDP_SNORK: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131009103631; EndTime_c(1012)=20131009104131; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv6 UDP packets with source port 7, 19, or 135, and destination port 135. |
|
Recommended action |
No action is required. |
ATK_IP6_UDP_SNORK_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_UDP_SNORK_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv6 UDP snork attack. The attack uses IPv6 UDP packets with source port 7, 19, or 135, and port 135. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP6_UDP_SNORK_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_UDP_SNORK_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
This message is for IPv6 UDP snork attack. The attack uses IPv6 UDP packets with source port 7, 19, or 135, and port 135. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet is received. |
|
Recommended action |
No action is required. |
ATK_IP6_UDP_SNORK_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. $7: End time of the attack. $8: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IP6_UDP_SNORK_SZ: SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131009103631; EndTime_c(1012)=20131009104131; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv6 UDP packets with source port 7, 19, or 135, and destination port 135. |
|
Recommended action |
No action is required. |
ATK_IPOPT_ABNORMAL
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Protocol type. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IPOPT_ABNORMAL: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging; BeginTime_c(1011)=20131011072002; EndTime_c(1012)=20131011072502; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for packets with more than two IP options. |
|
Recommended action |
No action is required. |
ATK_IPOPT_ABNORMAL_RAW
|
Message text |
RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Receiving interface name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Protocol type. $7: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IPOPT_ABNORMAL_RAW: RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging. |
|
Explanation |
This message is for packets that each has more than two IP options. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet with more than two IP options is received. |
|
Recommended action |
No action is required. |
ATK_IPOPT_ABNORMAL_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Protocol type. $7: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IPOPT_ABNORMAL_RAW_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging. |
|
Explanation |
This message is for packets that each has more than two IP options. If log aggregation is enabled, for packets of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet with more than two IP options is received. |
|
Recommended action |
No action is required. |
ATK_IPOPT_ABNORMAL_SZ
|
Message text |
SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IP address. $3: IP address of the peer DS-Lite tunnel interface. $4: Destination IP address. $5: Name of the receiving VPN instance. $6: Protocol type. $7: Actions against the attack. $8: Start time of the attack. $9: End time of the attack. $10: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IPOPT_ABNORMAL_SZ: SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging; BeginTime_c(1011)=20131011072002; EndTime_c(1012)=20131011072502; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for packets with more than two IP options. |
|
Recommended action |
No action is required. |
ATK_IPOPT_LOOSESRCROUTE
|
Message text |
IPOptValue(1057)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)= [UINT32]. |
|
Variable fields |
$1: IP option value. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. $9: Start time of the attack. $10: End time of the attack. $11: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_LOOSESRCROUTE: IPOptValue(1057)=131; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging; BeginTime_c(1011)=20131011063123; EndTime_c(1012)=20131011063623; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for packets with IP option 131. |
|
Recommended action |
No action is required. |
ATK_IPOPT_LOOSESRCROUTE_RAW
|
Message text |
IPOptValue(1057)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: IP option value. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_LOOSESRCROUTE_RAW: IPOptValue(1057)=131; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for packets with IP option 131 and of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet with IP option 131 is received. |
|
Recommended action |
No action is required. |
ATK_IPOPT_LOOSESRCROUTE_RAW_SZ
|
Message text |
IPOptValue(1057)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: IP option value. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_LOOSESRCROUTE_RAW_SZ: IPOptValue(1057)=131; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for packets with IP option 131 and of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet with IP option 131 is received. |
|
Recommended action |
No action is required. |
ATK_IPOPT_LOOSESRCROUTE_SZ
|
Message text |
IPOptValue(1057)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)= [UINT32]. |
|
Variable fields |
$1: IP option value. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. $9: Start time of the attack. $10: End time of the attack. $11: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_LOOSESRCROUTE_SZ: IPOptValue(1057)=131; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging; BeginTime_c(1011)=20131011063123; EndTime_c(1012)=20131011063623; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for packets with IP option 131. |
|
Recommended action |
No action is required. |
ATK_IPOPT_RECORDROUTE
|
Message text |
IPOptValue(1057)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: IP option value. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. $9: Start time of the attack. $10: End time of the attack. $11: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_RECORDROUTE: IPOptValue(1057)=7; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging; BeginTime_c(1011)=20131011063123; EndTime_c(1012)=20131011063623; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for packets with IP option 7. |
|
Recommended action |
No action is required. |
ATK_IPOPT_RECORDROUTE_RAW
|
Message text |
IPOptValue(1057)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: IP option value. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_RECORDROUTE_RAW: IPOptValue(1057)=7; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for packets with IP option 7 and of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet with IP option 7 is received. |
|
Recommended action |
No action is required. |
ATK_IPOPT_RECORDROUTE_RAW_SZ
|
Message text |
IPOptValue(1057)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: IP option value. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_RECORDROUTE_RAW_SZ: IPOptValue(1057)=7; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for packets with IP option 7 and of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet with IP option 7 is received. |
|
Recommended action |
No action is required. |
ATK_IPOPT_RECORDROUTE_SZ
|
Message text |
IPOptValue(1057)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: IP option value. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. $9: Start time of the attack. $10: End time of the attack. $11: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_RECORDROUTE_SZ: IPOptValue(1057)=7; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging; BeginTime_c(1011)=20131011063123; EndTime_c(1012)=20131011063623; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for packets with IP option 7. |
|
Recommended action |
No action is required. |
ATK_IPOPT_ROUTEALERT
|
Message text |
IPOptValue(1057)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: IP option value. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. $9: Start time of the attack. $10: End time of the attack. $11: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_ROUTEALERT: IPOptValue(1057)=148; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging; BeginTime_c(1011)=20131011063123; EndTime_c(1012)=20131011063623; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for packets with IP option 148. |
|
Recommended action |
No action is required. |
ATK_IPOPT_ROUTEALERT_RAW
|
Message text |
IPOptValue(1057)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: IP option value. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_ROUTEALERT_RAW: IPOptValue(1057)=148; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for packets with IP option 148 and of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet with IP option 148 is received. |
|
Recommended action |
No action is required. |
ATK_IPOPT_ROUTEALERT_RAW_SZ
|
Message text |
IPOptValue(1057)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: IP option value. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_ROUTEALERT_RAW_SZ: IPOptValue(1057)=148; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for packets with IP option 148 and of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet with IP option 148 is received. |
|
Recommended action |
No action is required. |
ATK_IPOPT_ROUTEALERT_SZ
|
Message text |
IPOptValue(1057)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: IP option value. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. $9: Start time of the attack. $10: End time of the attack. $11: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_ROUTEALERT_SZ: IPOptValue(1057)=148; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging; BeginTime_c(1011)=20131011063123; EndTime_c(1012)=20131011063623; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for packets with IP option 148. |
|
Recommended action |
No action is required. |
ATK_IPOPT_SECURITY
|
Message text |
IPOptValue(1057)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: IP option value. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. $9: Start time of the attack. $10: End time of the attack. $11: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_SECURITY: IPOptValue(1057)=130; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging; BeginTime_c(1011)=20131009091022; EndTime_c(1012)=20131009091522; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for packets with IP option 130. |
|
Recommended action |
No action is required. |
ATK_IPOPT_SECURITY_RAW
|
Message text |
IPOptValue(1057)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: IP option value. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_SECURITY_RAW: IPOptValue(1057)=130; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for packets with IP option 130 and of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet with IP option 130 is received. |
|
Recommended action |
No action is required. |
ATK_IPOPT_SECURITY_RAW_SZ
|
Message text |
IPOptValue(1057)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: IP option value. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_SECURITY_RAW_SZ: IPOptValue(1057)=130; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for packets with IP option 130 and of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet with IP option 130 is received. |
|
Recommended action |
No action is required. |
ATK_IPOPT_SECURITY_SZ
|
Message text |
IPOptValue(1057)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: IP option value. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. $9: Start time of the attack. $10: End time of the attack. $11: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_SECURITY_SZ: IPOptValue(1057)=130; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging; BeginTime_c(1011)=20131009091022; EndTime_c(1012)=20131009091522; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for packets with IP option 130. |
|
Recommended action |
No action is required. |
ATK_IPOPT_STREAMID
|
Message text |
IPOptValue(1057)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: IP option value. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. $9: Start time of the attack. $10: End time of the attack. $11: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_STREAMID: IPOptValue(1057)=136; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging; BeginTime_c(1011)=20131011063123; EndTime_c(1012)=20131011063623; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for packets with IP option 136. |
|
Recommended action |
No action is required. |
ATK_IPOPT_STREAMID_RAW
|
Message text |
IPOptValue(1057)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: IP option value. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_STREAMID_RAW: IPOptValue(1057)=136; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for packets with IP option 136 and of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet with IP option 136 is received. |
|
Recommended action |
No action is required. |
ATK_IPOPT_STREAMID_RAW_SZ
|
Message text |
IPOptValue(1057)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: IP option value. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_STREAMID_RAW_SZ: IPOptValue(1057)=136; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for packets with IP option 136 and of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet with IP option 136 is received. |
|
Recommended action |
No action is required. |
ATK_IPOPT_STREAMID_SZ
|
Message text |
IPOptValue(1057)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: IP option value. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. $9: Start time of the attack. $10: End time of the attack. $11: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_STREAMID_SZ: IPOptValue(1057)=136; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging; BeginTime_c(1011)=20131011063123; EndTime_c(1012)=20131011063623; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for packets with IP option 136. |
|
Recommended action |
No action is required. |
ATK_IPOPT_STRICTSRCROUTE
|
Message text |
IPOptValue(1057)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: IP option value. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. $9: Start time of the attack. $10: End time of the attack. $11: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_STRICTSRCROUTE: IPOptValue(1057)=137; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging; BeginTime_c(1011)=20131011063123; EndTime_c(1012)=20131011063623; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for packets with IP option 137. |
|
Recommended action |
No action is required. |
ATK_IPOPT_STRICTSRCROUTE_RAW
|
Message text |
IPOptValue(1057)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: IP option value. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_STRICTSRCROUTE_RAW: IPOptValue(1057)=137; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for packets with IP option 137 and of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet with IP option 137 is received. |
|
Recommended action |
No action is required. |
ATK_IPOPT_STRICTSRCROUTE_RAW_SZ
|
Message text |
IPOptValue(1057)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: IP option value. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_STRICTSRCROUTE_RAW_SZ: IPOptValue(1057)=137; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for packets with IP option 137 and of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet with IP option 137 is received. |
|
Recommended action |
No action is required. |
ATK_IPOPT_STRICTSRCROUTE_SZ
|
Message text |
IPOptValue(1057)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: IP option value. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. $9: Start time of the attack. $10: End time of the attack. $11: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_STRICTSRCROUTE_SZ: IPOptValue(1057)=137; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging; BeginTime_c(1011)=20131011063123; EndTime_c(1012)=20131011063623; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for packets with IP option 137. |
|
Recommended action |
No action is required. |
ATK_IPOPT_TIMESTAMP
|
Message text |
IPOptValue(1057)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: IP option value. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. $9: Start time of the attack. $10: End time of the attack. $11: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_TIMESTAMP: IPOptValue(1057)=68; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging; BeginTime_c(1011)=20131011063123; EndTime_c(1012)=20131011063623; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for packets with IP option 68. |
|
Recommended action |
No action is required. |
ATK_IPOPT_TIMESTAMP_RAW
|
Message text |
IPOptValue(1057)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: IP option value. $2: Receiving interface name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_TIMESTAMP_RAW: IPOptValue(1057)=68; RcvIfName(1023)=Ethernet0/0/2; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for packets with IP option 68 and of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet with IP option 68 is received. |
|
Recommended action |
No action is required. |
ATK_IPOPT_TIMESTAMP_RAW_SZ
|
Message text |
IPOptValue(1057)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: IP option value. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_TIMESTAMP_RAW_SZ: IPOptValue(1057)=68; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for packets with IP option 68 and of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time a packet with IP option 68 is received. |
|
Recommended action |
No action is required. |
ATK_IPOPT_TIMESTAMP_SZ
|
Message text |
IPOptValue(1057)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPAddr(1003)=[IPADDR]; DSLiteTunnelPeer(1040)=[STRING]; DstIPAddr(1007)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Protocol(1001)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: IP option value. $2: Source security zone name. $3: Source IP address. $4: IP address of the peer DS-Lite tunnel interface. $5: Destination IP address. $6: Name of the receiving VPN instance. $7: Protocol type. $8: Actions against the attack. $9: Start time of the attack. $10: End time of the attack. $11: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPOPT_TIMESTAMP_SZ: IPOptValue(1057)=68; SrcZoneName(1025)=Trust; SrcIPAddr(1003)=9.1.1.1; DSLiteTunnelPeer(1040)=--; DstIPAddr(1007)=6.1.1.1; RcvVPNInstance(1041)=--; Protocol(1001)=RAWIP; Action(1049)=logging; BeginTime_c(1011)=20131011063123; EndTime_c(1012)=20131011063623; AtkTimes(1050)=3. |
|
Explanation |
This message is sent when logs are aggregated for packets with IP option 68. |
|
Recommended action |
No action is required. |
ATK_IPV6_EXT_HEADER
|
Message text |
IPv6ExtHeader(1060)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: IPv6 extension header value. $2: Receiving interface name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPV6_EXT_HEADER: IPv6ExtHeader(1060)=43; RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131009103631; EndTime_c(1012)=20131009104131; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv6 packets with a user-defined extension header. |
|
Recommended action |
No action is required. |
ATK_IPV6_EXT_HEADER_ABNORMAL_RAW_SZ
|
Message text |
SrcZoneName(1025)=[STRING];SrcIPv6Addr(1036)=[IPADDR];DstIPv6Addr(1037)=[IPADDR];RcvVPNInstance(1042)=[STRING];Action(1053)=[STRING]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IPV6_EXT_HEADER_ABNORMAL_RAW_SZ: SrcZoneName(1025)=Trust;SrcIPv6Addr(1036)=1::1;DstIPv6Addr(1037)=2::11;RcvVPNInstance(1042)=--;Action(1053)=logging. |
|
Explanation |
If log aggregation is disabled, the message is sent every time the device receives an abnormal IPv6 packet in which the number of extension headers exceeds the specified upper limit. |
|
Recommended action |
No action is required. |
ATK_IPV6_EXT_HEADER_ABNORMAL_SZ
|
Message text |
SrcZoneName(1025)=[STRING];SrcIPv6Addr(1036)=[IPADDR];DstIPv6Addr(1037)=[IPADDR];RcvVPNInstance(1042)=[STRING];Action(1053)=[STRING];BeginTime_c(1011)=[STRING];EndTime_c(1012)=[STRING];AtkTimes(1054)=[UINT32]. |
|
Variable fields |
$1: Source security zone name. $2: Source IPv6 address. $3: Destination IPv6 address. $4: Name of the receiving VPN instance. $5: Actions against the attack. $6: Start time of the attack. $7: End time of the attack. $8: Attack times. |
|
Severity level |
3 |
|
Example |
ATK/3/ATK_IPV6_EXT_HEADER_ABNORMAL_SZ: SrcZoneName(1025)=Trust;SrcIPv6Addr(1036)=1::1;DstIPv6Addr(1037)=2::11;RcvVPNInstance(1042)=--;Action(1053)=logging;BeginTime_c(1011)=20131009103631;EndTime_c(1012)=20131009104131;AtkTimes(1054)=2. |
|
Explanation |
If log aggregation is enabled, the message is sent when logs are aggregated for receving abnormal IPv6 packets. The abnormal IPv6 packets include the following: · IPv6 packets in which the number of extension headers exceeds the specified upper limit. · IPv6 packets in which a duplicate-disallowed extension header appears more than once. |
|
Recommended action |
No action is required. |
ATK_IPV6_EXT_HEADER_RAW
|
Message text |
IPv6ExtHeader(1060)=[UINT32]; RcvIfName(1023)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: IPv6 extension header value. $2: Receiving interface name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPV6_EXT_HEADER_RAW: IPv6ExtHeader(1060)=43; RcvIfName(1023)=Ethernet0/0/2; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for IPv6 packets with a user-defined extension header and of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an IPv6 packet with a user-defined extension header is received. |
|
Recommended action |
No action is required. |
ATK_IPV6_EXT_HEADER_RAW_SZ
|
Message text |
IPv6ExtHeader(1060)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]. |
|
Variable fields |
$1: IPv6 extension header value. $2: Source security zone name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPV6_EXT_HEADER_RAW_SZ: IPv6ExtHeader(1060)=43; SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging. |
|
Explanation |
If log aggregation is enabled, for IPv6 packets with a user-defined extension header and of the same attributes, this message is sent only when the first packet is received. If log aggregation is disabled, this message is sent every time an IPv6 packet with a user-defined extension header is received. |
|
Recommended action |
No action is required. |
ATK_IPV6_EXT_HEADER_SZ
|
Message text |
IPv6ExtHeader(1060)=[UINT32]; SrcZoneName(1025)=[STRING]; SrcIPv6Addr(1036)=[IPADDR]; DstIPv6Addr(1037)=[IPADDR]; RcvVPNInstance(1041)=[STRING]; Action(1049)=[STRING]; BeginTime_c(1011)=[STRING]; EndTime_c(1012)=[STRING]; AtkTimes(1050)=[UINT32]. |
|
Variable fields |
$1: IPv6 extension header value. $2: Source security zone name. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Name of the receiving VPN instance. $6: Actions against the attack. $7: Start time of the attack. $8: End time of the attack. $9: Attack times. |
|
Severity level |
5 |
|
Example |
ATK/5/ATK_IPV6_EXT_HEADER_SZ: IPv6ExtHeader(1060)=43; SrcZoneName(1025)=Trust; SrcIPv6Addr(1036)=1::1; DstIPv6Addr(1037)=2::11; RcvVPNInstance(1041)=--; Action(1049)=logging; BeginTime_c(1011)=20131009103631; EndTime_c(1012)=20131009104131; AtkTimes(1050)=2. |
|
Explanation |
This message is sent when logs are aggregated for IPv6 packets with a user-defined extension header. |
|
Recommended action |
No action is required. |
ATM
This section contains ATM messages.
ATM_PVCDOWN
|
Message text |
|
|
Variable fields |
|
|
Severity level |
|
|
Example |
ATM/5/ATM_PVCDOWN: Interface ATM2/0/2 PVC 0/100 status is down. |
|
Explanation |
The PVC state became down. Possible reasons include the following: · The ATM interface to which the PVC belongs went down. · The OAM state of the PVC became down. · The PVC had been manually shut down. |
|
Recommended action |
Use the display atm pvc-info command to display detailed information about the PVC and take relevant actions: · If the interface state is down, take the following actions: ¡ Make sure both the local and remote ATM interfaces are up by using the display interface atm command. If the interfaces have been manually shut down, execute the undo shutdown command in interface view to bring them up. ¡ Make sure the two interfaces are correctly connected. · If the OAM state is down, take the following actions: ¡ Make sure the VPI/VCI value of the remote PVC is the same as the VPI/VCI value of the local PVC. ¡ Make sure the OAM configuration of the remote PVC is consistent with the OAM configuration of the local PVC. For example, if one end is configured as the OAM CC cell sink, the other end must be configured as the OAM CC cell source. ¡ Make sure the remote PVC is up. If the remote PVC has been manually shut down, execute the undo shutdown command in PVC view to bring it up. ¡ Make sure the two ends are correctly connected. ¡ If the two routers are connected through an ATM network, in addition to the previous check items, you must check the forwarding rule of the ATM network. If the ATM network cannot reach the PVC, the PVC cannot come up. · If the PVC state is down, check if the local PVC has been manually shut down. To bring up the PVC, execute the undo shutdown command in PVC view. |
ATM_PVCUP
|
Message text |
|
|
Variable fields |
|
|
Severity level |
|
|
Example |
|
|
Explanation |
The PVC state became up. |
|
Recommended action |
No action is required. |
BFD messages
This section contains BFD messages.
BFDMAD_PORT_CONFLICT
|
Message text |
Interface [STRING] has been configured as a dedicated BFD MAD port. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
5 (Notification) |
|
Example |
BFD/5/BFDMAD_PORT_CONFLICT: -MDC=1-Chassis=1-Slot=9; Interface GE1/9/2/2 has been configured as a dedicated BFD MAD port. |
|
Impact |
No negative impact on the system. |
|
Cause |
In an IRF fabric, a card can have only one dedicated BFD MAD port if IRF physical interfaces exist on the card. |
|
Recommended action |
No action is required. |
BFD_NORESOURCE
|
Message text |
No hardware resource for session LD [INT32]. |
|
Variable fields |
$1: BFD local identifier. |
|
Severity level |
5 (Notification) |
|
Example |
BFD/5/BFD_NORESOURCE: -Slot=8; No hardware resource for session LD [1]. |
|
Impact |
New hardware BFD sessions and CFD sessions cannot be created. |
|
Cause |
Hardware BFD resources are insufficient. |
|
Recommended action |
1. Use the display resource-monitor command to view the resource usage of hard_bfd_counter_resource in the corresponding slot. 2. Identify whether the BFD or CFD service quantity exceeds the total amount of resources. 3. Release unnecessary BFD or CFD services. 4. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
BFD messages
This section contains BFD messages.
BFD_CHANGE_FSM (Severity 4)
|
Message text |
Sess[STRING], Ver, Sta: [STRING]->[STRING], Diag: [UINT32] |
|
Variable fields |
$1: Source address, destination address, interface, message type, and MPLS FEC of the BFD session. For LSP sessions, this field contains the destination address, mask, and next hop address of LSPs. For PW sessions, this field contains the LSR ID of the peer PE and the PW ID. For TE tunnel sessions, this field contains the source address, destination address, tunnel ID, and LSP ID. $2: BFD session state before changing. $3: BFD session state after changing. Options include UP and DOWN. $4: Diagnostic information: · 0 (No Diagnostic). · 1 (Control Detection Time Expired)—A control packet mode BFD session goes down, because local detection times out. · 2 (Echo Function Failed)—An echo packet mode BFD session goes down, because local detection times out or the source IP address of echo packets is deleted. · 3 (Neighbor Signaled Session Down)—The remote end notifies the local end of BFD session down. · 7 (Administratively Down)—The local system prevents a BFD session from being established. |
|
Severity level |
4 |
|
Example |
BFD/4/BFD_CHANGE_FSM: Sess[20.0.4.2/20.0.4.1,LD/RD:533/532, Interface:Vlan204, SessType:Ctrl, LinkType:INET], Ver.1, Sta: INIT->UP, Diag: 0 (No Diagnostic). BFD/4/BFD_CHANGE_FSM: Sess[20.0.4.2/20.0.4.1,LD/RD:533/532, Interface: Vlan204, SessType: Ctrl, LinkType: LSP, FEC: LSP, 20.0.4.0/24/10.1.1.1], Ver.1, Sta: INIT->UP, Diag: 0 (No Diagnostic). BFD/4/BFD_CHANGE_FSM: Sess[20.0.4.2/20.0.4.1,LD/RD:533/532, Interface: Vlan204, SessType: Ctrl, LinkType: LSP, FEC: PW FEC-128, 20.0.4.2/1], Ver.1, Sta: INIT->UP, Diag: 0 (No Diagnostic). BFD/4/BFD_CHANGE_FSM: Sess[20.0.4.2/20.0.4.1,LD/RD:533/532, Interface: Vlan204, SessType: Ctrl, LinkType: LSP, FEC: TE Tunnel, 20.0.4.2/20.0.4.1/100/100], Ver.1, Sta: INIT->UP, Diag: 0 (No Diagnostic). |
|
Explanation |
The FSM of the BFD session has changed. This message appears when a BFD session changes to the UP or DOWN state. Unexpected session loss might indicate high error or packet loss rate in the network. |
|
Recommended action |
Check for incorrect BFD configuration or network congestion. |
BFD_CHANGE_FSM (Severity 5)
|
Message text |
Sess[STRING], Ver, Sta: [STRING]->[STRING], Diag: [UINT32] |
|
Variable fields |
$1: Source address, destination address, interface, message type, and MPLS FEC of the BFD session. For LSP sessions, this field contains the destination address, mask, and next hop address of LSPs. For PW sessions, this field contains the LSR ID of the peer PE and the PW ID. For TE tunnel sessions, this field contains the source address, destination address, tunnel ID, and LSP ID. $2: BFD session state before changing. $3: BFD session state after changing. Options include INIT, ADMIN-DOWN, and FAIL. $4: Diagnostic information: · 0 (No Diagnostic). · 1 (Control Detection Time Expired)—A control packet mode BFD session goes down, because local detection times out. · 2 (Echo Function Failed)—An echo packet mode BFD session goes down, because local detection times out or the source IP address of echo packets is deleted. · 3 (Neighbor Signaled Session Down)—The remote end notifies the local end of BFD session down. · 7 (Administratively Down)—The local system prevents a BFD session from being established. |
|
Severity level |
5 |
|
Example |
BFD/5/BFD_CHANGE_FSM: Sess[20.0.4.2/20.0.4.1,LD/RD:533/532, Interface:Vlan204, SessType:Ctrl, LinkType:INET], Ver.1, Sta: DOWN->INIT, Diag: 0 (No Diagnostic). BFD/5/BFD_CHANGE_FSM: Sess[20.0.4.2/20.0.4.1,LD/RD:533/532, Interface: Vlan204, SessType: Ctrl, LinkType: LSP, FEC: LSP, 20.0.4.0/24/10.1.1.1], Ver.1, Sta: DOWN->INIT, Diag: 0 (No Diagnostic). BFD/5/BFD_CHANGE_FSM: Sess[20.0.4.2/20.0.4.1,LD/RD:533/532, Interface: Vlan204, SessType: Ctrl, LinkType: LSP, FEC: PW FEC-128, 20.0.4.2/1], Ver.1, Sta: DOWN->INIT, Diag: 0 (No Diagnostic). BFD/5/BFD_CHANGE_FSM: Sess[20.0.4.2/20.0.4.1,LD/RD:533/532, Interface: Vlan204, SessType: Ctrl, LinkType: LSP, FEC: TE Tunnel, 20.0.4.2/20.0.4.1/100/100], Ver.1, Sta: DOWN->INIT, Diag: 0 (No Diagnostic). |
|
Explanation |
The FSM of the BFD session has been changed. This informational message appears when a BFD session changes to the INIT, ADMIN-DOWN, or FAIL state. Unexpected session loss might indicate high error or packet loss rate in the network. |
|
Recommended action |
Check for incorrect BFD configuration or network congestion. |
BFD_CHANGE_SESS
|
Message text |
Sess[STRING], Ver, Sta: [STRING], Diag: [UINT32] |
|
Variable fields |
$1: Source address, destination address, interface, message type, and MPLS FEC of the BFD session. For LSP sessions, this field contains the destination address, mask, and next hop address of LSPs. For PW sessions, this field contains the LSR ID of the peer PE and the PW ID. For TE tunnel sessions, this field contains the source address, destination address, tunnel ID, and LSP ID. $2: Session state. $3: Diagnostic code. |
|
Severity level |
5 |
|
Example |
BFD/5/BFD_CHANGE_SESS: Sess[17.1.1.2/17.1.1.1, LD/RD:1537/1537, Interface:GE1/0/1, SessType:Ctrl, LinkType:INET], Ver:1, Sta: Deleted, Diag: 7 (Administratively Down) |
|
Explanation |
This informational message appears when a BFD session is deleted. |
|
Recommended action |
Check the BFD session configuration. |
BFD_CREATE_SESS
|
Message text |
The BFD session has been created successfully. Sess [STRING], Ver, SessActive: [UINT32], SessName: [STRING], VpnName: [STRING], Applications: [STRING] |
|
Variable fields |
$1: Source address, destination address, interface, message type, and MPLS FEC of the BFD session. For LSP sessions, this field contains the destination address, mask, and next hop address of LSPs. For PW sessions, this field contains the LSR ID of the peer PE and the PW ID. For TE tunnel sessions, this field contains the source address, destination address, tunnel ID, and LSP ID. $2: Whether the session is activated: · 0—False. · 1—True. $3: Session name. $4: Name of the VPN associated with the session. $5: Name of the application associated with the session. |
|
Severity level |
5 |
|
Example |
BFD/5/BFD_CREATE_SESS: Sess [17.1.1.2/17.1.1.1, LD/RD: 1537/1537, Interface: GE1/0/1, SessType: Ctrl, LinkType: INET], Ver: 1, SessActive: 1, SessName: test, VpnName: test, Applications: BGP/OSPF |
|
Explanation |
This informational message appears when a BFD session is created. |
|
Recommended action |
No action is required. |
BFD_PKT_AUTH_ERR
|
Message text |
Sess [STRING], Ver, Sta: [STRING], Diag: [UINT32], P: [ UINT32], F: [ UINT32], C: [UINT32], A: [UINT32], D: [UINT32], M: [UINT32], DetectMult: [UINT32], Length: [UINT32], UDP port: [UINT32], TTL: [UINT32], PktAuthType: [UINT32], SessAuthType: [UINT32], Reason: [STRING] |
|
Variable fields |
$1: Source address, destination address, interface, message type, and MPLS FEC of the BFD session. For LSP sessions, this field contains the destination address, mask, and next hop address of LSPs. For PW sessions, this field contains the LSR ID of the peer PE and the PW ID. For TE tunnel sessions, this field contains the source address, destination address, tunnel ID, and LSP ID. $2: State field contained in a BFD message: · 0—AdminDown · 1—Down · 2—Init · 3—Up $3: Diagnostic information: · 0 (No Diagnostic). · 1 (Control Detection Time Expired)—A control packet mode BFD session goes down, because local detection times out. · 2 (Echo Function Failed)—An echo packet mode BFD session goes down, because local detection times out or the source IP address of echo packets is deleted. · 3 (Neighbor Signaled Session Down)—The remote end notifies the local end of BFD session down. · 7 (Administratively Down)—The local system prevents a BFD session from being established. · $4: P-bit contained in a BFD message. $5: F-bit contained in a BFD message. $6: C-bit contained in a BFD message. $7: A-bit contained in a BFD message. $8: D-bit contained in a BFD message. $9: M-bit contained in a BFD message. $10: Detection time multiplier contained in a BFD message. $11: Length contained in a BFD message. $12: UDP port number contained in a BFD message. $13: TTL contained in a BFD message. $14: Authentication mode contained in a BFD message: · 0—None · 1—Simple authentication mode. · 2—MD5 algorithm. · 3—M-MD5 algorithm. · 4—SHA1 algorithm. · 5—M-SHA1 algorithm. $15: Authentication mode of the BFD session: · 0—None. · 1—Simple authentication mode. · 2—MD5 algorithm. · 3—M-MD5 algorithm. · 4—SHA1 algorithm. · 5—M-SHA1 algorithm. · 6—HMAC_MD5 algorithm. · 7—HMAC-MMD5 algorithm. · 8—HMAC_SHA1 algorithm. · 9—HMAC-MSHA1 algorithm. $16: Reason for discarding a BFD packet: · Received a simple authentication packet with mismatching authentication type. Discard packet. · Received a simple authentication packet with mismatching length. Discard packet. · Received a simple authentication packet wih mismatching key ID. Discard packet. · Received a simple authentication packet with incorrect password. Discard packet. · Received an MD5 authentication packet with mismatching authentication type. Discard packet. · Received an MD5 authentication packet with mismatching length. Discard packet. · Received an MD5 authentication packet with mismatching key ID. Discard packet. · Received an MD5 authentication packet with mismatching sequence number. Discard packet. · Received an MD5 authentication packet with mismatching digest or calculation failure. Discard packet. · Received a SHA1 authentication packet with mismatching hash value or calculation failure. Discard packet. · Received a SHA1 authentication packet with mismatching authentication type. Discard packet. · Received a SHA1 authentication packet with mismatching length. Discard packet. · Received a SHA1 authentication packet with mismatching key ID. Discard packet. · Received a SHA1 authentication packet with mismatching sequence number. Discard packet. · Received a packet with none authentication mode. Discard packet. |
|
Severity level |
5 |
|
Example |
BFD/5/BFD_PKT_AUTH_ERR: Sess [17.1.1.2/17.1.1.1, LD/RD: 1537/1537, Interface: GE1/0/1, SessType: Ctrl, LinkType: INET], Ver: 1, Sta: 3, Diag: 0, P: 1, F: 0, C: 1, A: 1, D: 0, M: 0 , DetectMult: 5, Length: 48, UDP Port: 3784, TTL: 255, PktAuthType: 2, SessAuthType: 0, Reason: Received an MD5 authentication packet with mismatching authentication type. Discard packet. |
|
Explanation |
This informational message appears when the BFD session receives an invalid authentication packet. |
|
Recommended action |
Check the BFD session authentication configuration. |
BFD_REACHED_UPPER_LIMIT
|
Message text |
The total number of BFD sessions [ULONG] reached the upper limit. Can’t create a new session. |
|
Variable fields |
$1: Total number of BFD sessions. |
|
Severity level |
3 |
|
Example |
BFD/3/BFD_REACHED_UPPER_LIMIT: The total number of BFD session 100 reached upper limit. |
|
Explanation |
The total number of BFD sessions has reached the upper limit. |
|
Recommended action |
Check the BFD session configuration. |
BFD_RX_ZERO
|
Message text |
Received a message with a Required Min RX Interval of 0 during BFD session negotiation. Local discriminitor: [UINT32], Remote discriminitor: [UINT32] |
|
Variable fields |
$1: Local discriminator of the BFD session. $2: Remote discriminator of the BFD session. |
|
Severity level |
5 |
|
Example |
BFD/5/BFD_RX_ZERO: Received a message with a Required Min RX Interval of 0 during BFD session negotiation. Local discriminitor: 100, Remote discriminitor: 100 |
|
Explanation |
The device received a message with a Required Min RX Interval of 0 during BFD session negotiation, and then stopped the BFD session negotiation. |
|
Recommended action |
No action is required. |
BGP messages
This section contains BGP messages.
BGP_ASPATH_OVR_LMT
|
Message text |
The AS count in the AS_PATH attribute exceeded the limit. (Peer=[STRING], Source interface=[STRING], limit=[STRING], VPN instance=[STRING], address family=[STRING], operation=[STRING], Instance=[STRING]) |
|
Variable fields |
$1: IP address of the BGP peer. $2: Source interface used for TCP connection. $3: Maximum number of ASs in the AS_PATH attribute. $4: VPN instance name. This field is blank for the public network. $5: Address family to which the BGP route belongs: · IPv4-unicast: IPv4 unicast address family. · IPv4-multicast: IPv4 multicast address family. · VPNv4: VPNv4 address family. · IPv6-unicast: IPv6 unicast address family. · VPNv6: VPNv6 address family. · IPv4-flowspec: IPv4 flowspec address family. $6: Action taken by the local device when the AS count in the AS_PATH attribute of an advertised or received BGP route exceeds the limit: · The route will be withdrawn: The local device will send UPDATE messages to withdraw the advertised route. · The route will be retained: The route is a local summary route. The AS count limit does not take effect on that route. · The route will be discarded: The local device will discard the received route. $7: BGP instance name. |
|
Severity level |
4 |
|
Example |
BGP/4/BGP_ASPATH_OVR_LMT: The AS count in the AS_PATH attribute exceeded the limit. (Peer=1.1.1.1, source interface=GE1/0/1, limit=50, VPN instance=vpn1, address family=IPv4-unicast, operation=It will aggregate without as-set, Instance=default) |
|
Explanation |
The AS count in the AS_PATH attribute of a received route exceeded the limit. |
|
Recommended action |
Determine whether the local device needs the received route: · If not, no action is required. · If yes, contact the network administrator of the BGP peer that sent the route. To resolve this issue, the network administrator can perform one of the following tasks: ¡ Reduce the number of ASs included in advertised routes by configuring a BGP route distribution policy. ¡ Set a larger AS number quantity threshold by using the as-path-limit command. |
BGP_AUTH_FAILED
|
Message text |
BGP session authentication failed. (Peer=[STRING], TcpConnSocket=[STRING], Instance=[STRING]) |
|
Variable fields |
$1: IP address of the BGP peer. $2: Socket number of the TCP connection. $3: BGP instance name. |
|
Severity level |
4 |
|
Example |
BGP/4/BGP_AUTH_FAILED: BGP session authentication failed. (Peer=192.99.0.2, TcpConnSocket=10, Instance=default) |
|
Explanation |
BGP session authentication failed. |
|
Recommended action |
Collect the log and the configuration of the local device, and then contact H3C Support. |
BGP_BMP_STATE_CHANGED
|
Message text |
· Pattern 1: BGP [STRING]: Connected to BMP server [STRING]. · Pattern 2: BGP [STRING]: Disconnected from BMP Server [STRING] for [STRING]. |
|
Variable fields |
In pattern 1: $1: BGP instance name. $2: BMP server number. In pattern 2: $1: BGP instance name. $2: BMP server number. $3: Reason why the TCP connection between the device and the BMP server is terminated: · manual reset—The connection is manually reset. · TCP connect error—TCP connection error. · configuration changed—The local device modifies the settings related with the connection. · BMP server deleted—The BMP server is deleted. · HA stop event received—A stop event is received from the HA module. · bgp instance deleted—The BGP instance is deleted. · maximum limit of sending buffer reached—The number of messages sent to the BMP server has exceeded the buffer limit. |
|
Severity level |
3 |
|
Example |
BGP/3/BGP_BMP_STATE_CHANGED: BGP default: Connected to BMP server 2. |
|
Explanation |
The TCP connection from the BMP client to the BMP server was successfully established or was terminated. |
|
Recommended action |
If the TCP connection to the BMP server is accidentally terminated, contact the network administrator to identify whether the BMP server is faulty or whether the following settings related with TCP connection establishment are correct on the local device: · IP address and port number of the BMP server. · VPN instance to which the BMP server belongs. · Source interface for the TCP connection between the local device and the BMP server. · Source address for the TCP connection between the local device and the BMP server. · Security authentication mode used when the local device establishes the TCP connection to the BMP server. |
BGP_ERR_PEER_AS
|
Message text |
The AS number carried in the OPEN message from the peer was different from that configured for the peer. (VPN instance=[STRING], peer=[STRING], source interface=[STRING], expected AS=[STRING], received AS=[STRING], Instance=[STRING]) |
|
Variable fields |
$1: VPN instance name. This field is blank for the public network. $2: IP address of the BGP peer. $3: Source interface used for TCP connection. $4: AS number configured for the BGP peer. $5: AS number in the OPEN message received from the BGP peer. $6: BGP instance name. |
|
Severity level |
6 |
|
Example |
BGP/6/BGP_ERR_PEER_AS: The AS number carried in the OPEN message from the peer was different from that configured for the peer. (VPN instance=vpn1, peer=192.99.0.2, source interface=G1/0/1, expected AS=100, received AS=100, Instance=default) |
|
Explanation |
The AS number carried in the OPEN message from a BGP peer was different from that configured for the BGP peer. |
|
Recommended action |
Re-configure the AS number of the BGP peer on the local device. |
BGP_EXCEED_ROA_LIMIT
|
Message text |
BGP [STRING].[STRING]: The number of ROAs ([UINT32]) from server [STRING] exceeds the limit [UINT32]. |
|
Variable fields |
$1: BGP instance name. $2: VPN instance name. This field is blank for the public network. $3: Number of ROAs received from the RPKI server. $4: IP address of the RPKI server. $5: Maximum number of ROAs that can be received from the RPKI server. |
|
Severity level |
4 |
|
Example |
BGP/4/BGP_EXCEED_ROA_LIMIT: BGP default.vpn1: The number of ROAs (101) from server 192.168.56.10 exceeds the limit 100. |
|
Explanation |
The number of ROAs received from the RPKI server exceeded the limit. |
|
Recommended action |
Determine whether the received ROAs can satisfy the current service demands: · If yes, contact the RPKI server maintainer to cancel advertising unnecessary ROAs. · If not, increase the maximum number of ROAs that can be received from the RPKI server. |
BGP_EXCEED_ROA_LIMIT_CLEAR
|
Message text |
BGP [STRING].[STRING]: The number of ROAs ([UINT32]) from server [STRING] fell below the limit [UINT32]. |
|
Variable fields |
$1: BGP instance name. $2: VPN instance name. This field is blank for the public network. $3: Number of ROAs received from the RPKI server. $4: IP address of the RPKI server. $5: Maximum number of ROAs that can be received from the RPKI server. |
|
Severity level |
6 |
|
Example |
BGP/6/BGP_EXCEED_ROA_LIMIT_CLEAR: BGP default.vpn1: The number of ROAs (99) from server 192.168.56.10 fell below the limit 100. |
|
Explanation |
The number of ROAs received from the RPKI server dropped below the limit. |
|
Recommended action |
No action is required. |
BGP_EXCEED_ROUTE_LIMIT
|
Message text |
BGP [STRING].[STRING]: The number of routes ([UINT32]) from peer [STRING] ([STRING]) exceeds the limit [UINT32]. |
|
Variable fields |
$1: BGP instance name. $2: VPN instance name. This field is blank for the public network. $3: Number of received route prefixes. $4: IP address of the BGP peer. $5: Address family of the BGP peer. $6: Maximum number of routes that can be received from the peer. |
|
Severity level |
4 |
|
Example |
BGP/4/BGP_EXCEED_ROUTE_LIMIT: BGP default.vpn1: The number of routes (101) from peer 1.1.1.1 (IPv4-UNC) exceeds the limit 100. |
|
Explanation |
The number of routes received from a peer exceeded the limit. |
|
Recommended action |
Determine whether it is caused by attacks: · If yes, configure the device to defend against the attacks. · If not, increase the maximum number of routes. |
BGP_EXCEED_ROUTE_LIMIT_CLEAR
|
Message text |
BGP [STRING].[STRING]: The number of routes ([UINT32]) from peer [STRING] ([STRING]) fell below the limit [UINT32]. |
|
Variable fields |
$1: BGP instance name. $2: VPN instance name. This field is blank for the public network. $3: Number of received route prefixes. $4: IP address of the BGP peer. $5: Address family of the BGP peer. $6: Maximum number of routes that can be received from the peer. |
|
Severity level |
6 |
|
Example |
BGP/6/BGP_EXCEED_ROUTE_LIMIT_CLEAR: BGP default.vpn1: The number of routes (99) from peer 1.1.1.1 (IPv4-UNC) fell below the limit 100. |
|
Explanation |
The number of routes received from a peer dropped below the limit. |
|
Recommended action |
No action is required. |
BGP_GR_DUPLICT_OPEN_RCV
|
Message text |
Duplicate OPEN message was received from the peer, and this peer was detected GR-capable. (Peer=[STRING], VPN instance=[STRING], Instance=[STRING]) |
|
Variable fields |
$1: IP address of the BGP peer. $2: VPN instance name. This field is blank for the public network. $3: BGP instance name. |
|
Severity level |
6 |
|
Example |
BGP/6/BGP_GR_DUPLICT_OPEN_RCV: Duplicate OPEN message was received from the peer, and this peer was detected GR-capable. (Peer=192.99.0.2, VPN instance=vpn1, Instance=default) |
|
Explanation |
A BGP peer repeatedly sent an OPEN message to the local device and the peer was detected GR-capable. |
|
Recommended action |
No action is required. |
BGP_GR_NO_R_IN_OPEN
|
Message text |
The BGP session was re-established, because the GR-capable peer received an OPEN message without the R flag set. (VPN instance=[STRING], peer=[STRING], source interface=[STRING], Instance=[STRING]) |
|
Variable fields |
$1: IP address of the BGP peer. $2: VPN instance name. This field is blank for the public network. $3: Source interface used for TCP connection. $4: BGP instance name. |
|
Severity level |
6 |
|
Example |
BGP/6/BGP_GR_NO_R_IN_OPEN: The BGP session was re-established, because the GR-capable peer received an OPEN message without the R flag set. (VPN instance=vpn1, peer=192.99.0.2, source interface=G1/0/1, Instance=default) |
|
Explanation |
The BGP session was re-established between the local device and a GR-capable BGP peer, because the peer received an OPEN message without the R flag set. |
|
Recommended action |
No action is required. |
BGP_GR_PEER_START
|
Message text |
The peer is performing GR. (Peer=[STRING], source interface=[STRING], Instance=[STRING]) |
|
Variable fields |
$1: IP address of the BGP peer. $2: Source interface used for TCP connection. $3: BGP instance name. |
|
Severity level |
6 |
|
Example |
BGP/6/BGP_GR_PEER_START: The peer is performing GR. (Peer=192.99.0.2, source interface= G1/0/1, Instance=default) |
|
Explanation |
The BGP peer is performing GR. |
|
Recommended action |
No action is required. |
BGP_GR_RST_TMR_EXPIRE
|
Message text |
The GR timer expired. (Peer=[STRING], source interface=[STRING], VPN instance=[STRING], Instance=[STRING]) |
|
Variable fields |
$1: IP address of the BGP peer. $2: Source interface used for TCP connection. $3: VPN instance name. This field is blank for the public network. $4: BGP instance name. |
|
Severity level |
6 |
|
Example |
BGP/6/BGP_GR_RST_TMR_EXPIRE: The GR timer expired. (Peer=192.99.0.2, source interface=GE1/0/1, VPN instance=vpn1, Instance=default) |
|
Explanation |
The GR timer configured for the local device expired. |
|
Recommended action |
No action is required. |
BGP_LOG_ROUTE_FLAP
|
Message text |
BGP [STRING].[STRING]: The route [STRING] [STRING]/[UINT32] learned from peer [STRING] ([STRING]) flapped. |
|
Variable fields |
$1: BGP instance name. $2: VPN instance name. This field is blank for the public network. $3: RD of the BGP route. This field is blank for a route without an RD. $4: BGP route prefix. $5: Mask of the BGP route prefix. $6: IP address of the BGP peer. $7: Address family of the BGP peer. |
|
Severity level |
4 |
|
Example |
BGP/4/BGP_LOG_ROUTE_FLAP: BGP default.vpn1: The route 15.1.1.1/24 learned from peer 1.1.1.1 (IPv4-UNC) flapped. |
|
Explanation |
The route learned from a BGP peer flapped. |
|
Recommended action |
If a large number of routes flap, determine the route flapping cause and develop a solution. |
BGP_LABEL_CONFLICT
|
Message text |
BGP egress-engineering incoming label [STRING] conflicts with current configuration. |
|
Variable fields |
$1: SID value. |
|
Severity level |
4 |
|
Example |
BGP/4/BGP_LABEL_CONFLICT: BGP egress-engineering incoming label 3000 conflicts with current configuration. |
|
Explanation |
The SID value assigned by BGP Egress Peer Engineering (EPE) has been used. |
|
Recommended action |
Verify that the SID value specified in the routing policy used by BGP EPE has not been used. |
BGP_LABEL_OUTOFRANGE
|
Message text |
BGP egress-engineering incoming label [STRING] is out of range. |
|
Variable fields |
$1: SID value. |
|
Severity level |
4 |
|
Example |
BGP/4/BGP_LABEL_OUTOFRANGE: BGP egress-engineering incoming label 1024 is out of range. |
|
Explanation |
The SID value assigned by BGP EPE is out of range. |
|
Recommended action |
Verify that the SID value specified in the routing policy used by BGP EPE is valid. |
BGP_MEM_ALERT
|
Message text |
BGP [STRING] instance received system memory alert [STRING] event. |
|
Variable fields |
$1: BGP instance name. $2: Type of the memory alarm, stop and start. |
|
Severity level |
5 |
|
Example |
BGP/5/BGP_MEM_ALERT: BGP default instance received system memory alert start event. |
|
Explanation |
BGP received a memory alarm. |
|
Recommended action |
If BGP received a system memory alert start event, check the system memory and try to free some memory by adjusting modules that occupied too much memory. |
BGP_PEER_LICENSE_REACHED
|
Message text |
BGP [STRING]: Number of peers in Established state reached the license limit. |
|
Variable fields |
$1: BGP instance name. |
|
Severity level |
3 |
|
Example |
BGP/3/BGP_PEER_LICENSE_REACHED: BGP default: Number of peers in Established state reached the license limit. |
|
Explanation |
The number of peers in Established state reached the license limit. |
|
Recommended action |
Determine whether a new license is required. |
BGP_PEER_RT_EX_ACTIVE
|
Message text |
The number of routes received from the BGP peer exceeded the max number of routes that can be received from the peer. (Instance=[STRING], Afi=[STRING], Safi=[STRING], PeerAddrType=[STRING], PeerAddr=[STRING], MaxRouteNum=[STRING]) |
|
Variable fields |
$1: BGP instance name. $2: Address family identifier. $3: Subsequent address family identifier. $4: IP address type of the BGP peer. $5: IP address of the BGP peer. $6: Maximum number of routes that can be received from the BGP peer. |
|
Severity level |
4 |
|
Example |
BGP/4/BGP_PEER_RT_EX_ACTIVE: The number of routes received from the BGP peer exceeded the max number of routes that can be received from the peer. (Instance=default, AFI=1, SAFI=1, PeerAddrType=IPv4-UNC, PeerAddr=1.1.1.1, MaxRouteNumber=50) |
|
Explanation |
The number of routes received from a BGP peer exceeded the maximum number of routes that can be received from the peer. |
|
Recommended action |
Determine whether the received routes can satisfy the current service demands: · If yes, check the route distribution policy of the BGP peer and make sure the policy can filter out unnecessary routes. · If not, increase the maximum number of routes that can be received from the BGP peer. |
BGP_PEER_RT_EX_CLEAR
|
Message text |
The number of routes received from the BGP peer decreased below the max number of routes that can be received from the peer. (Instance=[STRING], AFI=[STRING], SAFI=[STRING], PeerAddrType=[STRING], PeerAddr=[STRING], MaxRouteNum=[STRING]) |
|
Variable fields |
$1: BGP instance name. $2: Address family identifier. $3: Subsequent address family identifier. $4: IP address type of the BGP peer. $5: IP address of the BGP peer. $6: Maximum number of routes that can be received from the BGP peer. |
|
Severity level |
4 |
|
Example |
BGP/4/BGP_PEER_RT_EX_CLEAR: The number of routes received from the BGP peer decreased below the max number of routes that can be received from the peer. (Instance=default, AFI=1, SAFI=1, PeerAddrType=IPv4-UNC, PeerAddr=1.1.1.1, MaxRouteNumber=50) |
|
Explanation |
The number of routes received from a BGP peer decreased below the maximum number of routes that can be received from the peer. |
|
Recommended action |
BGP_PEER_RT_NUM_THR_EX_ACTIVE
|
Message text |
The number of routes received from the BGP peer exceeded the alarm threshold. (Instance=[STRING], AFI=[STRING], SAFI=[STRING], PeerAddrType=[STRING], PeerAddr=[STRING], MaxRouteNumber=[STRING], alarm threshold=[STRING]) |
|
Variable fields |
$1: BGP instance name. $2: Address family identifier. $3: Subsequent address family identifier. $4: IP address type of the BGP peer. $5: IP address of the BGP peer. $6: Maximum number of routes that can be received from the BGP peer. $7: Alarm threshold specified for the BGP peer on the local device. The local device generates an alarm message when the ratio of received routes to maximum routes that can be received reaches the alarm threshold. |
|
Severity level |
4 |
|
Example |
BGP/4/BGP_PEER_RT_NUM_THR_EX_ACTIVE: The number of routes received from the BGP peer exceeded the alarm threshold. (Instance=default, AFI=1, SAFI=1, PeerAddrType=IPv4-UNC, PeerAddr=1.1.1.1, MaxRouteNumber=50, alarm threshold=50) |
|
Explanation |
The number of routes received from a BGP peer exceeded the alarm threshold. |
|
Recommended action |
Determine whether the received routes can satisfy the current service demands: · If yes, check the route distribution policy of the BGP peer and make sure the policy can filter out unnecessary routes. · If not, set a higher alarm threshold or increase the maximum number of routes that can be received from the BGP peer. |
BGP_PEER_RT_NUM_THR_EX_CLEAR
|
Message text |
The number of routes received from the BGP peer decreased below the alarm threshold. (Instance=[STRING], AFI=[STRING], SAFI=[STRING], PeerAddrType=[STRING], PeerAddr=[STRING], MaxRouteNumber=[STRING], alarm threshold=[STRING]) |
|
Variable fields |
$1: BGP instance name. $2: Address family identifier. $3: Subsequent address family identifier. $4: IP address type of the BGP peer. $5: IP address of the BGP peer. $6: Maximum number of routes that can be received from the BGP peer. $7: Alarm threshold specified for the BGP peer on the local device. The local device generates an alarm message when the ratio of received routes to maximum routes that can be received reaches the alarm threshold. |
|
Severity level |
4 |
|
Example |
BGP/4/BGP_PEER_RT_NUM_THR_EX_CLEAR: The number of routes received from the BGP peer decreased below the alarm threshold. (Instance=default, AFI=1, SAFI=1, PeerAddrType=IPv4-UNC, PeerAddr=1.1.1.1, MaxRouteNumber=50, alarm threshold=50) |
|
Explanation |
The number of routes received from a BGP peer decreased below the alarm threshold. |
|
Recommended action |
BGP_PEER_STATE_CHG
|
Message text |
Peer state changed after BGP received an event. (PrevState=[STRING], CurrState=[STRING], input event=[STRING], peer=[STRING], source interface=[STRING], VPN instance=[STRING], Instance=[STRING]) |
|
Variable fields |
$1: Original state of the peer session: · IDLE: Initial BGP session state. In this state, BGP refuses all connection requests. · CONNECT: In this state, BGP is establishing TCP connection to the peer. · ACTIVE: Intermediate state of BGP session establishment. In this state, BGP is trying to establish TCP connection to the peer. · OPENSENT: In this state, BGP is waiting for an OPEN message from the peer. · OPENCONFIRM: In this state, BGP is waiting for a KEEPALIVE or NOTIFICATION message from the peer. · ESTABLISHED: BGP has successfully established a session to the peer. Only in this state can BGP exchange UPDATE messages with the peer. $2: Current state of the peer session: · IDLE: Initial BGP session state. In this state, BGP refuses all connection requests. · CONNECT: In this state, BGP is establishing TCP connection to the peer. · ACTIVE: Intermediate state of BGP session establishment. In this state, BGP is trying to establish TCP connection to the peer. · OPENSENT: In this state, BGP is waiting for an OPEN message from the peer. · OPENCONFIRM: In this state, BGP is waiting for a KEEPALIVE or NOTIFICATION message from the peer. · ESTABLISHED: BGP has successfully established a session to the peer. Only in this state can BGP exchange UPDATE messages with the peer. $3: Event that caused the peer session state change: · START: BGP started establishing TCP connection to the peer. · STOP: BGP stopped establishing TCP connection to the peer. · IH_TIMER: The IdleHoldTimer expired. · CR_TIMER: The ConnectRetryTimer expired. · OD_TIMER: The DelayOpenTimer expired. · HOLD_TIMER: The HoldTimer expired. · KA_TIMER: The KeepaliveTimer expired. · TCP_SUCCEED: BGP successfully established TCP connection to the peer. · TCP_FAIL: BGP failed to establish TCP connection to the peer. · TCP_INCOMING: BGP received a TCP connection request from the peer. · RECV_OPEN: BGP received an OPEN message from the peer. · RECV_KA: BGP received a KEEPALIVE message from the peer. · RECV_UPDATE: BGP received an UPDATE message from the peer. · RECV_RR: BGP received a Route-Refresh message from the peer. · RECV_NOTIF: BGP received a NOTIFICATION message from the peer. · RECV_NOTIF_VER: BGP received a BGP-version error notification from the peer. · RECV_HEAD_ERR: BGP received an incorrect BGP packet header from the peer. · RECV_OPEN_ERR: BGP received an incorrect OPEN message from the peer. · RECV_UPDATE_ERR: BGP received an incorrect UPDATE message from the peer. · RECV_RR_ERR: BGP received an incorrect Route-Refresh message from the peer. · LINK_UNREACHABLE_DETECTED: The peer was detected unreachable. $4: IP address of the BGP peer. $5: Source interface used for TCP connection. $6: VPN instance name. This field is blank for the public network. $7: BGP instance name. |
|
Severity level |
6 |
|
Example |
BGP/6/BGP_PEER_STATE_CHG: Peer state changed after BGP received an event. (PrevState=OPENCONFIRM, CurrState=ESTABLISHED, input event=RECV_KA, peer=192.99.0.2, source interface= GE1/0/1, VPN instance=vpn1, Instance=default) |
|
Explanation |
BGP changed the state of a peer session after receiving a related event. |
|
Recommended action |
No action is required. |
BGP_REACHED_THRESHOLD
|
Message text |
BGP [STRING].[STRING]: The ratio of the number of routes ([UINT32]) received from peer [STRING] ([STRING]) to the number of allowed routes ([UINT32]) has reached the threshold ([UINT32]%). |
|
Variable fields |
$1: BGP instance name. $2: VPN instance name. This field is blank for the public network. $3: Number of routes received from the BGP peer. $4: IP address of the BGP peer. $5: Address family of the BGP peer. $6: Maximum number of routes that can be received from the peer. $7: Threshold on the ratio of the number of received routes to the limit. |
|
Severity level |
4 |
|
Example |
BGP/4/BGP_REACHED_THRESHOLD: BGP default.vpn1: The ratio of the number of routes (3) received from peer 1.1.1.1 (IPv4-UNC) to the number of allowed routes (2) has reached the threshold (75%). |
|
Explanation |
The ratio of the number of received routes to the limit reached the threshold. |
|
Recommended action |
Determine whether it is caused by attacks: · If yes, configure the device to defend against the attacks. · If not, increase the threshold value or the maximum number of routes that can be received from the peer. |
BGP_REACHED_THRESHOLD_CLEAR
|
Message text |
BGP [STRING].[STRING]: The ratio of the number of routes ([UINT32]) received from peer [STRING] ([STRING]) to the number of allowed routes ([UINT32]) has fallen below the threshold ([UINT32]%). |
|
Variable fields |
$1: BGP instance name. $2: VPN instance name. This field is blank for the public network. $3: Number of routes received from the BGP peer. $4: IP address of the BGP peer. $5: Address family of the BGP peer. $6: Maximum number of routes that can be received from the peer. $7: Threshold on the ratio of the number of received routes to the limit. |
|
Severity level |
6 |
|
Example |
BGP/6/BGP_REACHED_THRESHOLD_CLEAR: BGP default.vpn1: The ratio of the number of routes (3) received from peer 1.1.1.1 (IPv4-UNC) to the number of allowed routes (5) has fallen below the threshold (75%). |
|
Explanation |
The ratio of the number of received routes to the limit dropped below the threshold. |
|
Recommended action |
BGP_ROUTE_LICENSE_REACHED
|
Message text |
BGP [STRING]: Number of [STRING] routes reached the license limit. |
|
Variable fields |
$1: BGP instance name. $2: BGP address family: · IPv4-UNC public—IPv4 unicast routes for the public network. · IPv6-UNC public—IPv6 unicast routes for the public network. · IPv4 private—IPv4 unicast routes, VPNv4 routes, and nested VPN routes for the private network. · IPv6 private—IPv6 unicast routes and VPNv6 routes for the private network. |
|
Severity level |
3 |
|
Example |
BGP/3/BGP_ROUTE_LICENSE_REACHED: BGP default: Number of IPv4-UNC public routes reached the license limit. |
|
Explanation |
The number of routes in the specified address family reached the license limit. |
|
Recommended action |
Determine whether a new license is required. After the number of routes in the specified family falls below the license limit or the license limit increases, you must manually restore the discarded routes. |
BGP_RTID_CHG
|
Message text |
The router ID of the BGP instance is changed. For the new router ID to take effect, manually reset the BGP session. (Router ID=[STRING], instance=[STRING], VPN instance=[STRING]) |
|
Variable fields |
$2: BGP instance name. $3: VPN instance name. This field is blank for the public network. |
|
Severity level |
6 |
|
Example |
BGP/6/BGP_RTID_CHG: The Router ID of the BGP instance is changed. For the new router ID to take effect, manually reset the BGP session. (Router ID=2.2.2.2, instance=default, VPN instance=vpn1) |
|
Explanation |
The router ID of a BGP instance is changed. For the new router ID to take effect, manually reset the BGP sessions of that instance. |
|
Recommended action |
Use the reset bgp command in user view to reset the BGP sessions of the instance. |
BGP_STATE_CHANGED
|
Message text |
· Pattern 1: BGP [STRING].[STRING]: [STRING] state has changed from [STRING] to [STRING]. · Pattern 2: BGP [STRING].[STRING]: [STRING] state has changed from [STRING] to [STRING] for [STRING]. |
|
Variable fields |
In pattern 1: $2: VPN instance name. This field is blank for the public network. $3: IP address of the BGP peer. $4: Name of FSM before the state change. $5: Name of FSM after the state change. In pattern 2: $1: BGP instance name. $2: VPN instance name. This field is blank for the public network. $3: IP address of the BGP peer. $4: Name of FSM before the state change. $5: Name of FSM after the state change. $6: Reason for the state change and the corresponding error code. |
|
Severity level |
3 |
|
Example |
BGP/3/BGP_STATE_CHANGED: BGP default.vpn1:192.99.0.2 state has changed from OPENCONFIRM to ESTABLISHED. |
|
Explanation |
The FSM of a BGP peer has changed. This informational message appears when a BGP peer comes up or goes down. |
|
Recommended action |
If a peer goes down unexpectedly, determine whether an error or packet loss occurs. |
BIER messages
This section contains BIER messages.
BIER_BFRID_CONFLICT_ACTIVE
|
Message text |
A BFR ID conflict exists. Address family=[STRING], Sub-domain=[INT32], BFR ID=[INT32], BFR prefixes=[STRING]. |
|
Variable fields |
$1: Address family, which can only be IPv6. $2: BIER sub-domain ID. $3: Conflicting BFR ID. $4: BFR prefixes where the conflict exists. |
|
Severity level |
5 |
|
Example |
BIER/5/BIER_BFRID_CONFLICT_ACTIVE: -MDC=1; A BFR ID conflict exists. Address family=IPv6, Sub-domain=1, BFR ID=4, BFR prefixes=B::1,C::1. |
|
Explanation |
This message is generated when BFR IDs of different devices in a sub-domain are the same. |
|
Recommended action |
1. Identify the conflicting BFR edge devices through the BFR prefixes. 2. Modify the BFR ID for one of the two edge devices. |
BIER_BFRID_CONFLICT_CLEAR
|
Message text |
The BFR ID conflict was removed. Address family=[STRING], Sub-domain=[INT32], BFR ID=[INT32], BFR prefix=[STRING]. |
|
Variable fields |
$1: Address family, which can only be IPv6. $2: BIER sub-domain ID. $3: BFR ID. $4: BFR prefixes where the conflict was removed. |
|
Severity level |
5 |
|
Example |
BIERRIB/5/BIER_BFRID_CONFLICT_CLEAR: -MDC=1; The BFR ID conflict was removed. Address family=IPv6, Sub-domain=1, BFR ID=4, BFR prefix=B::1. |
|
Explanation |
This message is generated when a BFR ID conflict is removed. |
|
Recommended action |
1. No action is required. |
BRIPRO messages
This section contains BRIPRO messages.
CFD_CFG_NOTSPT
|
Message text |
Interface [INT32].does not support CFD. Please check your configuration. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
6 (Informational) |
|
Example |
BRIPRO/6/CFD_CFG_NOTSPT: -Slot=3; Interface XGE3/0/1 does not support CFD. Please check your configuration. |
|
Impact |
No impact on the system. |
|
Cause |
The interface does not support CFD. |
|
Recommended action |
Do not configure CFD on the interface. |
LAGG_SHARE_NOT_SPT
|
Message text |
Link aggregation load sharing not supported. |
|
Variable fields |
N/A |
|
Severity level |
6 (Informational) |
|
Example |
BRIPRO/6/LAGG_SHARE_NOT_SPT: -MDC=1-Slot=2; Link aggregation load sharing not supported. |
|
Impact |
An aggregation group containing ports on certain card models does not support global load sharing mode configuration. Aggregation groups containing ports on other cards are not affected. |
|
Cause |
An aggregation group does not support the set global load sharing modes if its member ports are on certain cards. |
|
Recommended action |
· Adjust the global load sharing mode for link aggregation based on services. · If the issue persists, collect the configuration file, log messages, and alarm information, and then contact Technical Support. |
PVST_NOT_SUPPORT
|
Message text |
PVST is not supported on this board. |
|
Variable fields |
N/A |
|
Severity level |
6 (Informational) |
|
Example |
BRIPRO/6/PVST_NOT_SUPPORT: -MDC=1-Slot=5; PVST is not supported on this board. |
|
Impact |
The card does not support PVST. |
|
Cause |
PVST was enabled on a card that does not support this feature. |
|
Recommended action |
· Do not configure PVST on the cards that do not support this feature. · If the issue persists, collect the configuration file, log messages, and alarm information, and then contact Technical Support. |
VLAN_TPID_CFGERR
|
Message text |
Operation failed because TPID value [INT32] was configured on [STRING]. Restore TPID value to default on this interface and try again. |
|
Variable fields |
$1: TPID value in the SVLAN tag. $2: Interface name. |
|
Severity level |
2 (Critical) |
|
Example |
BRIPRO/2/VLAN_TPID_CFGERR: -MDC=1-Slot=4; Operation failed because TPID value 2000 was configured on Bridge-Aggregation200. Restore TPID value to default on this interface and try again. |
|
Impact |
The TPID cannot be set for SVLANs on an interface. |
|
Cause |
, only one interface can be configured with a TPID value in the SVLAN tag other than the default TPID value. Restore the TPID value in the SVLAN tag to the default for the interface prompted in the message before you modify the TPID value on the target interface. |
|
Recommended action |
1. To configure the TPID for an SVLAN: ¡ Use the undo qinq ethernet-type service-tag command to restore the default TPID for the SVLAN tag. Then, use the qinq ethernet-type service-tag hex-value command to set the TPID for the SVLAN tag. ¡ Use the undo dot1q ethernet-type command to restore the TPID of the SVLAN tag to 0x8100 for incoming and outgoing packets, Then, use the dot1q ethernet-type command to set the TPID of the SVLAN tag for the incoming and outgoing packets. 2. If the issue persists, collect the configuration file, log messages, and alarm information, and then contact Technical Support. |
CFD messages
This section contains CFD messages.
HRD_TIMER_NORES
|
Message text |
No hardware resource for CFD detecting. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
CFD/4/HRD_TIMER_NORES: -MDC=1-Slot=5; No hardware resource for CFD detecting. |
|
Impact |
The CFD feature is not available. |
|
Cause |
The CFD feature is not available because of insufficient hardware timer resources. |
|
Recommended action |
1. Use the display bfd working-mode command to view the resource usage. 2. Cancel the CFD configuration related to unnecessary Layer 2 VPN services, and then reconfigure CFD. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
HRD_MEPNODE_NORES
|
Message text |
No hardware resource for ServiceInstance (INT32) MEP (INT32) RMEP (INT32). |
|
Variable fields |
$1: Service instance ID. $2: Local MEP ID. $3: Remote MEP ID. |
|
Severity level |
4 (Warning) |
|
Example |
CFD/4/HRD_MEPNODE_NORES: -MDC=1-Slot=5; No hardware resource for ServiceInstance(1) MEP(2) RMEP(3). |
|
Impact |
The CFD feature is not available. |
|
Cause |
The CFD feature is not available because of insufficient hardware memory space. |
|
Recommended action |
1. Use the display resource-monitor command to view the resource usage of hard_bfd_counter_resource. 2. Cancel the CFD configuration related to unnecessary Layer 2 VPN services, and then reconfigure CFD. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
COUNTERID_NORES
|
Message text |
No hardware resource for ServiceInstance (INT32) MEP (INT32). |
|
Variable fields |
$1: Service instance ID. $2: Local MEP ID. |
|
Severity level |
4 (Warning) |
|
Example |
CFD/4/COUNTERID_NORES: -MDC=1-Slot=5; No hardware resource for ServiceInstance(1) MEP(2). |
|
Impact |
The CFD feature is not available. |
|
Cause |
The CFD feature is not available because of insufficient hardware counter resources. |
|
Recommended action |
1. Use the display resource-monitor command to view the resource usage of hard_bfd_counter_resource. 2. Cancel the CFD configuration related to unnecessary Layer 2 VPN services, and then reconfigure CFD. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
WATCHDOG_NORES
|
Message text |
No hardware resource for ServiceInstance (INT32) MEP (INT32) RMEP (INT32). |
|
Variable fields |
$1: Service instance ID. $2: Local MEP ID. $3: Remote MEP ID. |
|
Severity level |
4 (Warning) |
|
Example |
CFD/4/WATCHDOG_ADDR_NORES: -MDC=1-Slot=5; No hardware resource for ServiceInstance(1) MEP(2) RMEP(3). |
|
Impact |
The CFD feature is not available. |
|
Cause |
The CFD feature is not available because of insufficient hardware memory resources. |
|
Recommended action |
1. Use the display resource-monitor command to view the resource usage of cfd_watchdog_index. 2. Cancel the CFD configuration related to unnecessary Layer 2 VPN services, and then reconfigure CFD. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
CFD messages
This section contains CFD messages.
CFD_CROSS_CCM
|
Message text |
MEP [UINT16] in SI [INT32] received a cross-connect CCM. It’s SrcMAC is [MAC], SeqNum is [INT32], RMEP is [UINT16], MD ID is [STRING], MA ID is [STRING]. |
|
Variable fields |
$1: Service instance ID. $2: Local MEP ID. $3: Source MAC address. $4: Sequence number. $5: Remote MEP ID. $6: MD ID. If no MD ID is available, "without ID" is displayed. $7: MA ID. |
|
Severity level |
6 |
|
Example |
CFD/6/CFD_CROSS_CCM: MEP 13 in SI 10 received a cross-connect CCM. Its SrcMAC is 0011-2233-4401, SeqNum is 78, RMEP is 12, MD ID is without ID, MA ID is 0. |
|
Explanation |
A MEP received a cross-connect CCM containing a different MA ID or MD ID. |
|
Recommended action |
Check the configurations of MEPs on both ends. Make sure the MEPs have consistent configurations, including MD, MA, and level. |
CFD_ERROR_CCM
|
Message text |
MEP [UINT16] in SI [INT32] received an error CCM. It’s SrcMAC is [MAC], SeqNum is [INT32], RMEP is [UINT16], MD ID is [STRING], MA ID is [STRING]. |
|
Variable fields |
$1: Service instance ID. $2: Local MEP ID. $3: Source MAC address. $4: Sequence number. $5: Remote MEP ID. $6: MD ID. If no MD ID is available, "without ID" is displayed. $7: MA ID. |
|
Severity level |
6 |
|
Example |
CFD/6/CFD_ERROR_CCM: MEP 2 in SI 7 received an error CCM. Its SrcMAC is 0011-2233-4401, SeqNum is 21, RMEP is 2, MD ID is 7, MA ID is 1. |
|
Explanation |
A MEP received an error CCM containing an unexpected MEP ID or lifetime. |
|
Recommended action |
Check the CCM configuration. Make sure the CCM intervals are consistent on both ends, and the remote MEP ID is included in the MEP list of the local end. |
CFD_LOST_CCM
|
Message text |
MEP [UINT16] in SI [INT32] failed to receive CCMs from RMEP [UINT16]. |
|
Variable fields |
$1: Local MEP ID. $2: Service instance ID. $3: Remote MEP ID. |
|
Severity level |
6 |
|
Example |
CFD/6/CFD_LOST_CCM: MEP 1 in SI 7 failed to receive CCMs from RMEP 2. |
|
Explanation |
A MEP failed to receive CCMs within 3.5 sending intervals because the link is faulty or the remote MEP does not send CCM within 3.5 sending intervals. |
|
Recommended action |
Check the link status and the configuration of the remote MEP. If the link is down or faulty (becomes unidirectional, for example), restore the link. If the remote MEP is configured with the same service instance, make sure the CCM sending intervals are consistent on both ends. |
CFD_NO_HRD_RESOURCE
|
Message text |
Failed to start CCM on service instance [INT32] because of insufficient hardware frequency resources. |
|
Variable fields |
$1: Service instance ID. |
|
Severity level |
6 |
|
Example |
CFD/6/CFD_NO_HRD_RESOURCE: -MDC=1; Failed to start CCM on service instance 7 because of insufficient hardware frequency resources. |
|
Explanation |
This message is generated when CCM sending fails to be enabled in a service instance because of insufficient hardware frequency resources. |
|
Recommended action |
Contact H3C Support. |
CFD_REACH_LOWERLIMIT
|
Message text |
[STRING] reached or fell below the lower limit [STRING] on MEP [UINT16] in service instance [INT32]. |
|
Variable fields |
$1: Monitored indicator: · Far-end frame loss ratio. · Near-end frame loss ratio. · Frame delay. $2: Threshold. $3: Local MEP ID. $4: Service instance ID. |
|
Severity level |
6 |
|
Example |
CFD/6/ CFD_REACH_LOWERLIMIT: Far-end frame loss ratio reached or fell below the lower limit 4% on MEP 2 in service instance 3. |
|
Explanation |
This message is generated when a monitored indicator reaches or falls below the lower limit. |
|
Recommended action |
No action is required. |
CFD_REACH_LOWERLIMIT_EX
|
Message text |
[STRING] reached or fell below the lower limit [STRING] on synthetic-slm test instance [STRING] in service instance [INT32]. |
|
Variable fields |
$1: Monitored indicator: · Far-end frame loss ratio. · Near-end frame loss ratio. $2: Threshold. $3: Source MEP ID and target MEP ID. $4: Service instance ID. |
|
Severity level |
6 |
|
Example |
CFD/6/ CFD_REACH_LOWERLIMIT_EX: Far-end frame loss ratio reached or fell below the lower limit 4% on synthetic-slm test instance mep(1001) to target-mep(2001) in service instance 1. |
|
Explanation |
This message is generated when a monitored indicator for single-ended synthetic LM reaches or falls below the lower limit. |
|
Recommended action |
No action is required. |
CFD_REACH_UPPERLIMIT
|
Message text |
[STRING] reached or exceeded the upper limit [STRING] on MEP [UINT16] in service instance [INT32]. |
|
Variable fields |
$1: Monitored indicator: · Far-end frame loss ratio. · Near-end frame loss ratio. · Frame delay. $2: Threshold. $3: Local MEP ID. $4: Service instance ID. |
|
Severity level |
6 |
|
Example |
CFD/6/ CFD_REACH_LOWERLIMIT: Far-end frame loss ratio reached or fell below the lower limit 4% on MEP 2 in service instance 3. |
|
Explanation |
This message is generated when a monitored indicator reaches or exceeds the upper limit. |
|
Recommended action |
No action is required. |
CFD_REACH_UPPERLIMIT_EX
|
Message text |
[STRING] reached or exceeded the upper limit [STRING] on synthetic-slm test instance [STRING] in service instance [INT32]. |
|
Variable fields |
$1: Monitored indicator: · Far-end frame loss ratio. · Near-end frame loss ratio. $2: Threshold. $3: Source MEP ID and target MEP ID. $4: Service instance ID. |
|
Severity level |
6 |
|
Example |
CFD/6/ CFD_REACH_UPPERLIMIT_EX: Far-end frame loss ratio reached or exceeded the upper limit 80% on synthetic-slm test instance mep(1001) to target-mep(2001) in service instance 1. |
|
Explanation |
This message is generated when a monitored indicator for single-ended synthetic LM reaches or exceeds the upper limit. |
|
Recommended action |
No action is required. |
CFD_RECEIVE_CCM
|
Message text |
MEP [UINT16] in SI [INT32] received CCMs from RMEP [UINT16] |
|
Variable fields |
$1: Local MEP ID. $2: Service instance ID. $3: Remote MEP ID. |
|
Severity level |
6 |
|
Example |
CFD/6/CFD_RECEIVE_CCM: MEP 1 in SI 7 received CCMs from RMEP 2. |
|
Explanation |
A MEP received CCMs from a remote MEP. |
|
Recommended action |
No action is required. |
CFGMAN messages
This section contains configuration management messages.
CFGMAN_CFGCHANGED
|
Message text |
-EventIndex=[INT32]-CommandSource=[INT32]-ConfigSource=[INT32]-ConfigDestination=[INT32]; Configuration changed. |
|
Variable fields |
$1: Event index in the range of 1 to 2147483647. $2: Configuration change source: ¡ cli—The configuration change came from the CLI. ¡ snmp—The configuration change came from SNMP or was a configuration database change detected by SNMP. ¡ other—The configuration change came from other sources. $3: Source configuration: ¡ erase—Deleting or renaming a configuration file. ¡ running—Saving the running configuration. ¡ commandSource—Copying a configuration file. ¡ startup—Saving the running configuration to the next-startup configuration file. ¡ local—Saving the running configuration to a local file. ¡ networkFtp—Using FTP to transfer and save a configuration file to the device as the running configuration or next-startup configuration file. ¡ hotPlugging—A card hot swapping caused the configuration to be deleted or become ineffective. $4: Destination configuration: ¡ erase—Deleting or renaming a configuration file. ¡ running—Saving the running configuration. ¡ commandSource—Copying a configuration file. ¡ startup—Saving the running configuration to the next-startup configuration file. ¡ local—Saving the running configuration to a local file. ¡ networkFtp—Using FTP to transfer and save a configuration file to the device as the running configuration or next-startup configuration file. ¡ hotPlugging—A card hot swapping caused the configuration to be deleted or become ineffective. |
|
Severity level |
5 |
|
Example |
CFGMAN/5/CFGMAN_CFGCHANGED: -EventIndex=[6]-CommandSource=[snmp]-ConfigSource=[startup]-ConfigDestination=[running]; Configuration changed. |
|
Explanation |
The running configuration changed in the past 10 minutes. |
|
Recommended action |
No action is required. |
CFGMAN_OPTCOMPLETION
|
Message text |
-OperateType=[INT32]-OperateTime=[INT32]-OperateState=[INT32]-OperateEndTime=[INT32]; Operation completed. |
|
Variable fields |
$1: Operation type: ¡ running2startup—Saves the running configuration to the next-startup configuration file. ¡ startup2running—Loads the configuration in the next-startup configuration file. ¡ running2net—Saves the running configuration to a host on the network. ¡ net2running—Transfers a configuration file from a host on the network and loads the configuration. ¡ net2startup—Transfers a configuration file from a host on the network and specifies the file as the next-startup configuration file. ¡ startup2net—Copies the next-startup configuration file to a host on the network. $2: Operation start time. $3: Operation status: ¡ InProcess—Operation is in progress. ¡ success—Operation succeeded. ¡ InvalidOperation—Invalid operation. ¡ InvalidProtocol—Invalid protocol. ¡ InvalidSource—Invalid source file name. ¡ InvalidDestination—Invalid destination file name. ¡ InvalidServer—Invalid server address. ¡ DeviceBusy—The device is busy. ¡ InvalidDevice—Invalid device address. ¡ DeviceError—An error occurred on the device. ¡ DeviceNotWritable—The storage medium on the device is write protected. ¡ DeviceFull—The device does not have enough free storage space for the file. ¡ FileOpenError—Failed to open the file. ¡ FileTransferError—Failed to transfer the file. ¡ ChecksumError—File checksum error. ¡ LowMemory—The memory space is not sufficient. ¡ AuthFailed—User authentication failed. ¡ TransferTimeout—Transfer timed out. ¡ UnknownError—An unknown error occurred. ¡ invalidConfig—Invalid configuration. $4: Operation end time. |
|
Severity level |
5 |
|
Example |
CFGMAN/5/CFGMAN_OPTCOMPLETION: -OperateType=[running2startup]-OperateTime=[248]-OperateState=[success]-OperateEndTime=[959983]; Operation completed. |
|
Explanation |
The device is performing or has completed an operation. |
|
Recommended action |
If the operation is not successful, locate and resolve the issue. |
CFGMAN_SAVE_FAILURE
|
Message text |
Automatic running configuration saving was not executed because the status of [STRING] is fault. |
|
Variable fields |
$1: Hardware location. |
|
Severity level |
4 |
|
Example |
CFGMAN/4/CFGMAN_SAVE_FAILURE: Automatic running configuration saving was not executed because the status of chassis 1 slot 0 subslot 1 is fault. |
|
Explanation |
Automatic running configuration saving was not executed because a hardware fault is present. |
|
Recommended action |
1. Use the display device command to check the hardware state for the fault. 2. Fix the hardware fault. 3. Wait for the system to automatically save the running configuration or manually save the running configuration. |
CLK messages
This section contains clock monitoring messages.
CLK_GET_CFG_OK
|
Message text |
Get clock global config succeed. |
|
Variable fields |
N/A |
|
Severity level |
5 (Notification) |
|
Example |
DSYSM/5/CLK_GET_CFG_OK: -MDC=1; Get clock global config succeed. |
|
Impact |
No negative impact on the system. |
|
Cause |
The following global clock settings were obtained successfully: · Whether the SSM quality level is used in automatic reference selection. · Cock reference selection mode. |
|
Recommended action |
No action is required. |
CLK_TRACE_CHG
|
Message text |
Traced reference change alarm, current traced reference is [INT32]. |
|
Variable fields |
$1: Clock source ID. |
|
Severity level |
5 (Notification) |
|
Example |
DRIVER/5/CLK_TRACE_CHG: -MDC=1; Traced reference change alarm, current traced reference is 9. |
|
Impact |
No negative impact on the system. |
|
Cause |
The clock reference traced by the device changed. |
|
Recommended action |
No action is required. |
CLK_TRACE_NOREF
|
Message text |
Traced reference change alarm, no reference traced now. |
|
Variable fields |
N/A |
|
Severity level |
3 (Error) |
|
Example |
DRIVER/3/CLK_TRACE_NOREF: -MDC=1; Traced reference change alarm, no reference traced now. |
|
Impact |
No negative impact on the system. |
|
Cause |
The device did not have a clock reference to trace. |
|
Recommended action |
1. Use the display network-clock status command to display the operating state of the network clock monitoring module. ¡ If the device uses automatic reference selection, ensure link connectivity between the device and clock source. ¡ If the device uses manual reference selection, first use the display network-clock source command to display the states of all clock sources. Then use the network-clock work-mode manual source command to specify a clock reference in normal state as the clock reference. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
CLK_REF_RECOVER
|
Message text |
Reference [INT32] is recovered. |
|
Variable fields |
$1: Clock source ID. |
|
Severity level |
3 (Error) |
|
Example |
DRIVER/3/CLK_REF_RECOVER: -MDC=1; References 5 is recovered. |
|
Impact |
No negative impact on the system. |
|
Cause |
The clock reference of the device recovered to normal state. Only a clock source in normal state can be selected as the clock reference. To display the states of clock sources, execute the display network-clock source command. |
|
Recommended action |
No action is required. |
CLK_REF_LOST
|
Message text |
Reference [INT32] is lost. |
|
Variable fields |
$1: Clock source ID. |
|
Severity level |
5 |
|
Example |
DRIVER/3/CLK_REF_LOST: -MDC=1; References 5 is lost. |
|
Impact |
The user services get stuck and users go offline. |
|
Cause |
· The link between the device and the clock source was disconnected. · The line clock input port went down. |
|
Recommended action |
1. Ensure link connectivity between the device and the clock source. 2. Check if the line clock input port on the device is down. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
CLK_ALLREF_LOST
|
Message text |
All references are lost. |
|
Variable fields |
N/A |
|
Severity level |
5 (Notification) |
|
Example |
DRIVER/5/CLK_ALLREF_LOST: -MDC=1; All references are lost. |
|
Impact |
The user services get stuck and users go offline. |
|
Cause |
· The links between the device and the clock sources were disconnected. · The line clock input port went down. |
|
Recommended action |
1. Ensure link connectivity between the device and the clock sources. 2. Check if the line clock input port on the device is down. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
CLK_PTP_PRICHG
|
Message text |
Priority alarm, current priority of PTP is [INT32]. |
|
Variable fields |
$1: PTP clock priority. |
|
Severity level |
5 (Notification) |
|
Example |
DRIVER/5/CLK_PTP_PRICHG: -MDC=1; Priority alarm, current priority of PTP is 8. |
|
Impact |
No negative impact on the system. |
|
Cause |
The PTP clock priority was changed. |
|
Recommended action |
No action is required. |
CLK_REF_PRICHG
|
Message text |
Priority alarm, current priority of reference [INT32] is [INT32]. |
|
Variable fields |
$1: Clock source ID. $2: Clock priority. |
|
Severity level |
5 (Notification) |
|
Example |
DRIVER/5/CLK_SSM_CHG: -MDC=1; SSM level alarm, current SSM level of reference 2 1 is SSUB. |
|
Impact |
No negative impact on the system. |
|
Cause |
The priority of a clock source was changed. |
|
Recommended action |
No action is required. |
CLK_SSM_CHG
|
Message text |
SSM level alarm, current SSM level of reference [INT32] is [STRING]. |
|
Variable fields |
$1: Clock source ID. $2: SSM quality level. |
|
Severity level |
5 (Notification) |
|
Example |
DRIVER/5/CLK_SSM_CHG: -MDC=1; SSM level alarm, current SSM level of reference 2 is SSUB. |
|
Impact |
No negative impact on the system. |
|
Cause |
The SSM quality level of a clock source was changed. |
|
Recommended action |
No action is required. |
CLK_PTPSSM_CHG
|
Message text |
SSM level alarm, current SSM level of PTP is [STRING]. |
|
Variable fields |
$1: SSM quality level. |
|
Severity level |
5 (Notification) |
|
Example |
DRIVER/5/CLK_PTPSSM_CHG: -MDC=1; SSM level alarm, current SSM level of PTP is SSUA. |
|
Impact |
No negative impact on the system. |
|
Cause |
The SSM quality level of the PTP clock was changed. |
|
Recommended action |
No action is required. |
CLK_LOCKED
|
Message text |
Phase lock alarm, current phase lock mode is [STRING]. |
|
Variable fields |
$1: Phase lock state. |
|
Severity level |
5 (Notification) |
|
Example |
DRIVER/5/CLK_LOCKED: -MDC=1; Phase lock alarm, current phase lock mode is Locked. DRIVER/5/CLK_LOCKED: -MDC=1; Phase lock alarm, current phase lock mode is Holdover. DRIVER/5/CLK_LOCKED: -MDC=1; Phase lock alarm, current phase lock mode is Freerun. |
|
Impact |
No negative impact on the system. |
|
Cause |
The phase lock state of the clock monitoring module changed. |
|
Recommended action |
No action is required. |
CLK_SSM_OUTLEVEL
|
Message text |
SSM out level alarm, current SSM out level is [STRING]. |
|
Variable fields |
$1: SSM quality level. |
|
Severity level |
5 (Notification) |
|
Example |
DRIVER/5/CLK_SSM_OUTLEVEL: -MDC=1; SSM out level alarm, current SSM out level is SSUB. |
|
Impact |
No negative impact on the system. |
|
Cause |
The SSM quality level of the selected clock reference was changed. |
|
Recommended action |
No action is required. |
RCV_GPS_TOD
|
Message text |
Failed to receive ToD signals from the GPS device. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
DRVPLAT/4/RCV_GPS_TOD: -MDC=1; Failed to receive ToD signals from the GPS device. |
|
Impact |
The user services get stuck and users go offline. |
|
Cause |
The FPGA detected anomalies in ToD signals from the GPS device. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
RCV_GPS_1PPS
|
Message text |
Failed to receive 1PPS signals from the GPS device. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
DRVPLAT/4/RCV_GPS_1PPS: -MDC=1; Failed to receive 1PPS signals from the GPS device. |
|
Impact |
The user services get stuck and users go offline. |
|
Cause |
The FPGA detected anomalies in 1PPS signals from the GPS device. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
FPGA_TSMT_FQC
|
Message text |
On the MPU, the FPGA failed to transmit frequency signals to the clock chip. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
DRVPLAT/4/FPGA_TSMT_FQC: -MDC=1; On the MPU, the FPGA failed to transmit frequency signals to the clock chip. |
|
Impact |
The user services get stuck and users go offline. |
|
Cause |
The clock chip detected anomalies in 8 KHz signals from the FPGA. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
CLK_DSTB_FQC
|
Message text |
The clock chip on the MPU failed to distribute frequency signals to the FPGA. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
DRVPLAT/4/CLK_DSTB_FQC: -MDC=1; The clock chip on the MPU failed to distribute frequency signals to the FPGA. |
|
Impact |
The user services get stuck and users go offline. |
|
Cause |
The FPGA detected anomalies in 8 KHz signals from the clock chip. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
CLK_DSTB_1PPS
|
Message text |
The clock chip on the MPU failed to distribute 1PPS signals to the FPGA. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
DRVPLAT/4/CLK_DSTB_1PPS: -MDC=1; The clock chip on the MPU failed to distribute 1PPS signals to the FPGA. |
|
Impact |
The user services get stuck and users go offline. |
|
Cause |
The FPGA detected anomalies in 1PPS signals from the clock chip. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
MPU_DSTB_TOD
|
Message text |
The MPU failed to distribute ToD signals to the interface module. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
DRVPLAT/4/MPU_DSTB_TOD: -MDC=1-Slot=8; The MPU failed to distribute ToD signals to the interface module. |
|
Impact |
The user services get stuck and users go offline. |
|
Cause |
The interface module logic detected anomalies in ToD signals from the MPU. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
MPU_DSTB_1PPS
|
Message text |
The MPU failed to distribute 1PPS signals to the interface module. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
DRVPLAT/4/MPU_DSTB_1PPS: -MDC=1-Slot=8; The MPU failed to distribute 1PPS signals to the interface module. |
|
Impact |
The user services get stuck and users go offline. |
|
Cause |
The interface module logic detected anomalies in 1PPS signals from the MPU. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
MPU_DSTB_FQC
|
Message text |
The MPU failed to distribute frequency signals to the interface module. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
DRVPLAT/4/MPU_DSTB_FQC: -MDC=1-Slot=8; The MPU failed to distribute frequency signals to the interface module. |
|
Impact |
The user services get stuck and users go offline. |
|
Cause |
The interface module clock chip detected anomalies in frequency signals from the MPU. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
ITFC_DSTB_FQC
|
Message text |
The interface module failed to distribute frequency signals to the interface. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
DRVPLAT/4/ITFC_DSTB_FQC: -MDC=1-Slot=8; The interface module failed to distribute frequency signals to the interface. |
|
Impact |
The user services get stuck and users go offline. |
|
Cause |
The interface module clock chip detected anomalies in frequency signals from the base card. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
ITFC_TSMT_FQC
|
Message text |
The interface failed to transmit frequency signals to the interface module. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
DRVPLAT/4/ITFC_TSMT_FQC: -MDC=1-Slot=8; The interface failed to transmit frequency signals to the interface module. |
|
Impact |
The user services get stuck and users go offline. |
|
Cause |
The interface module clock chip detected anomalies in frequency signals from the interface. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
CLK_SYNC_A
|
Message text |
Npu clock source MPA, p1 = %lu |
|
Variable fields |
%lu: Clock reference change result. · 0: Successful. · Other value than 0: Failed. |
|
Severity level |
7 (Debug) |
|
Example |
BSP/7/CLK_SYNC_A: -MDC=1-Slot=18; Npu clock source MPA, p1 = 0 |
|
Impact |
No negative impact on the system. |
|
Cause |
The clock reference of the SFE-A switching fabric module changed to the downstream clock port on the MPU in slot 0. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help if the switching fails. |
CLK_SYNC_B
|
Message text |
Npu clock source MPB, p1 = %lu |
|
Variable fields |
%lu: Clock reference change result. · 0: Successful. · Other value than 0: Failed. |
|
Severity level |
7 (Debug) |
|
Example |
BSP/7/CLK_SYNC_B: -MDC=1-Slot=19; Npu clock source MPB, p1 = 0 |
|
Impact |
No negative impact on the system |
|
Cause |
The clock reference of the SFE-A switching fabric module changed to the downstream clock port of the MPU in slot 1. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help if the switching fails. |
CLKM messages
This section contains clock monitoring module messages.
CLKM_ESMC_PKT_ALARM
|
Message text |
ESMC packets were lost. (PortName=[STRING]) |
|
Variable fields |
$1: Name of the interface that receives ESMC packets. |
|
Severity level |
4 |
|
Example |
CLKM/4/CLKM_ESMC_PKT_ALARM: ESMC packets were lost. (PortName=G1/0/1) |
|
Explanation |
The device issues this message when ESMC packets were lost. |
|
Recommended action |
To resolve the issue: 1. Determine whether both the local and peer interfaces are ESMC-enabled. ¡ If both of them are ESMC-enabled, go to 3. ¡ If one or neither of them is ESMC-enabled, go to 2. ¡ If the device continues to output this message, go to 3. ¡ If the device does not output this message any more, the issue is resolved. 3. Collect alarm, log, and configuration information and contact the support. |
CLKM_SOURCE_FREQDEVIATION_ALARM
|
Message text |
The frequency offset of the clock reference for [STRING] has crossed the threshold. |
|
Variable fields |
$1: Device or chassis ID. |
|
Severity level |
4 |
|
Example |
CLKM/4/CLKM_SOURCE_FREQDEVIATION_ALARM: The frequency offset of the clock reference for chassis 1 has crossed the threshold. |
|
Explanation |
The clock frequency deviation crossed the threshold. |
|
Recommended action |
Identify whether the clock frequency deviation status is Alarm. |
CLKM_SOURCE_FREQDEVIATION_NORMAL
|
Message text |
The frequency offset of the clock reference for [STRING] has dropped below the threshold and resumed to normal. |
|
Variable fields |
$1: Device or chassis ID. |
|
Severity level |
4 |
|
Example |
CLKM/4/CLKM_SOURC_FREQDEVIATION_NORMAL: The frequency offset of the clock reference for chassis 1 has dropped below the threshold and resumed to normal. |
|
Explanation |
The clock frequency deviation resumed to normal. |
|
Recommended action |
N/A |
CLKM_SOURCE_LOST
|
Message text |
|
|
Variable fields |
$1: Device or chassis ID. |
|
Severity level |
4 |
|
Example |
CLKM/4/CLKM_SOURCE_LOST: Chassis 1 has lost signals from the clock reference. |
|
Explanation |
|
|
Recommended action |
Examine the related configuration and clock reference status. |
CLKM_SOURCE_SSM_DEGRADE
|
Message text |
|
|
Variable fields |
$1: Device or chassis ID. $2: SSM level before degradation. $3: SSM level after degradation. $4: SSM level degradation threshold. |
|
Severity level |
4 |
|
Example |
CLKM/4/CLKM_SOURCE_SSM_DEGRADE: The SSM quality level of the clock reference for chassis 1 has degraded from SSU-A to SEC. The SSM quality level threshold is SSU-A. |
|
Explanation |
The SSM level of the clock reference degraded to a value lower than the degradation threshold. |
|
Recommended action |
Examine the related configuration and clock reference status. |
CLKM_SOURCE_SSM_RESUME
|
Message text |
The SSM quality level of the clock reference for [STRING] has risen from [STRING] to [STRING].The SSM quality level threshold is [STRING]. |
|
Variable fields |
$1: Device or chassis ID. $2: SSM level before degradation. $3: SSM level after degradation. $4: SSM level degradation threshold. |
|
Severity level |
4 |
|
Example |
CLKM/4/CLKM_SOURCE_SSM_RESUME: The SSM quality level of the clock reference for chassis 1 has risen from SEC to SSU-A. The SSM quality level threshold is SSU-A. |
|
Explanation |
The SSM quality level of the clock reference resumed to the acceptable ranges. |
|
Recommended action |
N/A |
CLKM_SOURCE_SWITCHOVER
|
Message text |
|
|
Variable fields |
$1: Device or chassis ID. $2: Clock source type. ¡ Name of the line clock input port. ¡ BITS0. ¡ BITS1. ¡ PTP. ¡ Local clock reference. |
|
Severity level |
4 |
|
Example |
CLKM/4/CLKM_SOURCE_SSM_SWITCHOVER: The clock reference of chassis 1 has changed to BITS0. |
|
Explanation |
The clock reference was changed. |
|
Recommended action |
N/A |
CONNLMT messages
This section contains connection limit messages.
CONNLMT_IPV4_OVERLOAD
|
Message text |
RcvIfName(1023)=[STRING];Protocol(1001)=[STRING];SrcIPAddr(1003)=[IPADDR];DstIPAddr(1007)=[IPADDR];ServicePort(1071)=[UINT16];RcvVPNInstance(1042)=[STRING];SndVPNInstance(1043)=[STRING];SndDSLiteTunnelPeer(1041)=[STRING];UpperLimit(1049)=[UINT32];LimitRuleNum(1051)=[UINT16];Event(1048)=[STRING]; |
|
Variable fields |
$1: Global, or interface name. $2: Transport layer protocol type. $3: Source IP address. $4: Destination IP address. $5: Service port number. $6: Source VPN instance name. $7: Destination VPN instance name. $8: Peer tunnel ID. $9: Upper threshold. $10: Rule ID. $11: Event message. |
|
Severity level |
6 |
|
Example |
CONNLMT/6/CONNLMT_IPV4_OVERLOAD: RcvIfName(1023)=Global;Protocol(1001)=;SrcIPAddr(1003)=10.10.10.1;DstIPAddr(1007)=;ServicePort(1071)=;RcvVPNInstance(1042)=;SndVPNInstance(1043)=;SndDSLiteTunnelPeer(1041)=;UpperLimit(1049)=1000;LimitRuleNum(1051)=1;Event(1048)=Exceeded upper threshold; |
|
Explanation |
The number of concurrent connections exceeded the upper threshold. |
|
Recommended action |
No action is required. |
CONNLMT_IPV4_RECOVER
|
Message text |
RcvIfName(1023)=[STRING];Protocol(1001)=[STRING];SrcIPAddr(1003)=[IPADDR];DstIPAddr(1007)=[IPADDR];ServicePort(1071)=[UINT16];RcvVPNInstance(1042)=[STRING];SndVPNInstance(1043)=[STRING];SndDSLiteTunnelPeer(1041)=[STRING];DropPktCount(1052)=[UINT32];LowerLimit(1050)=[UINT32];LimitRuleNum(1051)=[UINT16];Event(1048)=[STRING]; |
|
Variable fields |
$1: Global, or interface name. $2: Transport layer protocol type. $3: Source IP address. $4: Destination IP address. $5: Service port number. $6: Source VPN instance name. $7: Destination VPN instance name. $8: Peer tunnel ID. $9: Number of dropped packets. $10: Lower threshold. $11: Rule ID. $12: Event message. |
|
Severity level |
6 |
|
Example |
CONNLMT/6/CONNLMT_IPV4_RECOVER: RcvIfName(1023)=Global;Protocol(1001)=;SrcIPAddr(1003)=10.10.10.1;DstIPAddr(1007)=;ServicePort(1071)=;RcvVPNInstance(1042)=;SndVPNInstance(1043)=;SndDSLiteTunnelPeer(1041)=;DropPktCount(1052)=306004;LowerLimit(1050)=10;LimitRuleNum(1051)=1;Event(1048)=Dropped below lower threshold; |
|
Explanation |
The number of concurrent connections dropped to the lower threshold from the upper threshold. |
|
Recommended action |
No action is required. |
CONNLMT_IPV6_OVERLOAD
|
Message text |
RcvIfName(1023)=[STRING];Protocol(1001)=[STRING];SrcIPv6Addr(1036)=[IPADDR];DstIPv6Addr(1037)=[IPADDR];ServicePort(1071)=[UINT16];RcvVPNInstance(1042)=[STRING];SndVPNInstance(1043)=[STRING];SndDSLiteTunnelPeer(1041)=[STRING];UpperLimit(1049)=[UINT32];LimitRuleNum(1051)=[UINT16];Event(1048)=[STRING]; |
|
Variable fields |
$1: Global, or interface name. $2: Transport layer protocol type. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Service port number. $6: Source VPN instance name. $7: Destination VPN instance name. $8: Peer tunnel ID. $9: Upper threshold. $10: Rule ID. $11: Event message. |
|
Severity level |
6 |
|
Example |
CONNLMT/6/CONNLMT_IPV6_OVERLOAD: RcvIfName(1023)=Global;Protocol(1001)=;SrcIPv6Addr(1036)=2001::1;DstIPv6Addr(1037)=;ServicePort(1071)=;RcvVPNInstance(1042)=;SndVPNInstance(1043)=;SndDSLiteTunnelPeer(1041)=;UpperLimit(1049)=1000;LimitRuleNum(1051)=1;Event(1048)=Exceeded upper threshold; |
|
Explanation |
The number of concurrent connections exceeded the upper threshold. |
|
Recommended action |
No action is required. |
CONNLMT_IPV6_RECOVER
|
Message text |
RcvIfName(1023)=[STRING];Protocol(1001)=[STRING];SrcIPv6Addr(1036)=[IPADDR];DstIPv6Addr(1037)=[IPADDR];ServicePort(1071)=[UINT16];RcvVPNInstance(1042)=[STRING];SndVPNInstance(1043)=[STRING];SndDSLiteTunnelPeer(1041)=[STRING];DropPktCount(1052)=[UINT32];LowerLimit(1050)=[UINT32];LimitRuleNum(1051)=[UINT16];Event(1048)=[STRING]; |
|
Variable fields |
$1: Global, or interface name. $2: Transport layer protocol type. $3: Source IPv6 address. $4: Destination IPv6 address. $5: Service port number. $6: Source VPN instance name. $7: Destination VPN instance name. $8: Peer tunnel ID. $9: Number of dropped packets. $10: Lower threshold. $11: Rule ID. $12: Event message. |
|
Severity level |
6 |
|
Example |
CONNLMT/6/CONNLMT_IPV6_RECOVER: RcvIfName(1023)=Global;Protocol(1001)=;SrcIPAddr(1003)=2001::1;DstIPAddr(1007)=;ServicePort(1071)=;RcvVPNInstance(1042)=;SndVPNInstance(1043)=;SndDSLiteTunnelPeer(1041)=;DropPktCount(1052)=306004;LowerLimit(1050)=10;LimitRuleNum(1051)=1;Event(1048)=Dropped below lower threshold; |
|
Explanation |
The number of concurrent connections dropped to the lower threshold from the upper threshold. |
|
Recommended action |
No action is required. |
DDP
This section contains DDP messages.
DDP_FLOW_MONITOR_ACTIVE
|
Message text |
The flow monitor function became active due to the disabling of the hardware NetStream function. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
DDP/4/DDP_FLOW_MONITOR_ACTIVE: -MDC=1-Slot=3; The flow monitor function became active due to the disabling of the hardware NetStream function. |
|
Impact |
The hardware NetStream in the specified slot does not take effect, but the flow monitor function is re-enabled. |
|
Cause |
The hardware NetStream function is incompatible with the flow monitor function. If you first configure flow monitor, enable hardware NetStream, and then disable hardware NetStream, cards that support hardware NetStream will output this log message. · To disable hardware NetStream, use undo ip netstream hardware enable in system view. · To configure flow monitor, use flow-monitor { inbound | outbound } in system view. |
|
Recommended action |
Identify whether a slot requires hardware NetStream or flow monitor based on the actual network requirements. · If the slot requires flow monitor, no action is required. · If the slot requires hardware NetStream, execute ip netstream hardware enable to enable hardware NetStream. |
DDP_FLOW_MONITOR_INACTIVE
|
Message text |
The flow monitor function became inactive due to the enabling of the hardware NetStream function. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
DDP/4/DDP_FLOW_MONITOR_INACTIVE: -MDC=1-Slot=3; The flow monitor function became inactive due to the enabling of the hardware NetStream function. |
|
Impact |
The flow monitor function in the specified slot no long takes effect. |
|
Cause |
The hardware NetStream function is incompatible with the flow monitor function. If you first configure flow monitor and then enable hardware NetStream (this operation disables flow monitor), cards that support hardware NetStream will output this log message. · To enable hardware NetStream, use ip netstream hardware enable in system view. · To configure flow monitor, use flow-monitor { inbound | outbound } in system view. |
|
Recommended action |
Identify whether a slot requires hardware NetStream or flow monitor based on the actual network requirements. · If the slot requires hardware NetStream, no action is required. · If the slot requires flow monitor, execute undo ip netstream hardware enable to disable hardware NetStream. Then, the configured flow monitor on the slot is enabled again. |
DEV messages
This section contains device management messages.
CPLD_STAT_CONFLICT
|
Message text |
The CPLD on the standby MPU in slot [INT32] mistakenly reported a switchover to the active MPU role. The active MPU is in slot [INT32]. |
|
Variable fields |
$1: Slot number of the standby MPU. $2: Slot number of the active MPU. |
|
Severity level |
4 (Warning) |
|
Example |
DEVD/4/CPLD_STAT_CONFLICT: -MDC=1-Slot=0; The CPLD on the standby MPU in slot 0 mistakenly reported a switchover to the active MPU role. The active MPU is in slot 1. |
|
Impact |
The message is reported mistakenly, which does not impact the system. |
|
Cause |
The CPLD on the standby MPU mistakenly reported a switchover to the active MPU role. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
USB_OVER_CURRT
|
Message text |
Over-current occurred to the USB port on the MPU. Please remove and check the USB device. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
DRVPLAT/4/USB_OVER_CURRT: -MDC=1; Over-current occurred to the USB port on the MPU. Please remove and check the USB device. |
|
Impact |
The connected USB device is not available. |
|
Cause |
The current of a USB port on the MPU is too high. The connected USB device failed. |
|
Recommended action |
1. Replace the USB device. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
TEMP_TOO_HIGH
|
Message text |
Pattern 1: Temperature of the board is too high! Pattern 2: Warning: Chip [INT32] temperature([STRING]) in slot [INT32] is too high, please check it. Pattern 3: hotspot [STRING] in slot [INT32] temperature([STRING]) is too high, please check it. Pattern 4: Warning: cpu temperature([STRING]) in slot [INT32] is too high, please check it. |
|
Variable fields |
Pattern 1: N/A. Pattern 2: $1: Chip number. $2: Temperature. $3: Slot number of the card. Pattern 3: $1: Hotspot sensor number. $2: Slot number of the card. $3: Temperature. Pattern 4: $1: Temperature. $2: Slot number of the card. |
|
Severity level |
Pattern 1: 4 (Warning) Pattern 2: 5 (Notification) Pattern 3: 5 (Notification) Pattern 4: 5 (Notification) |
|
Example |
Pattern 1: DRVPLAT/4/TEMP_TOO_HIGH: Temperature of the board is too high! Pattern 2: DRVPLAT/5/TEMP_TOO_HIGH: Warning:Chip 1 temperature(80) in slot 2 is too high, please check it. Pattern 3: DRVPLAT/5/TEMP_TOO_HIGH: hotspot 1 in slot 2 temperature(80) is too high, please check it. Pattern 4: DRVPLAT/5/TEMP_TOO_HIGH: Warning: cpu temperature(80) in slot 2 is too high, please check it. |
|
Impact |
The card might be faulty and cannot operate correctly. |
|
Cause |
The card temperature is too high. Fans failed or the ambient temperature is too high. |
|
Recommended action |
1. Check the ambient temperature. If the ambient temperature is too high, verify that the air conditioner for the room is operating correctly. 2. Verify that the air inlet and outlet for the device are not blocked. 3. Check the fans of the device. If the fans in a fan tray are not operating correctly, replace the fan tray. 4. Verify that all cards are installed correctly and all slots are installed with filler panels. 5. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
BOARD_INCOMPATIBLE
|
Message text |
Pattern 1: Warning: Standby board on slot [STRING] is not compatible with MPU board. Pattern 2: Warning: The LPU board on slot [STRING] is not compatible with MPU board. Pattern 3: The card in slot [UINT32] failed to start up. The card is not compatible with the chassis. |
|
Variable fields |
Pattern 1: $1: Slot number of the card. Pattern 2: $1: Slot number of the card. Pattern 3: $1: Slot number of the card. |
|
Severity level |
2 (Critical) |
|
Example |
Pattern 1: DRVPLAT/2/BOARD_INCOMPATIBLE: -MDC=1; Warning: Standby board on slot 1 is not compatible with MPU board. Pattern 2: DRVPLAT/2/BOARD_INCOMPATIBLE: -MDC=1; Warning: The LPU board on slot 4 is not compatible with MPU board. Pattern 3: DRVPLAT/2/BOARD_INCOMPATIBLE: -MDC=1; The card in slot 4 failed to start up. The card is not compatible with the chassis. |
|
Impact |
The card cannot startup correctly. |
|
Cause |
The card in the slot is not compatible with the local active MPU or chassis. |
|
Recommended action |
1. Replace the card with one that is compatible with the local active MPU and chassis. 2. Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
INCONSISTENT_SPEC
|
Message text |
Warning: Two power modules have different power specifications. |
|
Variable fields |
N/A. |
|
Severity level |
3 (Error) |
|
Example |
DRVPLAT/3/INCONSISTENT_SPEC:Warning: Two power modules have different power specifications. |
|
Impact |
The power modules cannot provide power correctly, which might cause the cards to power off randomly. |
|
Cause |
Power modules in the router have different power specifications. |
|
Recommended action |
Use power modules of the same model in the router. |
DEVICE_ID_DIFF
MPU_TYPE_DIFF
|
Message text |
IRF setup failed. The member devices have MPUs of different models. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
DRVPLAT/4/MPU_TYPE_DIFF: IRF setup failed. The member devices have MPUs of different models. |
|
Impact |
The IRF fabric cannot be established. |
|
Cause |
The member devices for the same IRF fabric must use MPUs of the same model. If not, the IRF fabric cannot be set up. |
|
Recommended action |
1. Check the card identifiers of the MPUs. Make sure all MPUs of the member devices have the same card identifier. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
MAC_ADDR_DIFF
|
Message text |
IRF setup failed. The MPUs on member devices have different MAC address table sizes. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
DRVPLAT/4/MAC_ADDR_DIFF: IRF setup failed. The MPUs on member devices have different MAC address table sizes. |
|
Impact |
The IRF fabric cannot be set up. |
|
Cause |
The member devices for the same IRF fabric must have the same MAC address table capacity. If not, the IRF fabric cannot be set up. |
|
Recommended action |
Contact alarm information, log messages, and configuration data, and then contact Technical Support for help. |
OVER_TEMP_ALARM
|
Message text |
Current temperature on slot [STRING] is [STRING] degrees centigrade, which is higher than the shutdown threshold. The board is being shut down. |
|
Variable fields |
$1: Slot number of the card. $2: Temperature. |
|
Severity level |
2 (Critical) |
|
Example |
DRVPLAT/2/OVER_TEMP_ALARM: -MDC=1; Current temperature on slot 4 is 101 degrees centigrade, which is higher than the shutdown threshold. The board is being shut down. |
|
Impact |
The card is powered off. |
|
Cause |
The temperature of a card exceeded the shutdown threshold and was going to be shut down. |
|
Recommended action |
1. Verify that all fans are installed firmly. If a fan has been pulled out, install the fan firmly and power on the card after the fan operates correctly. 2. If the issue persists, check the operating status of fans. If one or more fans are not operating correctly, replace the fans. 3. If the issue persists, replace the card or wait for the card to cool down. 4. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
|
Message text |
Current temperature on slot [INT32] is [INT32] degrees centigrade, which is higher than the shutdown threshold. The board is being reboot. |
|
Variable fields |
$1: Slot number of the MPU. $2: Hotspot sensor number. |
|
Severity level |
2 (Critical) |
|
Example |
DRVPLAT/2/OVER_TEMP_ALARM: -MDC=1; Current temperature on slot 10 is 116 degrees centigrade, which is higher than the shutdown threshold. The board is being reboot. |
|
Impact |
The MPU reboots. |
|
Cause |
The hotspot sensor temperature of the MPU exceeds the shutdown threshold. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
BOARD_MODE_NSPT
|
Message text |
In Mode [STRING], the card in slot [INT32] is not supported. Now rebooting. |
|
Variable fields |
Pattern 1: $1: System operating mode of the device. $2: Member ID of the device in the IRF fabric. $3: Slot number of the card. Pattern 2: $1: System operating mode of the device. $2: Slot number of the card |
|
Severity level |
2 (Critical) |
|
Example |
DRVPLAT/2/BOARD_MODE_NSPT: In Mode sdn-wan, the card in chassis 2 slot 6 is not supported. Now rebooting. |
|
Impact |
The interface module cannot operate correctly in the specified mode. |
|
Cause |
The specified interface module is not supported in the current system operating mode, and is to reboot. |
|
Recommended action |
Determine whether to continue using the specified system operating mode: · To continue using the specified system operating mode, replace the interface module with an interface module that supports the specified system operating mode. · To stop using the specified system operating mode, execute the system-working-mode command to specify a new system operating mode. |
BOARD_NOTSUPPORT_SLOT
|
Message text |
The card in slot [INT32] is not supported on the device. The card is not supported in slot [INT32],It can be installed in the following slots: %s. |
|
Variable fields |
$1: Slot number of the card |
|
Severity level |
2 (Critical) |
|
Example |
DRIVER/2/BOARD_NOT SUPPORT_SLOT: -MDC=1; The card in slot 5 is not supported on the device. |
|
Impact |
The card cannot be powered on. |
|
Cause |
An unsupported card is inserted in the slot. |
|
Recommended action |
If the card is not supported by the device, remove the card. If the card is supported in a specific slot, install it in that slot. |
POWER_IS_ERR
|
Message text |
Power supply in power [UINT32] became abnormal. The power supply might be powered off. |
|
Variable fields |
$1: Power supply slot. |
|
Severity level |
2 (Critical) |
|
Example |
DRVPLAT/2/POWER_IS_ERR: -MDC=1;Power supply in power 1 became abnormal. The power supply might be powered off. |
|
Impact |
The power supply for the system is abnormal. |
|
Cause |
The system detected a power supply failure. The power supply might be powered off. |
|
Recommended action |
· Check the power supply on the device. · Replace the abnormal power supply. |
SFC_CHANGED
|
Message text |
Warning: Short circuit sfc has been changed, it will take effect only after system restart. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
DEVD/4/SFC_CHANGED:Warning: Short circuit sfc has been changed, it will take effect only after system restart. |
|
Impact |
Traffic cannot be forwarded correctly. |
|
Cause |
The number of switching fabric modules was reduced, and the chassis is no longer fully configured with switching fabric modules. You must reboot the system for the switching fabric modules to take effect. |
|
Recommended action |
Reboot the system. |
POWER_SWITCH_ERR
|
Message text |
Pattern 1: Only one power switch in chassis [UINT32] is turned on. Pattern 2: Only one power switch is turned on. |
|
Variable fields |
Pattern 1: $1: IRF member ID of the device. |
|
Severity level |
3 (Error) |
|
Example |
DRVPLAT/3/POWER_SWITCH_ERR: Only one power switch is turned on. |
|
Impact |
The system might be mistakenly powered off. |
|
Cause |
When the chassis backplane switches are not pressed simultaneously, hardware status detection will generate user log messages and traps. |
|
Recommended action |
Actively press down all the backplane switches simultaneously. |
MICRO_SWITCH_ERR
|
Message text |
The micro switch on the MPU in chassis [UINT32] slot [UINT32] is not turned off. Pattern 2: The micro switch on the MPU in slot [UINT32] is not turned off. |
|
Variable fields |
Pattern 1: $1: IRF member ID of the device. $2: Slot number of the card. Pattern 2: $1: Slot number of the card. |
|
Severity level |
3 (Error) |
|
Example |
DRVPLAT/3/ MICRO_SWITCH_ERR: The micro switch on the MPU in chassis 2 slot 8 is not turned off. |
|
Impact |
The system might have error packets. |
|
Cause |
When the micro switch on the MPU is not turned off, hardware status detection will generate user log messages and traps. |
|
Recommended action |
Actively turn off the micro switch of the device or replace the component. |
DEV messages
This section contains device management messages.
AUTOSWITCH_FAULT
|
Message text |
[STRING] automatically switches between active and standby, and a fault occurs during the switching. |
|
Variable fields |
$1: Chassis number. |
|
Severity level |
1 |
|
Example |
DEV/1/ AUTO_SWITCH_FAULT: Chassis 1 automatically switches between active and standby, and a fault occurs during the switching, please contact technical support. |
|
Explanation |
An active/standby switchover was performed automatically on a device, and a fault occurred during the switchover process. |
|
Recommended action |
5. Execute the display diagnostic-information command to collect and save diagnostic information. 6. Reboot the device manually for clearing the fault. 7. Execute the display device command to display the device status. If the device status is not Normal, contact technical support. |
AUTOSWITCH_FAULT_REBOOT
|
Message text |
[STRING] automatically switches between active and standby, and a fault occurs during the switching, the device will immediately restart [STRING] to restore the fault. |
|
Variable fields |
$1: Chassis number. $2: Chassis number and slot number or slot number. |
|
Severity level |
1 |
|
Example |
DEV/1/AUTO_SWITCH_FAULT_REBOOT: Chassis 1 automatically switches between active and standby, and a fault occurs during the switching, the device will immediately restart chassis 1 slot 0 to restore the fault. |
|
Explanation |
An active/standby switchover was performed automatically on a device, and a fault occurred during the switchover process. The device will restart the faulty card immediately to clear the fault. |
|
Recommended action |
Execute the display device command to display the card status after the card is rebooted. If the card status is not Normal, contact technical support. |
BOARD_ALARM_CLEAR
|
Message text |
Board alarm cleared. (PhysicalIndex=<[UINT]>, PhysicalName=<[STRING]>, RelativeResource=<[STRING]>, ErrorCode=<[UINT]>, Reason=<[STRING]>) |
|
Variable fields |
$1: Entity index. $2: Entity name. $3: Fault location information. $4: Fault code. $5: Fault description. |
|
Severity level |
2 |
|
Example |
DEV/2/BOARD_ALARM_CLEAR: Board alarm cleared. (PhysicalIndex=140, PhysicalName=Level 1 Module 9 on Chassis 1, RelativeResource=1, ErrorCode=441002, Reason=FPGA load failed.) |
|
Explanation |
An alarm was cleared on a card. |
|
Recommended action |
No action is required. |
BOARD_ALARM_OCCUR
|
Message text |
Board alarm occurred. (PhysicalIndex=<[UINT]>, PhysicalName=<[STRING]>, RelativeResource=<[STRING]>, ErrorCode=<[UINT]>, Reason=<[STRING]>) |
|
Variable fields |
$1: Entity index. $2: Entity name. $3: Fault location information. $4: Fault code. $5: Fault description. |
|
Severity level |
2 |
|
Example |
DEV/2/BOARD_ALARM_OCCUR: Board alarm occurred. (PhysicalIndex=140, PhysicalName=Level 1 Module 9 on Chassis 1, RelativeResource=1, ErrorCode=441002, Reason=FPGA load failed.) |
|
Explanation |
An alarm occurred on a card. |
|
Recommended action |
For more information, review the related alarm information, or contact H3C Support. |
BOARD_FATALALARM_OCCUR
|
Message text |
Board fatal alarm occurred. (PhysicalIndex=<[UINT]>, PhysicalName=<[STRING]>, RelativeResource=<[STRING]>, ErrorCode=<[UINT]>, Reason=<[STRING]>) |
|
Variable fields |
$1: Entity index. $2: Entity name. $3: Fault location information. $4: Fault code. $5: Fault description. |
|
Severity level |
1 |
|
Example |
DEV/1/BOARD_FATALALARM_OCCUR: Board fatal alarm occurred. (PhysicalIndex=180136, PhysicalName=Level 1 Module 5 on Chassis 2, RelativeResource=2/5/0, ErrorCode=000008, Reason=System can't work without SFU board in slot 1.) |
|
Explanation |
This message was generated in one of the following situations: · The system cannot operate correctly because a slot is not installed with the correct card. · The device was not installed with the fabric module or service module of the correct module. For more information, see the fault description. |
|
Recommended action |
Execute the display device command to display the fabric module status. If the fabric module status is Normal, but the fault is still present, contact H3C Support. |
BOARD_REBOOT
|
Message text |
Board is rebooting on [STRING]. |
|
Variable fields |
$1: Chassis number and slot number or slot number. |
|
Severity level |
5 |
|
Example |
DEV/5/BOARD_REBOOT: Board is rebooting on slot 1. |
|
Explanation |
A card was manually or automatically rebooted. |
|
Recommended action |
If an unexpected automatic reboot occurred, perform the following tasks: 1. Execute the display version command after the slot starts up. 2. Check the Last reboot reason field for the reboot reason. 3. If an exception caused the reboot, contact H3C Support. |
BOARD_REMOVED
|
Message text |
Board was removed from [STRING], type is [STRING]. |
|
Variable fields |
$1: Chassis number and slot number or slot number. $2: Card type. |
|
Severity level |
3 |
|
Example |
DEV/3/BOARD_REMOVED: Board was removed from slot 1, type is LSQ1FV48SA. |
|
Explanation |
An LPU or a standby MPU was removed from a member device, causing the device to leave the IRF fabric. |
|
Recommended action |
If the LPU or MPU was not manually removed, perform the following tasks: 1. Verify that the card is securely seated. 2. Replace the card if the message persists. 3. Reboot the device to make it join the IRF fabric. 4. If the issue persists, contact H3C Support. |
BOARD_RUNNING_FAULT
|
Message text |
[STRING] is detected to be faulty. |
|
Variable fields |
$1: Chassis number and slot number or slot number. |
|
Severity level |
1 |
|
Example |
DEV/1/ BOARD_FAULT_REBOOT: Chassis 1 slot 0 is detected to be faulty, please contact technical support. |
|
Explanation |
A card was detected faulty. |
|
Recommended action |
1. Execute the display diagnostic-information command to collect and save diagnostic information. 2. Reboot the card manually for clearing the fault. 3. Execute the display device command to display the card status. If the card status is not Normal, contact technical support. |
BOARD_RUNNING_FAULT_REBOOT
|
Message text |
[STRING] is detected to be faulty, the device will immediately restart [STRING] to recover from the fault. |
|
Variable fields |
$1: Chassis number and slot number or slot number. $2: Chassis number and slot number or slot number. |
|
Severity level |
1 |
|
Example |
DEV/1/ BOARD_RUNNING_FAULT_REBOOT: Chassis 1 slot 0 is detected to be faulty, the device will immediately restart chassis 1 slot 0 to recover from the fault. |
|
Explanation |
A card was detected faulty. The device will restart the card immediately to clear the fault. |
|
Recommended action |
Execute the display device command to display the card status after the card is rebooted. If the card status is not Normal, contact technical support. |
BOARD_STATE_FAULT
|
Message text |
Board state changed to Fault on [STRING], type is [STRING]. |
|
Variable fields |
$1: Chassis number and slot number or slot number. $2: Card type. |
|
Severity level |
2 |
|
Example |
DEV/2/BOARD_STATE_FAULT: Board state changed to Fault on slot 1, type is LSQ1FV48SA. |
|
Explanation |
The card was starting up (initializing or loading software) or was not operating correctly. |
|
Recommended action |
· If the card was newly installed, wait for the card to start up. The required startup time varies by card model and software version and is typically less than 10 minutes. · If the card was not newly installed, contact H3C Support. |
BOARD_STATE_NORMAL
|
Message text |
Board state changed to Normal on [STRING], type is [STRING]. |
|
Variable fields |
$1: Chassis number and slot number or slot number. $2: Card type. |
|
Severity level |
5 |
|
Example |
DEV/5/BOARD_STATE_NORMAL: Board state changed to Normal on slot 1, type is LSQ1FV48SA. |
|
Explanation |
A newly installed LPU or standby MPU completed initialization. |
|
Recommended action |
No action is required. |
CFCARD_FAILED
|
Message text |
CF card state changed to Fault in [STRING] [STRING]. |
|
Variable fields |
$1: Chassis number and slot number, slot number, or the device. $2: CF card slot number. This field is displayed only if the device supports multiple CF cards. |
|
Severity level |
3 |
|
Example |
DEV/3/CFCARD_FAILED: CF card state changed to Fault in slot 1 CF card slot 1. |
|
Explanation |
A CF card failed. |
|
Recommended action |
1. Remove and install the CF card again. 2. If the issue persists, replace the CF card. |
CFCARD_INSERTED
|
Message text |
CF card was inserted in [STRING] [STRING]. |
|
Variable fields |
$1: Chassis number and slot number, slot number, or the device. $2: CF card slot number. This field is displayed only if the device supports multiple CF cards. |
|
Severity level |
4 |
|
Example |
DEV/4/CFCARD_INSERTED: CF card was inserted in slot 1 CF card slot 1. |
|
Explanation |
A CF card was installed. |
|
Recommended action |
No action is required. |
CFCARD_REMOVED
|
Message text |
CF card was removed from [STRING] [STRING]. |
|
Variable fields |
$1: Chassis number and slot number, slot number, or the device. $2: CF card slot number. This field is displayed only if the device supports multiple CF cards. |
|
Severity level |
3 |
|
Example |
DEV/3/CFCARD_REMOVED: CF card was removed from slot 1 CF card slot 1. |
|
Explanation |
A CF card was removed. |
|
Recommended action |
If the CF card was not manually removed, perform the following tasks: 1. Verify that the card is securely seated. 2. Replace the card if the message persists. 3. If the issue persists, contact H3C Support. |
CHASSIS_REBOOT
|
Message text |
Chassis [STRING] is rebooting now. |
|
Variable fields |
$1: Chassis number. |
|
Severity level |
5 |
|
Example |
DEV/5/CHASSIS_REBOOT: Chassis 1 is rebooting now. |
|
Explanation |
The chassis was manually or automatically rebooted. |
|
Recommended action |
If an unexpected automatic reboot occurs, perform the following tasks: 1. Execute the display version command after the chassis starts up. 2. Check the Last reboot reason field for the reboot reason. 3. If an exception caused the reboot, contact H3C Support. |
CPU_STATE_NORMAL
|
Message text |
Cpu state changed to Normal on [STRING]. |
|
Variable fields |
$1: Chassis number, slot number, and CPU number, or slot number and CPU number. The CPU number is displayed only if multiple CPUs are supported. |
|
Severity level |
5 |
|
Example |
DEV/5/CPU_STATE_NORMAL: Cpu state changed to Normal on slot 1 cpu 1. |
|
Explanation |
CPU status changed to normal. |
|
Recommended action |
No action is required. |
DEV_ SAVE_DIAGFILE_INTERRUPT
|
Message text |
Diagnostic information saved to file [STRING] interrupted by a new collection directive. |
|
Variable fields |
$1: Full path of the file for saving diagnostic information. |
|
Severity level |
6 |
|
Example |
DEV/6/DEV_SAVE_DIAGFILE_INTERRUPT: Diagnostic information saved to file /flash:/diag_H3C_20210425-103910.tar.gz interrupted by a new collection directive.. |
|
Explanation |
The diagnostic information collection task in progress in the background is interrupted by a new directive for collecting diagnostic information. |
|
Recommended action |
No action is required. |
DEV_CLOCK_CHANGE
|
Message text |
-User=[STRING]-IPAddr=[IPADDR]; System clock changed from [STRING] to [STRING]. |
|
Variable fields |
$1: Username of the login user. $2: IP address of the login user. $3: Old time. $4: New time. |
|
Severity level |
5 |
|
Example |
DEV/5/DEV_CLOCK_CHANGE: -User=admin-IPAddr=192.168.1.2; System clock changed from 15:49:52 01/02/2013 to 15:50:00 01/02/2013. |
|
Explanation |
The system time changed. |
|
Recommended action |
No action is required. |
DEV_FAULT_TOOLONG
|
Message text |
Card in [STRING] is still in Fault state for [INT32] minutes. |
|
Variable fields |
$1: Chassis number and slot number or slot number. $2: Time duration during which the card stayed in Fault state. |
|
Severity level |
4 |
|
Example |
DEV/4/DEV_FAULT_TOOLONG: Card in slot 1 is still in Fault state for 60 minutes. |
|
Explanation |
A card stayed in Fault state for a long period of time. |
|
Recommended action |
1. Reboot the card. 2. If the issue persists, contact H3C Support. |
DEV_REBOOT_UNSTABLE
|
Message text |
A reboot command was executed while the system status was not Stable. |
|
Variable fields |
N/A |
|
Severity level |
5 |
|
Example |
DEV/5/DEV_REBOOT_UNSTABLE: A reboot command was executed while the system status was not Stable. |
|
Explanation |
The reboot command was executed while the system status was not Stable. |
|
Recommended action |
Do not execute the reboot command while the system is starting up. It takes some time for the system to enter Stable state. If the system does not enter Stable state after a period, perform the following tasks: 1. Execute the display system stable state command to identify the components that are not in Stable state. 2. Troubleshoot the components that are not in Stable state. |
DEV_SAVE_DIAGFILE
|
Message text |
Diagnostic information saved to file [STRING] successfully. |
|
Variable fields |
$1: Full path of the file for saving diagnostic information. |
|
Severity level |
6 |
|
Example |
DEV/6/DEV_SAVE_DIAGFILE: Diagnostic information saved to file flash:/diag_H3C_20210425-103409.tar.gz successfully. |
|
Explanation |
Diagnostic information has been saved successfully. |
|
Recommended action |
No action is required. |
DYINGGASP
|
Message text |
Power failure or manual power-off occurred. |
|
Variable fields |
N/A |
|
Severity level |
0 |
|
Example |
DYINGGASP/0/DYINGGASP: Power failure or manual power-off occurred. |
|
Explanation |
The device detected an abrupt loss of power. |
|
Recommended action |
1. Verify that the power source is supplying power correctly. 2. Verify that the power cord is connected firmly. 3. Check the installed power modules. If one or more power modules have problems, replace the power modules. 4. If the issue persists, contact H3C Support. |
FAN_ABSENT
|
Message text |
Pattern 1: Fan [INT32] is absent. Pattern 2: Chassis [INT32] fan [INT32] is absent. |
|
Variable fields |
Pattern 1: $1: Fan tray number. Pattern 2: $1: Chassis number. $2: Fan tray number. |
|
Severity level |
3 |
|
Example |
DEV/3/FAN_ABSENT: Fan 2 is absent. |
|
Explanation |
A fan tray was not in place. |
|
Recommended action |
1. Check the fan tray slot: ¡ If the fan tray slot is empty, the temperature might have increased and the system recommends that you install a fan tray. ¡ If a fan tray is present, verify that the fan tray is securely seated. 2. Replace the fan tray if the message persists. 3. If the issue persists, contact H3C Support. |
FAN_ALARM_CLEAR
|
Message text |
Fan alarm cleared. (PhysicalIndex=<[UINT]>, PhysicalName=<[STRING]>, RelativeResource=<[STRING]>, ErrorCode=<[UINT]>, Reason=<[STRING]>) |
|
Variable fields |
$1: Entity index. $2: Entity name. $3: Fault location information. $4: Fault code. $5: Fault description. |
|
Severity level |
2 |
|
Example |
DEV/2/FAN_ALARM_CLEAR: Fan alarm cleared. (PhysicalIndex=199, PhysicalName=Fan 2, RelativeResource=0, ErrorCode=300020, Reason=Fan tray is not present.) |
|
Explanation |
A fan alarm was cleared. |
|
Recommended action |
No action is required. |
FAN_ALARM_OCCUR
|
Message text |
Fan alarm occurred. ( PhysicalIndex=<[UINT]>, PhysicalName=<[STRING]>, RelativeResource=<[STRING]>, ErrorCode=<[UINT]>, Reason=<[STRING]>) |
|
Variable fields |
$1: Entity index. $2: Entity name. $3: Fault location information. $4: Fault code. $5: Fault description. |
|
Severity level |
2 |
|
Example |
DEV/2/FAN_ALARM_OCCUR: Fan alarm occurred. (PhysicalIndex=199, PhysicalName=Fan 2, RelativeResource=0, ErrorCode=300020, Reason=Fan tray is not present.) |
|
Explanation |
A fan alarm occurred. |
|
Recommended action |
1. Re-install the fan tray that operates incorrectly. 2. Replace the fan tray. 3. If the issue persists, contact H3C Support. |
FAN_DIRECTION_NOT_PREFERRED
|
Message text |
Fan [INT32] airflow direction is not preferred on [STRING], please check it. |
|
Variable fields |
$1: Fan tray number. $2: Chassis number and slot number or slot number. |
|
Severity level |
1 |
|
Example |
DEV/1/FAN_DIRECTION_NOT_PREFERRED: Fan 1 airflow direction is not preferred on slot 1, please check it. |
|
Explanation |
The airflow direction of the fan tray is different from the airflow direction setting. |
|
Recommended action |
1. Verify that the airflow direction setting is correct. 2. Verify that the fan tray model provides the same airflow direction as the configured setting. 3. If the issue persists, contact H3C Support. |
FAN_FAILED
|
Message text |
Pattern 1: Fan [INT32] failed. Pattern 2: Chassis [STRING] fan [INT32] failed. |
|
Variable fields |
Pattern 1: $1: Fan tray number. Pattern 2: $1: Chassis number. $2: Fan tray number. |
|
Severity level |
2 |
|
Example |
DEV/2/FAN_FAILED: Fan 2 failed. |
|
Explanation |
The fan tray stopped because of an exception. |
|
Recommended action |
Replace the fan tray. |
FAN_FATALALARM_CLEAR
|
Message text |
Fan fatal alarm cleared. (PhysicalIndex=<[UINT]>, PhysicalName=<[STRING]>, RelativeResource=<[STRING]>, ErrorCode=<[UINT]>, Reason=<[STRING]>) |
|
Variable fields |
$1: Entity index. $2: Entity name. $3: Fault location information. $4: Fault code. $5: Fault description. |
|
Severity level |
1 |
|
Example |
DEV/1/FAN_FATALALARM_CLEAR: Fan warning alarm cleared. (PhysicalIndex=199, PhysicalName=Fan 2, RelativeResource=0, ErrorCode=300016, Reason=The fan resumed running.) |
|
Explanation |
A fatal fan alarm was cleared. |
|
Recommended action |
Contact H3C Support. |
FAN_FATALALARM_OCCUR
|
Message text |
Fan fatal alarm occurred. (PhysicalIndex=<[UINT]>, PhysicalName=<[STRING]>, RelativeResource=<[STRING]>, ErrorCode=<[UINT]>, Reason=<[STRING]>) |
|
Variable fields |
$1: Entity index. $2: Entity name. $3: Fault location information. $4: Fault code. $5: Fault description. |
|
Severity level |
1 |
|
Example |
DEV/1/FAN_FATALALARM_OCCUR: Fan fatal alarm occurred. (PhysicalIndex=199, PhysicalName=Fan 2, RelativeResource=0, ErrorCode=300016, Reason=The fan stopped running.) |
|
Explanation |
A fatal fan alarm occurred. |
|
Recommended action |
Contact H3C Support. |
FAN_RECOVERED
|
Message text |
Pattern 1: Fan [INT32] recovered. Pattern 2: Chassis [STRING] fan [INT32] recovered. |
|
Variable fields |
Pattern 1: $1: Fan tray number. Pattern 2: $1: Chassis number. $2: Fan tray number. |
|
Severity level |
2 |
|
Example |
DEV/2/FAN_RECOVERED: Fan 2 recovered. |
|
Explanation |
The fan tray started to operate correctly after it was installed. |
|
Recommended action |
No action is required. |
MAD_DETECT
|
Message text |
Multi-active devices detected, please fix it. |
|
Variable fields |
N/A |
|
Severity level |
1 |
|
Example |
DEV/1/MAD_DETECT: Multi-active devices detected, please fix it. |
|
Explanation |
Multiple member devices were found active. |
|
Recommended action |
1. Use the display irf command to view which member devices have left the original IRF fabric. 2. Use the display irf link command to locate the IRF link with problems. 3. Fix the IRF link in DOWN state. |
POWER_ABSENT
|
Message text |
Pattern 1: Power [INT32] is absent. Pattern 2: Chassis [STRING] power [INT32] is absent. |
|
Variable fields |
Pattern 1: $1: Power supply number. Pattern 2: $1: Chassis number. $2: Power supply number. |
|
Severity level |
3 |
|
Example |
DEV/3/POWER_ABSENT: Power 1 is absent. |
|
Explanation |
A power supply was removed. |
|
Recommended action |
1. Check the power supply slot. ¡ If the power supply slot is empty, install a power supply. ¡ If a power supply is present, verify that the power supply is securely seated. 2. If the issue persists, replace the power supply. 3. If the issue persists, contact H3C Support. |
POWER_ALARM_CLEAR
|
Message text |
Power alarm cleared. (PhysicalIndex=<[UINT]>, PhysicalName=<[STRING]>, RelativeResource=<[STRING]>, ErrorCode=<[UINT]>, Reason=<[STRING]>) |
|
Variable fields |
$1: Entity index. $2: Entity name. $3: Fault location information. $4: Fault code. $5: Fault description. |
|
Severity level |
2 |
|
Example |
DEV/2/POWER_ALARM_CLEAR: Power alarm cleared. (PhysicalIndex=163, PhysicalName=Unknown Power 2, RelativeResource=0, ErrorCode=233001, Reason=Overtemperature occurred on the power supply.) |
|
Explanation |
A power alarm was cleared. |
|
Recommended action |
No action is required. |
POWER_ALARM_OCCUR
|
Message text |
Power alarm occurred. (PhysicalIndex=<[UINT]>, PhysicalName=<[STRING]>, RelativeResource=<[STRING]>, ErrorCode=<[UINT]>, Reason=<[STRING]>) |
|
Variable fields |
$1: Entity index. $2: Entity name. $3: Fault location information. $4: Fault code. $5: Fault description. |
|
Severity level |
2 |
|
Example |
DEV/2/POWER_ALARM_OCCUR: Power alarm occurred. (PhysicalIndex=163, PhysicalName=Unknown Power 2, RelativeResource=0, ErrorCode=233001, Reason=Overtemperature occurred on the power supply.) |
|
Explanation |
A power alarm was cleared. |
|
Recommended action |
1. Execute the display power command to display the power supply status. 2. If the power supply status is Absent, verify that the power supply is installed correctly. 3. Replace the power supply. 4. If the issue persists, contact H3C Support. |
POWER_FAILED
|
Message text |
Pattern 1: Power [INT32] failed. Pattern 2: Chassis [STRING] power [INT32] failed. |
|
Variable fields |
Pattern 1: $1: Power supply number. Pattern 2: $1: Chassis number. $2: Power supply number. |
|
Severity level |
2 |
|
Example |
DEV/2/POWER_FAILED: Power 1 failed. |
|
Explanation |
A power supply failed. |
|
Recommended action |
Replace the power supply. |
POWER_MONITOR_ABSENT
|
Message text |
Pattern 1: Power monitor unit [INT32] is absent. Pattern 2: Chassis [STRING] power monitor unit [INT32] is absent. |
|
Variable fields |
Pattern 1: $1: Power monitoring module number. Pattern 2: $1: Chassis number. $2: Power monitoring module number. |
|
Severity level |
3 |
|
Example |
DEV/3/POWER_MONITOR_ABSENT: Power monitor unit 1 is absent. |
|
Explanation |
A power monitoring module was removed. |
|
Recommended action |
1. Check the power monitoring module slot. ¡ If the power monitoring module slot is empty, install a power monitoring module. ¡ If a power monitoring module is present, verify that the power monitoring module is securely seated. 2. If the issue persists, replace the power monitoring module. 3. If the issue persists, contact H3C Support. |
POWER_MONITOR_FAILED
|
Message text |
Pattern 1: Power monitor unit [INT32] failed. Pattern 2: Chassis [STRING] power monitor unit [INT32] failed. |
|
Variable fields |
Pattern 1: $1: Power monitoring module number. Pattern 2: $1: Chassis number. $2: Power monitoring module number. |
|
Severity level |
2 |
|
Example |
DEV/2/POWER_MONITOR_FAILED: Power monitor unit 1 failed. |
|
Explanation |
A power monitoring module failed. |
|
Recommended action |
Replace the power monitoring module. |
POWER_MONITOR_RECOVERED
|
Message text |
Pattern 1: Power monitor unit [INT32] recovered. Pattern 2: Chassis [STRING] power monitor unit [INT32] recovered. |
|
Variable fields |
Pattern 1: $1: Power monitoring module number. Pattern 2: $1: Chassis number. $2: Power monitoring module number. |
|
Severity level |
2 |
|
Example |
DEV/2/POWER_MONITOR_RECOVERED: Power monitor unit 1 recovered. |
|
Explanation |
The power monitoring module started to operate correctly after it was installed. |
|
Recommended action |
No action is required. |
POWER_RECOVERED
|
Message text |
Pattern 1: Power [INT32] recovered. Pattern 2: Chassis [STRING] power [INT32] recovered. |
|
Variable fields |
Pattern 1: $1: Power supply number. Pattern 2: $1: Chassis number. $2: Power supply number. |
|
Severity level |
2 |
|
Example |
DEV/2/POWER_RECOVERED: Power 1 recovered. |
|
Explanation |
The power supply started to operate correctly after it was installed. |
|
Recommended action |
No action is required. |
POWER_WARNING_CLEAR
|
Message text |
Power warning alarm cleared. (PhysicalIndex=<[UINT]>, PhysicalName=<[STRING]>, RelativeResource=<[STRING]>, ErrorCode=<[UINT]>, Reason=<[STRING]>) |
|
Variable fields |
$1: Entity index. $2: Entity name. $3: Fault location information. $4: Fault code. $5: Fault description. |
|
Severity level |
4 |
|
Example |
DEV/4/POWER_WARNING_CLEAR: Power warning alarm cleared. (PhysicalIndex=163, PhysicalName=Unknown Power 2, RelativeResource=0, ErrorCode=200037, Reason=No enough power to power on the board in chassis $1 slot $2. Required power is $3 W, available power is $4 W.) |
|
Explanation |
A warning power alarm was cleared. |
|
Recommended action |
No action is required. |
POWER_WARNING_OCCUR
|
Message text |
Power warning alarm occurred. (PhysicalIndex=<[UINT]>, PhysicalName=<[STRING]>, RelativeResource=<[STRING]>, ErrorCode=<[UINT]>, Reason=<[STRING]>) |
|
Variable fields |
$1: Entity index. $2: Entity name. $3: Fault location information. $4: Fault code. $5: Fault description. |
|
Severity level |
4 |
|
Example |
DEV/4/POWER_WARNING_OCCUR: Power warning alarm occurred. (PhysicalIndex=163, PhysicalName=Unknown Power 2, RelativeResource=0, ErrorCode=200037, Reason=No enough power to power on the board in chassis $1 slot $2. Required power is $3 W, available power is $4 W.) |
|
Explanation |
A warning power alarm occurred. |
|
Recommended action |
Replace the power supply or contact H3C Support. |
RPS_ABSENT
|
Message text |
Pattern 1: RPS [INT32] is absent. Pattern 2: Chassis [STRING] RPS [INT32] is absent. |
|
Variable fields |
Pattern 1: $1: RPS number. Pattern 2: $1: Chassis number. $2: RPS number. |
|
Severity level |
3 |
|
Example |
DEV/3/RPS_ABSENT: RPS 1 is absent. |
|
Explanation |
An RPS was removed. |
|
Recommended action |
1. Check the RPS slot. ¡ If the RPS slot is empty, install an RPS. ¡ If an RPS is present, verify that the RPS is securely seated. 2. If the issue persists, replace the RPS. 3. If the issue persists, contact H3C Support. |
RPS_NORMAL
|
Message text |
Pattern 1: RPS [INT32] is normal. Pattern 2: Chassis [STRING] RPS [INT32] is normal. |
|
Variable fields |
Pattern 1: $1: RPS number. Pattern 2: $1: Chassis number. $2: RPS number. |
|
Severity level |
5 |
|
Example |
DEV/5/RPS_NORMAL: RPS 1 is normal. |
|
Explanation |
The RPS started to operate correctly after it was installed. |
|
Recommended action |
No action is required. |
SUBCARD_FAULT
|
Message text |
Subcard state changed to Fault on [STRING] subslot [INT32], type is [STRING]. |
|
Variable fields |
$1: Chassis number and slot number or slot number. $2: Subslot number. $3: Subcard type. |
|
Severity level |
2 |
|
Example |
DEV/2/SUBCARD_FAULT: Subcard state changed to Fault on slot 1 subslot 1, type is MIM-1ATM-OC3SML. |
|
Explanation |
The subcard failed, or its status changed to Fault after it was rebooted. |
|
Recommended action |
Track the status of the subcard. · If the status of the subcard changes to Normal later, no action is required. · If the status is always Fault, replace the subcard. |
SUBCARD_INSERTED
|
Message text |
Subcard was inserted in [STRING] subslot [INT32], type is [STRING]. |
|
Variable fields |
$1: Chassis number and slot number or slot number. $2: Subslot number. $3: Subcard type. |
|
Severity level |
4 |
|
Example |
DEV/4/SUBCARD_INSERTED: Subcard was inserted in slot 1 subslot 1, type is MIM-1ATM-OC3SML. |
|
Explanation |
A subcard was installed. |
|
Recommended action |
No action is required. |
SUBCARD_REBOOT
|
Message text |
Subcard is rebooting on [STRING] subslot [INT32]. |
|
Variable fields |
$1: Chassis number and slot number or slot number. $2: Subslot number. |
|
Severity level |
5 |
|
Example |
DEV/5/SUBCARD_REBOOT: Subcard is rebooting on slot 1 subslot 1. |
|
Explanation |
The subcard was manually or automatically rebooted. |
|
Recommended action |
· If the subcard operates correctly after it starts up, no action is required. · If you want to know the reboot reason or the subcard keeps rebooting, contact H3C Support. |
SUBCARD_REMOVED
|
Message text |
Subcard was removed from [STRING] subslot [INT32], type is [STRING]. |
|
Variable fields |
$1: Chassis number and slot number or slot number. $2: Subslot number. $3: Subcard type. |
|
Severity level |
3 |
|
Example |
DEV/3/SUBCARD_REMOVED: Subcard was removed from slot 1 subslot 1, type is MIM-1ATM-OC3SML. |
|
Explanation |
A subcard was removed. |
|
Recommended action |
If the subcard was not manually removed, perform the following tasks: 1. Verify that the subcard is securely seated. 2. Replace the subcard if the message persists. 3. If the issue persists, contact H3C Support. |
SYSTEM_REBOOT
|
Message text |
System is rebooting now. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
DEV/4/SYSTEM_REBOOT: System is rebooting now. |
|
Explanation |
The system was manually or automatically rebooted. |
|
Recommended action |
If an unexpected automatic reboot occurred, perform the following tasks: 1. Execute the display version command after the system starts up. 2. Check the Last reboot reason field for the reboot reason. 3. If an exception caused the reboot, contact H3C Support. |
TEMPERATURE_ALARM
|
Message text |
Pattern 1: Temperature is greater than the high-temperature alarming threshold on sensor [STRING] [USHOT]. Pattern 2: Temperature is greater than the high-temperature alarming threshold on [STRING] sensor [STRING] [USHOT]. Pattern 3: Temperature is greater than the high-temperature alarming threshold on [STRING] [STRING] sensor [STRING] [USHOT]. |
|
Variable fields |
Pattern 1: $1: Sensor type. $2: Sensor number. Pattern 2: $1: Slot number. $2: Sensor type. $3: Sensor number. Pattern 3: $1: Chassis number. $2: Slot number. $3: Sensor type. $4: Sensor number. |
|
Severity level |
4 |
|
Example |
DEV/4/TEMPERATURE_ALARM: Temperature is greater than the high-temperature alarming threshold on slot 1 sensor inflow 1. |
|
Explanation |
A sensor's temperature exceeded the high-temperature alarming threshold. The ambient temperature was too high or the fan tray was not operating correctly. |
|
Recommended action |
1. Verify that the ambient temperature is normal and the ventilation system is operating correctly. 2. Use the display fan command to verify that the fan trays are in position and operating correctly. If a fan tray is missing, install the fan tray. If a fan tray does not operate correctly, replace it. |
TEMPERATURE_ALARM_CLEAR
|
Message text |
Temperature alarm cleared. (PhysicalIndex=<[UINT]>, PhysicalName=<[STRING]>, RelativeResource=<[STRING]>, ErrorCode=<[UINT]>, Reason=<[STRING]> , ThresholdType=<[STRING]>, ThresholdValue=<[STRING]>, CurrentValue=<[STRING]>) |
|
Variable fields |
$1: Entity index. $2: Entity name. $3: Fault location information. $4: Fault code. $5: Fault description. $6: Threshold type. $7: Threshold value. $8: Current value. |
|
Severity level |
2 |
|
Example |
DEV/2/TEMPERATURE_ALARM_CLEAR: Temperature alarm cleared. (PhysicalIndex=4011, PhysicalName=Temperature Sensor 1 on Board 0, RelativeResource=0/0, ErrorCode=433009, Reason=Board temperature restored, ThresholdType=LowAlarm, ThresholdValue=7, CurrentValue=31.) |
|
Explanation |
A low-temperature alarm was cleared. |
|
Recommended action |
No action is required. |
TEMPERATURE_ALARM_OCCUR
|
Message text |
Temperature alarm occurred. (PhysicalIndex=<[UINT]>, PhysicalName=<[STRING]>, RelativeResource=<[STRING]>, ErrorCode=<[UINT]>, Reason=<[STRING]> , ThresholdType=<[STRING]>, ThresholdValue=<[STRING]>, CurrentValue=<[STRING]>) |
|
Variable fields |
$1: Entity index. $2: Entity name. $3: Fault location information. $4: Fault code. $5: Fault description. $6: Threshold type. $7: Threshold value. $8: Current value. |
|
Severity level |
2 |
|
Example |
DEV/2/TEMPERATURE_ALARM_OCCUR: Temperature alarm occurred. (PhysicalIndex=4011, PhysicalName=Temperature Sensor 1 on Board 0, RelativeResource=0/0, ErrorCode=433009, Reason=Board temperature out of range, ThresholdType=LowAlarm, ThresholdValue=7, CurrentValue=3.) |
|
Explanation |
A low-temperature alarm occurred. |
|
Recommended action |
Verify that the ambient temperature is normal. |
TEMPERATURE_LOW
|
Message text |
Pattern 1: Temperature is less than the low-temperature threshold on sensor [STRING] [INT32]. Pattern 2: Temperature is less than the low-temperature threshold on [STRING] sensor [STRING] [INT32]. Pattern 3: Temperature is less than the low-temperature threshold on [STRING] [STRING] sensor [STRING] [INT32]. |
|
Variable fields |
Pattern 1: $1: Sensor type. $2: Sensor number. Pattern 2: $1: Slot number. $2: Sensor type. $3: Sensor number. Pattern 3: $1: Chassis number. $2: Slot number. $3: Sensor type. $4: Sensor number. |
|
Severity level |
4 |
|
Example |
DEV/4/TEMPERATURE_LOW: Temperature is less than the low-temperature threshold on slot 1 sensor inflow 1. |
|
Explanation |
A sensor's temperature fell below the low-temperature threshold. |
|
Recommended action |
Adjust the ambient temperature higher. |
TEMPERATURE_NORMAL
|
Message text |
Pattern 1: Temperature changed to normal on sensor [STRING] [INT32]. Pattern 2: Temperature changed to normal on [STRING] sensor [STRING] [INT32]. Pattern 3: Temperature changed to normal on [STRING] [STRING] sensor [STRING] [INT32]. |
|
Variable fields |
Pattern 1: $1: Sensor type. $2: Sensor number. Pattern 2: $1: Slot number. $2: Sensor type. $3: Sensor number. Pattern 3: $1: Chassis number. $2: Slot number. $3: Sensor type. $4: Sensor number. |
|
Severity level |
4 |
|
Example |
DEV/4/TEMPERATURE_NORMAL: Temperature changed to normal on slot 1 sensor inflow 1. |
|
Explanation |
A sensor's temperature was normal (between the low-temperature threshold and the high-temperature warning threshold). |
|
Recommended action |
No action is required. |
TEMPERATURE_POWEROFF
|
Message text |
Powering off [STRING]: Temperature exceeded the shutdown threshold. |
|
Variable fields |
$1: Chassis number and slot number or slot number. |
|
Severity level |
2 |
|
Example |
DEV/2/TEMPERATURE_POWEROFF: Powering off slot 1: Temperature exceeded the shutdown threshold. |
|
Explanation |
The specified slot was powered off because the sensor's temperature exceeded the shutdown threshold. |
|
Recommended action |
1. Verify that the ambient temperature is normal and the ventilation system is operating correctly. 2. Use the display fan command to verify that the fan trays are in position and operating correctly. If a fan tray is missing, install the fan tray. If a fan tray does not operate correctly, replace it. 3. Power on the slot manually. |
TEMPERATURE_SHUTDOWN
|
Message text |
Pattern 1: Temperature is greater than the high-temperature shutdown threshold on sensor [STRING] [INT32]. The slot will be powered off automatically. Pattern 2: Temperature is greater than the high-temperature shutdown threshold on [STRING] sensor [STRING] [INT32]. The slot will be powered off automatically. Pattern 3: Temperature is greater than the high-temperature shutdown threshold on [STRING] [STRING] sensor [STRING] [INT32]. The slot will be powered off automatically. |
|
Variable fields |
Pattern 1: $1: Sensor type. $2: Sensor number. Pattern 2: $1: Slot number. $2: Sensor type. $3: Sensor number. Pattern 3: $1: Chassis number. $2: Slot number. $3: Sensor type. $4: Sensor number. |
|
Severity level |
2 |
|
Example |
DEV/2/TEMPERATURE_SHUTDOWN: Temperature is greater than the high-temperature shutdown threshold on slot 1 sensor inflow 1. The slot will be powered off automatically. |
|
Explanation |
A sensor's temperature exceeded the high-temperature shutdown threshold. The ambient temperature was too high or the fan tray was not operating correctly. |
|
Recommended action |
1. Verify that the ambient temperature is normal and the ventilation system is operating correctly. 2. Use the display fan command to verify that the fan trays are in position and operating correctly. If a fan tray is missing, install the fan tray. If a fan tray does not operate correctly, replace it. |
TEMPERATURE_WARNING
|
Message text |
Pattern 1: Temperature is greater than the high-temperature warning threshold on sensor [STRING] [INT32]. Pattern 2: Temperature is greater than the high-temperature warning threshold on [STRING] sensor [STRING] [INT32]. Pattern 3: Temperature is greater than the high-temperature warning threshold on [STRING] [STRING] sensor [STRING] [INT32]. |
|
Variable fields |
Pattern 1: $1: Sensor type. $2: Sensor number. Pattern 2: $1: Slot number. $2: Sensor type. $3: Sensor number. Pattern 3: $1: Chassis number. $2: Slot number. $3: Sensor type. $4: Sensor number. |
|
Severity level |
4 |
|
Example |
DEV/4/TEMPERATURE_WARNING: Temperature is greater than the high-temperature warning threshold on slot 1 sensor inflow 1. |
|
Explanation |
A sensor's temperature exceeded the high-temperature warning threshold. The ambient temperature was too high or the fan tray was not operating correctly. |
|
Recommended action |
1. Verify that the ambient temperature is normal and the ventilation system is operating correctly. 2. Use the display fan command to verify that the fan trays are in position and operating correctly. If a fan tray is missing, install the fan tray. If a fan tray does not operate correctly, replace it. |
TIMER_CREATE_FAILED_FIRST
|
Message text |
The process with PID [UINT] failed to create a timer. Reason for the failure:[STRING]. |
|
Variable fields |
$1: PID of the process. $2: Reason for the first timer creation failure. The value is "Maximum number of timers already reached." |
|
Severity level |
4 |
|
Example |
DEV/4/TIMER_CREATE_FAILED_FIRST: The process with PID 70 failed to create a timer. Reason for the failure: Maximum number of timers already reached. |
|
Explanation |
The system outputs this message when a process fails to create a timer for the first time. The system uses the following mechanism to avoid frequent output of messages that report timer creation failures: · The system outputs a TIMER_CREATE_FAILED_FIRST message when a process fails to create a timer for the first time. · If a timer creation failure occurs again 15 minutes after the first failure, the system outputs a TIMER_CREATE_FAILED_MORE message. · The TIMER_CREATE_FAILED_MORE message records last time when the timer creation failure message was generated, and the number of timer creation failures between the last and current messages that report timer creation failures. The system does not generate log messages about timer creation failures that occurred within the 15 minutes. |
|
Recommended action |
1. Restart the device to recover the service module corresponding to the process. 2. If the issue persists, contact H3C Support. |
TIMER_CREATE_FAILED_MORE
|
Message text |
The process with PID [UINT] failed to create a timer:[UINT] consecutive failures since [STRING].Reason for the failure:[STRING]. |
|
Variable fields |
$1: PID of the process. $2: Number of timer creation failures between the last and current messages that report time creation failures. $3: Last time when the creation failure log message was generated. $4: Reason for this timer creation failure. The value is "Maximum number of timers already reached." |
|
Severity level |
4 |
|
Example |
DEV/4/TIMER_CREATE_FAILED_MORE: The process with PID 70 failed to create a timer:2 consecutive failures since 2019/11/21 16:00:00.Reason for the failure: Maximum number of timers already reached. |
|
Explanation |
The system outputs this message when a process fails to create a timer again 15 minutes after the first-time creation failure. The system uses the following mechanism to avoid frequent output of messages that report timer creation failures: · The system outputs a TIMER_CREATE_FAILED_FIRST message when a process fails to create a timer for the first time. · If a timer creation failure occurs again 15 minutes after the first failure, the system outputs a TIMER_CREATE_FAILED_MORE message. · The TIMER_CREATE_FAILED_MORE message records last time when the timer creation failure message was generated, and the number of timer creation failures between the last and current messages that report timer creation failures. The system does not generate log messages about timer creation failures that occurred within the 15 minutes. |
|
Recommended action |
1. Restart the device to recover the service module corresponding to the process. 2. If the issue persists, contact H3C Support. |
VCHK_VERSION_INCOMPATIBLE
|
Message text |
Software version of [STRING] is incompatible with that of the MPU. |
|
Variable fields |
$1: Chassis number and slot number or slot number. |
|
Severity level |
1 |
|
Example |
DEV/1/VCHK_VERSION_INCOMPATIBLE: Software version of slot 1 is incompatible with that of the MPU. |
|
Explanation |
A PEX that was starting up detected that its software version is incompatible with the parent device's software version. |
|
Recommended action |
Specify a set of startup software images for the PEX. Make sure the images are compatible with the parent device's software images. |
VOLTAGE_ALARM_CLEAR
|
Message text |
Voltage alarm cleared. (PhysicalIndex=<[UINT]>, PhysicalName=<[STRING]>, RelativeResource=<[STRING]>, ErrorCode=<[UINT]>, Reason=<[STRING]>) |
|
Variable fields |
$1: Entity index. $2: Entity name. $3: Fault location information. $4: Fault code. $5: Fault description. $6: Threshold type. $7: Threshold value. $8: Current value. |
|
Severity level |
2 |
|
Example |
DEV/2/VOLTAGE_ALARM_CLEAR: Voltage alarm cleared. (PhysicalIndex=199, PhysicalName=Voltage 2, RelativeResource=0, ErrorCode=420003, Reason=Voltage fell below the high output voltage warning threshold. ) |
|
Explanation |
A high voltage alarm was cleared. |
|
Recommended action |
No action is required. |
VOLTAGE_ALARM_OCCUR
|
Message text |
Voltage alarm occurred. (PhysicalIndex=<[UINT]>, PhysicalName=<[STRING]>, RelativeResource=<[STRING]>, ErrorCode=<[UINT]>, Reason=<[STRING]> , ThresholdType=<[STRING]>, ThresholdValue=<[STRING]>, CurrentValue=<[STRING]>) |
|
Variable fields |
$1: Entity index. $2: Entity name. $3: Fault location information. $4: Fault code. $5: Fault description. $6: Threshold type. $7: Threshold value. $8: Current value. |
|
Severity level |
2 |
|
Example |
DEV/2/VOLTAGE_ALARM_OCCUR: Voltage alarm occurred. (PhysicalIndex=4043, PhysicalName=Voltage Sensor 0 on Board 0, RelativeResource=0/0, ErrorCode=420005, Reason=Voltage exceeded the high output voltage shutdown threshold., ThresholdType=LowAlarm, ThresholdValue=1031, CurrentValue=0.) |
|
Explanation |
A high voltage alarm occurred. |
|
Recommended action |
Contact H3C Support. |
VOLTAGE_FATALALARM_CLEAR
|
Message text |
Voltage fatal alarm cleared. (PhysicalIndex=<[UINT]>, PhysicalName=<[STRING]>, RelativeResource=<[STRING]>, ErrorCode=<[UINT]>, Reason=<[STRING]> , ThresholdType=<[STRING]>, ThresholdValue=<[STRING]>, CurrentValue=<[STRING]>) |
|
Variable fields |
$1: Entity index. $2: Entity name. $3: Fault location information. $4: Fault code. $5: Fault description. $6: Threshold type. $7: Threshold value in units. $8: Current value in units. |
|
Severity level |
1 |
|
Example |
DEV/1/VOLTAGE_FATALALARM_CLEAR: Voltage fatal alarm cleared. (PhysicalIndex=5683, PhysicalName=Voltage Sensor 2 on Board 14, RelativeResource=0/14, ErrorCode=420001, Reason= Board powered up, ThresholdType=HighAlarm, ThresholdValue= INVALID, CurrentValue= INVALID) |
|
Explanation |
A fatal voltage alarm was cleared. |
|
Recommended action |
No action is required. |
VOLTAGE_FATALALARM_OCCUR
|
Message text |
Voltage fatal alarm occurred. (PhysicalIndex=<[UINT]>, PhysicalName=<[STRING]>, RelativeResource=<[STRING]>, ErrorCode=<[UINT]>, Reason=<[STRING]> , ThresholdType=<[STRING]>, ThresholdValue=<[STRING]>, CurrentValue=<[STRING]>) |
|
Variable fields |
$1: Entity index. $2: Entity name. $3: Fault location information. $4: Fault code. $5: Fault description. $6: Threshold type. $7: Threshold value in units. $8: Current value in units. |
|
Severity level |
1 |
|
Example |
DEV/1/VOLTAGE_FATALALARM_OCCUR: Voltage fatal alarm occurred. (PhysicalIndex=5683, PhysicalName=Voltage Sensor 2 on Board 14, RelativeResource=0/14, ErrorCode=420001, Reason=Board failed to power up, ThresholdType=HighAlarm, ThresholdValue=INVALID, CurrentValue= INVALID) |
|
Explanation |
A fatal voltage alarm occurred. |
|
Recommended action |
1. Execute the display voltage command to verify that the power supply information meets the requirements of the device. 2. If the issue persists, contact H3C Support. |
DEVD
This section contains DEVD messages.
BRD_NOT_CMPT
|
Message text |
The board installed in slot [UINT32] cannot start up. The board model is different from the preprovisioned model. |
|
Variable fields |
$1: Slot number of the card. |
|
Severity level |
3 (Error) |
|
Example |
DEVD/3/BRD_NOT_CMPT: -MDC=1; The board installed in slot 8 cannot start up. The board model is different from the preprovisioned model. |
|
Impact |
The card cannot start up. |
|
Cause |
The specified card cannot start up because the model of the card is different from the preprovisioned model. |
|
Recommended action |
1. Replace the card with a card of the preprovisioned model. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
RSA_SET_RESULT
|
Message text |
Check can't pass! |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
DEVD/4/RSA_SET_RESULT: Check can't pass! |
|
Impact |
The card reboot might occur. |
|
Cause |
This message is generated when software images do not exist or are invalid. |
|
Recommended action |
Upload valid software images. |
DHCP
This section contains DHCP messages.
DHCP_NOTSUPPORTED
|
Message text |
Failed to apply filtering rules for DHCP packets because some rules are not supported. |
|
Variable fields |
N/A |
|
Severity level |
3 |
|
Example |
DHCP/3/DHCP_NOTSUPPORTED: Failed to apply filtering rules for DHCP packets because some rules are not supported. |
|
Explanation |
The system failed to apply filtering rules for DHCP packets because some rules are not supported on the device. |
|
Recommended action |
No action is required. |
DHCP_NORESOURCES
|
Message text |
Failed to apply filtering rules for DHCP packets because hardware resources are insufficient. |
|
Variable fields |
N/A |
|
Severity level |
3 |
|
Example |
DHCP/3/DHCP_NORESOURCES: Failed to apply filtering rules for DHCP packets because hardware resources are insufficient. |
|
Explanation |
The system failed to apply filtering rules for DHCP packets because the hardware resources are insufficient. |
|
Recommended action |
Release hardware resources and then apply the rules again. |
DHCPR
This section contains DHCP relay agent messages.
DHCPR_INVALIDPACKET
|
Message text |
Invalid BOOTP packet received: [STRING]. |
|
Variable fields |
$1: Reason why the packet is invalid: · Invalid packet type. · Invalid giaddr. · Invalid magic cookie. |
|
Severity level |
3 |
|
Example |
DHCPR/3/DHCPR_INVALIDPACKET: Invalid BOOTP packet received: Invalid packet type. |
|
Explanation |
The DHCP relay agent received an invalid BOOTP packet. |
|
Recommended action |
Check the source of the invalid BOOTP packet. |
DHCPR_PACKETLARGEHOP
|
Message text |
BOOTP request discarded: Hop limit exceeded. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
DHCPR/4/DHCPR_PACKETLARGEHOP: BOOTP request discarded: hop limit exceeded. |
|
Explanation |
The DHCP relay agent discarded a BOOTP request because of hop limit exceeding. |
|
Recommended action |
Check the source of the BOOTP request and the link between the client and the DHCP relay agent. |
DHCPR_SERVERCHANGE
|
Message text |
Switched to the server of pool [STRING] at [IPADDR] because the current server did not respond. Switched to the server of interface [STRING] at [IPADDR] because the current server did not respond. |
|
Variable fields |
$1: IP pool on the relay agent. $2: IP address of the DHCP server. $3: Interface enabled with the DHCP relay agent. |
|
Severity level |
3 |
|
Example |
DHCPR/3/DHCPR_SERVERCHANGE: -MDC=1; Switched to the server of pool 1 at 2.2.2.2 because the current server did not respond. DHCPR/3/DHCPR_SERVERCHANGE: -MDC=1; Switched to the server of interface GigabitEthernet1/0/1 at 2.2.2.2 because the current server did not respond. |
|
Explanation |
The DHCP relay agent did not receive any responses from the current DHCP server and switched to another DHCP server for IP address acquisition. |
|
Recommended action |
No action is required. |
DHCPR_SERVERNORESPONSE
|
Message text |
No response received from DHCP server ( [IPADDR] in [STRING], pool [STRING] ) because of the reason: [STRING]. |
|
Variable fields |
$1: IP address of the DHCP server. $2: VPN instance name. This field displays N/A for the public network. $3: Name of the IP address pool. $4: Reason why the DHCP server did not respond: · No route to the DHCP server—No route to the DHCP server exists. · DHCP server too busy—The DHCP server was too busy. · DHCP server pool exhausted—The DHCP server had no assignable IP resources. |
|
Severity level |
4 |
|
Example |
|
|
Explanation |
The DHCP relay agent received no response from the DHCP server. |
|
Recommended action |
Check the IP address pool configuration on the DHCP server and the link between the DHCP server and the DHCP relay agent. |
DHCPR_SWITCHMASTER
|
Message text |
Switched to the master DHCP server at [IPADDR]. |
|
Variable fields |
$1: IP address of the master DHCP server. |
|
Severity level |
3 |
|
Example |
DHCPR/3/DHCPR_SWITCHMASTER: -MDC=1; Switched to the master DHCP server at 2.2.2.2. |
|
Explanation |
After a switchback delay time, the DHCP relay agent switched from a backup DHCP server back to the master DHCP server for IP address acquisition. |
|
Recommended action |
No action is required. |
DHCPR6
This section contains DHCPv6 relay agent messages.
DHCPR6_SERVERNORESPONSE
|
Message text |
No response received from DHCP server ( [IPADDR] in [STRING], pool [STRING] ) because of the reason: [STRING]. |
|
Variable fields |
$1: IP address of the DHCPv6 server. $2: VPN instance name. This field displays N/A for the public network. $3: Name of the IPv6 address pool. $4: Reason why the DHCPv6 server did not respond: · No route to the DHCPv6 server—No route to the DHCPv6 server exists. · DHCPv6 server too busy—The DHCPv6 server was too busy. · DHCPv6 server pool exhausted—The DHCPv6 server had no assignable IPv6 addresses. · DHCPv6 server prefix exhausted—The DHCPv6 server had no assignable IPv6 prefixes. |
|
Severity level |
4 |
|
Example |
DHCPR6/6/ DHCPR6_SERVERNORESPONSE: No response received from DHCP server ( 10::1 in vpn1, pool pool1 ) because of the reason: No route to the DHCPv6 server. |
|
Explanation |
The DHCPv6 relay agent received no response from the DHCPv6 server. |
|
Recommended action |
Check the IPv6 address pool configuration on the DHCPv6 server and the link between the DHCPv6 server and the DHCPv6 relay agent. |
DHCPS messages
This section contains DHCP server messages.
DHCPS_ALLOCATE_IP
|
Message text |
DHCP server received a DHCP client's request packet on interface [STRING], and allocated an IP address [IPADDR](lease [UINT32] seconds) for the DHCP client(MAC [MAC]) from [STRING] pool. |
|
Variable fields |
$1: Name of the interface on which the DHCP server is configured. $2: IPv4 address assigned to the DHCP client. $3: Lease duration of the assigned IPv4 address. $4: MAC address of the DHCP client. $5: Name of the IP pool to which the assigned IPv4 address belongs. |
|
Severity level |
5 |
|
Example |
DHCPS/5/DHCPS_ALLOCATE_IP: DHCP server received a DHCP client’s request packet on interface GigabitEthernet1/0/2, and allocated an IP address 1.0.0.91(lease 86400 seconds) for the DHCP client(MAC 0000-0000-905a) from p1 pool. |
|
Explanation |
The DHCP server assigned an IPv4 address with a lease to a DHCP client. |
|
Recommended action |
No action is required. |
DHCPS_ALLOC_USERIP_FAILED
|
Message text |
IP allocation failed in domain [STRING] because of the reason: [STRING]. |
|
Variable fields |
$1: Name of the ISP domain. $2: Reason why the DHCP server failed the IP allocation: · UP information mismatch. · No authorized pool or pool-group exists or the interface is not on the network specified for the matching pool. · No free lease in the matching pool or pool-group. · Creating lease failed. · Pool misconfiguration on the relay agent. · Other. |
|
Severity level |
4 |
|
Example |
DHCPS/4/DHCPS_ALLOC_USERIP_FAILED: IP allocation failed in domain domain1 because of the reason: UP information mismatch. |
|
Explanation |
The DHCP server failed to assign an IP address to a DHCP client. |
|
Recommended action |
Check the IP address pool configuration on the DHCP server and the DHCP relay agent. |
DHCPS_CONFLICT_IP
|
Message text |
A conflict IP [IPADDR] from [STRING] pool was detected by DHCP server on interface [STRING]. |
|
Variable fields |
$1: IPv4 address that is in conflict. $2: Name of the IP pool to which the conflicting IPv4 address belongs. $3: Name of the interface on which DHCP server is configured. |
|
Severity level |
5 |
|
Example |
DHCPS/5/DHCPS_CONFLICT_IP: A conflict IP 100.1.1.1 from p1 pool was detected by DHCP server on interface GigabitEthernet1/0/2. |
|
Explanation |
The DHCP server deleted a conflicting IPv4 address from an IP pool. |
|
Recommended action |
No action is required. |
DHCPS_EXTEND_IP
|
Message text |
DHCP server received a DHCP client's request packet on interface [STRING], and extended lease from [STRING] pool for the DHCP client (IP [IPADDR], MAC [MAC]). |
|
Variable fields |
$1: Name of the interface on which DHCP server is configured. $2: Name of the IP pool to which the client's IPv4 address belongs. $3: IPv4 address of the DHCP client. $4: MAC address of the DHCP client. |
|
Severity level |
5 |
|
Example |
DHCPS/5/DHCPS_EXTEND_IP: DHCP server received a DHCP client’s request packet on interface GigabitEthernet1/0/2, and extended lease from p1 pool for the DHCP client (IP 1.0.0.91, MAC 0000-0000-905a). |
|
Explanation |
The DHCP server extended the lease for a DHCP client. |
|
Recommended action |
No action is required. |
DHCPS_FILE
|
Message text |
Failed to save DHCP client information due to lack of storage resources. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
DHCPS/4/DHCPS_FILE: Failed to save DHCP client information due to lack of storage resources. |
|
Explanation |
The DHCP server failed to back up DHCP bindings to the backup file due to lack of storage resources. |
|
Recommended action |
Delete unnecessary files to release resources. |
DHCPS_NET_THRESHOLD_EXCEED
|
Message text |
The subnet usage of address pool [STRING] has reached or exceeded the threshold. |
|
Variable fields |
$1: IP address pool name. |
|
Severity level |
5 |
|
Example |
DHCPS/5/DHCPS_NET_THRESHOLD_EXCEED: The subnet usage of address pool pool1 has reached or exceeded the threshold. |
|
Explanation |
The subnet usage of the IP pool has reached or exceeded the threshold. |
|
Recommended action |
Replan address resources in the IP pool. |
DHCPS_NET_THRESHOLD_REC
|
Message text |
The subnet usage of pool [STRING] has descended to or dropped below 90% of the threshold. |
|
Variable fields |
$1: IP address pool name. |
|
Severity level |
5 |
|
Example |
DHCPS/5/DHCPS_NET_THRESHOLD_REC: The subnet usage of pool [STRING] has descended to or dropped below 90% of the threshold. |
|
Explanation |
The subnet usage of the IP pool has dropped to or below 90% of the threshold. |
|
Recommended action |
N/A |
DHCPS_NET_EXHAUST
|
Message text |
Address pool [STRING] has run out of assignable subnets. |
|
Variable fields |
$1: IP address pool name. |
|
Severity level |
4 |
|
Example |
DHCPS/4/DHCPS_NET_EXHAUST: Address pool pool1 has run out of assignable subnets. |
|
Explanation |
The subnet usage of the IP pool has reached 100%. |
|
Recommended action |
Replan address resources in the IP pool. |
DHCPS_NET_EXHAUSTREC
|
Message text |
The subnet usage of pool [STRING] has descended to or dropped below 90%. |
|
Variable fields |
$1: IP address pool name. |
|
Severity level |
5 |
|
Example |
DHCPS/5/DHCPS_NET_EXHAUSTREC: The subnet usage of pool [STRING] has descended to or dropped below 90%. |
|
Explanation |
The subnet usage of the IP pool has dropped to or below 90%. |
|
Recommended action |
N/A |
DHCPS_POOLGP_EXHAUSTION
|
Message text |
Pool group [STRING] has run out of IP addresses. |
|
Variable fields |
$1: Name of the IP address pool group. |
|
Severity level |
4 |
|
Example |
DHCPS/4/DHCPS_POOLGP_EXHAUSTION: Pool group group1 has run out of IP addresses. |
|
Explanation |
The IP address pool group has run out of IP addresses. |
|
Recommended action |
Replan the address resource of the IP address pool group. |
DHCPS_POOLGP_EXHAUSTION_RECOV
|
Message text |
IP address usage of pool group [STRING] has dropped to or below 90%. |
|
$1: Name of the IP address pool group. |
|
|
Severity level |
4 |
|
Example |
DHCPS/4/DHCPS_POOLGP_EXHAUSTION_RECOV: IP address usage of pool group group1 has dropped to or below 90%. |
|
The IP address usage of the IP address pool group has dropped to or below 90%. |
|
|
Recommended action |
DHCPS_POOLGP_THRESHOLD_EXCEED
|
Message text |
IP address usage of pool group [STRING] has exceeded the threshold. |
|
Variable fields |
$1: Name of the IP address pool group. |
|
Severity level |
4 |
|
Example |
DHCPS/4/DHCPS_POOLGP_THRESHOLD_EXCEED: IP address usage of pool group group1 has exceeded the threshold. |
|
The IP address usage of the IP address pool group has exceeded the threshold. |
|
|
Recommended action |
Replan the address resource of the IP address pool group. |
DHCPS_POOLGP_THRESHOLD_RECOV
|
Message text |
IP address usage of pool group [STRING] has dropped to or below 90% of the threshold. |
|
Variable fields |
$1: Name of the IP address pool group. |
|
Severity level |
4 |
|
Example |
DHCPS/4/DHCPS_POOLGP_THRESHOLD_RECOV: IP address usage of pool group group1 has dropped to or below 90% of the threshold. |
|
Explanation |
The IP address usage of the IP address pool group has dropped to or below 90% of the threshold. |
|
Recommended action |
No action is required. |
DHCPS_RECLAIM_IP
|
Message text |
DHCP server reclaimed a [STRING] pool’s lease(IP [IPADDR], lease [UINT32] seconds), which is allocated for the DHCP client (MAC [MAC]). |
|
Variable fields |
$1: Name of the IP pool to which the assigned IPv4 address belongs. $2: IPv4 address assigned to the DHCP client. $3: Lease duration of the assigned IPv4 address. $4: MAC address of the DHCP client. |
|
Severity level |
5 |
|
Example |
DHCPS/5/DHCPS_RECLAIM_IP: DHCP server reclaimed a p1 pool’s lease(IP 1.0.0.91, lease 86400 seconds), which is allocated for the DHCP client (MAC 0000-0000-905a). |
|
Explanation |
The DHCP server reclaimed the IPv4 address assigned to a DHCP client. |
|
Recommended action |
No action is required. |
DHCPS_ROUTE_ADD
|
Message text |
UNR route ( Destination [STRING], Nexthop [STRING], Tunnel-destination [STRING] ) added for pool [STRING]. |
|
Variable fields |
$1: Destination network. $2: Next hop of the network route. $3: Destination of the tunnel. If no tunnel is configured, this field displays N/A. $4: Name of the IP address pool. |
|
Severity level |
6 |
|
Example |
DHCPS/6/DHCPS_ROUTE_ADD: UNR route ( Destination 10.1.1.1/24, Nexthop 0.0.0.0, Tunnel-destination N/A ) added for pool pool1. |
|
Explanation |
The local device has generated a UNR for the IP address pool. |
|
Recommended action |
No action is required. |
DHCPS_ROUTE_DEL
|
Message text |
UNR route ( Destination [STRING], Nexthop [STRING], Tunnel-destination [STRING] ) deleted for pool [STRING]. |
|
Variable fields |
$1: Destination network. $2: Next hop of the network route. $3: Destination of the tunnel. If no tunnel is configured, this field displays N/A. $4: Name of the IP address pool. |
|
Severity level |
6 |
|
Example |
DHCPS/6/DHCPS_ROUTE_DEL: UNR route ( Destination 10.1.1.1/24, Nexthop 0.0.0.0, Tunnel-destination N/A ) deleted for pool pool1. |
|
A UNR issued for the IP address pool was deleted as the corresponding network was deleted. |
|
|
Recommended action |
No action is required. |
DHCPS_ROUTE_UPADD
|
Message text |
Issued UNR route ( Destination [STRING], Nexthop [STRING], Tunnel-destination [STRING] ) for pool [STRING] to UP [UINT]. |
|
Variable fields |
$1: Destination network. $2: Next hop of the network route. $3: Destination of the tunnel. If no tunnel is configured, this field displays N/A. $4: Name of the IP address pool. |
|
Severity level |
6 |
|
Example |
DHCPS/6/DHCP_ROUTE_UPADD: Issued UNR route ( Destination 10.1.1.1/24, Nexthop 0.0.0.0, Tunnel-destination N/A ) for pool pool1 to UP 1024. |
|
After the CP assigns an IP address to a DHCP client, it issues a UNR for that client to the UP. The UNR can guide the downlink traffic of the client. |
|
|
Recommended action |
No action is required. |
DHCPS_ROUTE_UPDEL
|
Message text |
Delete UNR route ( Destination [STRING], Nexthop [STRING], Tunnel-destination [STRING] ) for pool [STRING] issued to UP [UINT]. |
|
Variable fields |
$1: Destination network. $2: Next hop of the network route. $3: Destination of the tunnel. If no tunnel is configured, this field displays N/A. $4: Name of the IP address pool. $5: UP ID. |
|
Severity level |
6 |
|
Example |
DHCPS/6/DHCPS_ROUTE_UPDEL: Delete UNR route ( Destination 10.1.1.1/24, Nexthop 0.0.0.0, Tunnel-destination N/A ) for pool pool1 issued to UP 1024. |
|
Explanation |
The CP deleted a UNR issued to the UP because the corresponding network was deleted. |
|
Recommended action |
No action is required. |
DHCPS_ROUTE_SMOOTHSTART
|
Message text |
Route restore started. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
DHCPS/6/DHCPS_ROUTE_SMOOTHSTART: Route restore started. |
|
Explanation |
After the device or the process restarted, the device started restoring network routes issued for IP address pools. |
|
Recommended action |
No action is required. |
DHCPS_ROUTE_SMOOTHEND
|
Message text |
Route restore ended. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
DHCPS/6/DHCPS_ROUTE_SMOOTHEND: Route restore ended. |
|
Explanation |
The device finished restoring network routes issue for IP address pools. |
|
Recommended action |
No action is required. |
DHCPS_ROUTE_UPSMOOTHSTART
|
Message text |
The CP started synchronizing routes to UPs. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
DHCPS/6/DHCPS_ROUTE_UPSMOOTHSTART: The CP started synchronizing routes to UPs. |
|
Explanation |
The CP started synchronizing the network routes issued for IP address pools to UPs. |
|
Recommended action |
No action is required. |
DHCPS_ROUTE_UPSMOOTHEND
|
Message text |
The CP finished synchronizing routes to UPs. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
DHCPS/6/DHCPS_ROUTE_UPSMOOTHEND: The CP finished synchronizing routes to UPs. |
|
Explanation |
The CP finished synchronizing the network routes issued for IP address pools to UPs. |
|
Recommended action |
No action is required. |
DHCPS_THRESHOLD_EXCEED
|
Message text |
The IP address utilization of the address pool [STRING] has exceeded the threshold. |
|
Variable fields |
$1: IP pool name. |
|
Severity level |
4 |
|
Example |
DHCPS/4/DHCPS_THRESHOLD_EXCEED The IP address utilization of the address pool 1 has exceeded the threshold. |
|
Explanation |
The IP pool usage has exceeded the threshold. |
|
Recommended action |
Replan address resources in the IP pool. |
DHCPS_THRESHOLD_RECOVER
|
Message text |
The IP address usage of pool [STRING] has descended to 90% of the threshold. |
|
Variable fields |
$1: IP pool name. |
|
Severity level |
4 |
|
Example |
DHCPS/4/DHCPS_THRESHOLD_RECOVER: The IP address usage of pool 1 has descended to 90% of the threshold. |
|
Explanation |
The IP pool usage has descended to 90% of the threshold. |
|
Recommended action |
No action is required. |
DHCPS_VERIFY_CLASS
|
Message text |
Illegal DHCP client-PacketType=[STRING]-ClientAddress=[MAC]; |
|
Variable fields |
$1: Type of the packet. $2: Hardware address of the DHCP client. |
|
Severity level |
5 |
|
Example |
|
|
Explanation |
The DHCP server verified that the DHCP client was not on the user class whitelist. (vBRAS-CP devices do not support printing this log.) |
|
Recommended action |
Check the validity of the DHCP client. |
DHCPS_WARNING_EXHAUSTION
|
Message text |
Address pool [STRING] has run out of IP addresses. |
|
Variable fields |
$1: IP pool name. |
|
Severity level |
3 |
|
Example |
DHCPS/3/DHCPS_WARNING_EXHAUSTION: Address pool 1 has run out of IP addresses. |
|
Explanation |
The IP pool has run out of IP addresses. |
|
Recommended action |
Replan address resources in the IP pool. |
DHCPS_WARNING_EXHAUSTIONRECOVER
|
Message text |
The IP address usage of pool [STRING] has descend to 90%. |
|
Variable fields |
$1: IP pool name. |
|
Severity level |
4 |
|
Example |
DHCPS/4/DHCPS_WARNING_EXHAUSTION: The IP address usage of pool pool1 has descend to 90%. |
|
Explanation |
The IP address usage of that pool has dropped to or below 90%. |
|
Recommended action |
N/A |
DHCPS6 messages
This section contains DHCPv6 server messages.
DHCPS6_ALLOCATE_ADDRESS
|
Message text |
DHCPv6 server received a DHCPv6 client’s request packet on interface [STRING], and allocated an IPv6 address [IPADDR] (lease [UINT32] seconds) for the DHCP client(DUID [HEX], IAID [HEX]) from [STRING] pool. |
|
Variable fields |
$1: Name of the interface on which DHCPv6 server is configured. $2: IPv6 address assigned to the DHCPv6 client. $3: Lease duration of the assigned IPv6 address. $4: DUID of the DHCPv6 client. $5: IAID of the DHCPv6 client. $6: Name of the address pool to which the assigned IPv6 address belongs. |
|
Severity level |
5 |
|
Example |
DHCPS6/5/DHCPS6_ALLOCATE_ADDRESS: DHCPv6 server received a DHCPv6 client’s request packet on interface Ethernet0/2, and allocated an IPv6 address 2000::3(lease 60 seconds) for the DHCP client(DUID 0001000118137c37b4b52facab5a, IAID 10b4b52f) from p1 pool. |
|
Explanation |
The DHCPv6 server assigned an IPv6 address with a lease to a DHCPv6 client. |
|
Recommended action |
No action is required. |
DHCPS6_ALLOCATE_PREFIX
|
Message text |
DHCPv6 server received a DHCPv6 client’s request packet on interface [STRING], and allocated an IPv6 prefix [IPADDR] (lease [UINT32] seconds) for the DHCP client(DUID [HEX], IAID [HEX]) from [STRING] pool. |
|
Variable fields |
$1: Name of the interface on which DHCPv6 server is configured. $2: IPv6 prefix assigned to the DHCPv6 client. $3: Lease duration of the assigned IPv6 prefix. $4: DUID of the DHCPv6 client. $5: IAID of the DHCPv6 client. $6: Name of the address pool to which the assigned IPv6 prefix belongs. |
|
Severity level |
5 |
|
Example |
DHCPS6/5/DHCPS6_ALLOCATE_PREFIX: DHCPv6 server received a DHCPv6 client’s request packet on interface Ethernet0/2, and allocated an IPv6 prefix 2000::(lease 60 seconds) for the DHCP client(DUID 0001000118137c37b4b52facab5a, IAID 10b4b52f) from p1 pool. |
|
Explanation |
The DHCPv6 server assigned an IPv6 prefix with a lease to a DHCPv6 client. |
|
Recommended action |
No action is required. |
DHCPS6_ALLOC_USERIP_FAILED
|
Message text |
IPv6 allocation failed in domain [STRING] because of the reason: [STRING]. |
|
Variable fields |
$1: Name of the ISP domain. $2: Reason why the DHCPv6 server failed the IPv6 address allocation: · UP information mismatch. · No authorized pool or pool-group exists or the interface is not on the network specified for the matching pool. · No free lease in the matching pool or pool-group. · Creating lease failed. · Pool misconfiguration on the relay agent. · Other. |
|
Severity level |
4 |
|
Example |
DHCPS6/4/ DHCPS6_ALLOC_USERIP_FAILED: IPv6 allocation failed in domain domain1 because of the reason: UP information mismatch. |
|
Explanation |
The DHCPv6 server failed to assign an IPv6 address to a DHCPv6 client. |
|
Recommended action |
Check the IPv6 address pool configuration on the DHCPv6 server and the DHCPv6 relay agent. |
DHCPS6_ALLOC_USERPD_FAILED
|
Message text |
IPv6 prefix allocation failed in domain [STRING] because of the reason: [STRING]. |
|
Variable fields |
$1: Name of the ISP domain. $2: Reason why the DHCPv6 server failed the IPv6 prefix allocation: · UP information mismatch. · No authorized pool or pool-group exists or the interface is not on the network specified for the matching pool. · No free lease in the matching pool or pool-group. · No authorized pool or pool-group exists or the interface is not on the network specified for the matching pool. · No free lease in the matching pool or pool-group. · Creating lease failed. · Pool misconfiguration on the relay agent. · Other. |
|
Severity level |
4 |
|
Example |
DHCPS6/4/ DHCPS6_ALLOC_USERIP_FAILED: IPv6 prefix allocation failed in domain domain1 because of the reason: UP information mismatch. |
|
Explanation |
The DHCPv6 server failed to assign an IPv6 prefix to a DHCPv6 client. |
|
Recommended action |
Check the IPv6 address pool configuration on the DHCPv6 server and the DHCPv6 relay agent. |
DHCPS6_CONFLICT_ADDRESS
|
A conflict IPv6 address [IPADDR] from [STRING] pool was detected by DHCPv6 server on interface [STRING]. |
|
|
Variable fields |
$1: IPv6 address that is in conflict. $2: Name of the address pool to which the conflicting IPv6 address belongs. $3: Name of the interface on which DHCPv6 server is configured. |
|
Severity level |
5 |
|
Example |
DHCPS6/5/DHCPS6_CONFLICT_ADDRESS: A conflict IPv6 address 33::1 from p1 pool was detected by DHCPv6 server on interface Ethernet0/2. |
|
Explanation |
The DHCPv6 server deleted a conflicting IPv6 address from an address pool. |
|
Recommended action |
No action is required. |
DHCPS6_EXTEND_ADDRESS
|
Message text |
DHCPv6 server received a DHCP client’s request packet on interface [STRING], and extended lease from [STRING] pool for the DHCP client (IPv6 address [IPADDR], DUID [HEX], IAID [HEX]). |
|
Variable fields |
$1: Name of the interface on which DHCPv6 server is configured. $2: Name of the address pool to which the client's IPv6 address belongs. $3: IPv6 address of the DHCPv6 client. $4: DUID of the DHCPv6 client. $5: IAID of the DHCPv6 client. |
|
Severity level |
5 |
|
Example |
DHCPS6/5/DHCPS6_EXTEND_ADDRESS: DHCPv6 server received a DHCP client’s request packet on interface Ethernet0/2, and extended lease from p1 pool for the DHCP client (IPv6 address 2000::3, DUID 0001000118137c37b4b52facab5a, IAID 10b4b52f). |
|
Explanation |
The DHCPv6 server extended the address lease for a DHCPv6 client. |
|
Recommended action |
No action is required. |
DHCPS6_EXTEND_PREFIX
|
Message text |
DHCPv6 server received a DHCP client’s request packet on interface [STRING], and extended lease from [STRING] pool for the DHCP client (IPv6 prefix [IPADDR], DUID [HEX], IAID [HEX]). |
|
Variable fields |
$1: Name of the interface on which DHCPv6 server is configured. $2: Name of the address pool to which the client's IPv6 prefix belongs. $3: IPv6 prefix of the DHCPv6 client. $4: DUID of the DHCPv6 client. $5: IAID of the DHCPv6 client. |
|
Severity level |
5 |
|
Example |
DHCPS6/5/DHCPS6_EXTEND_PREFIX: DHCPv6 server received a DHCP client’s request packet on interface Ethernet0/2, and extended lease from p1 pool for the DHCP client (IPv6 prefix 2000::, DUID 0001000118137c37b4b52facab5a, IAID 10b4b52f). |
|
Explanation |
The DHCPv6 server extended the prefix lease for a DHCPv6 client. |
|
Recommended action |
No action is required. |
DHCPS6_FILE
|
Message text |
Failed to save DHCP client information due to lack of storage resources. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
DHCPS6/4/DHCPS6_FILE: Failed to save DHCP client information due to lack of storage resources. |
|
Explanation |
The DHCPv6 server failed to back up DHCPv6 bindings to the backup file due to lack of storage resources. |
|
Recommended action |
Delete unnecessary files to release resources. |
DHCPS6_IP_NET_EXHAUST
|
Message text |
|
|
Variable fields |
$1: IPv6 address pool name. |
|
Severity level |
4 |
|
Example |
DHCPS6/4/DHCPS6_IP_NET_EXHAUST: Address pool pool1 has run out of assignable subnets. |
|
Explanation |
The subnet usage of the IPv6 pool has reached 100%. |
|
Recommended action |
Replan address resources in the IPv6 pool. |
DHCPS6_IP_NET_EXHAUSTREC
|
Message text |
The subnet usage of address pool [STRING] has descended to or dropped below 90%. |
|
Variable fields |
$1: IPv6 address pool name. |
|
Severity level |
5 |
|
Example |
DHCPS6/5/DHCPS6_IP_NET_EXHAUSTREC: The subnet usage of address pool [STRING] has descended to or dropped below 90%. |
|
Explanation |
The subnet usage of the IPv6 pool has dropped to or below 90%. |
|
Recommended action |
N/A |
DHCPS6_IP_NET_THRESHOLD_EXCEED
|
Message text |
The subnet usage of address pool [STRING] has reached or exceeded the threshold. |
|
Variable fields |
$1: IPv6 address pool name. |
|
Severity level |
5 |
|
Example |
DHCPS6/5/DHCPS6_IP_NET_THRESHOLD_EXCEED: The subnet usage of address pool pool1 has reached or exceeded the threshold. |
|
Explanation |
The subnet usage of the IPv6 pool has reached or exceeded the threshold. |
|
Recommended action |
Replan address resources in the IPv6 pool. |
DHCPS6_IP_NET_THRESHOLD_REC
|
Message text |
The subnet usage of pool [STRING] has descended to or dropped below 90% of the threshold. |
|
Variable fields |
$1: IPv6 address pool name. |
|
Severity level |
5 |
|
Example |
DHCPS6/5/DHCPS6_IP_NET_THRESHOLD_REC: The subnet usage of pool [STRING] has descended to or dropped below 90% of the threshold. |
|
Explanation |
The subnet usage of the IPv6 pool has dropped to or below 90% of the threshold. |
|
Recommended action |
N/A |
DHCPS6_IP_THRESHOLD_EXCEED
|
Message text |
The IPv6 address usage of pool [STRING] has reached or exceeded the threshold. |
|
Variable fields |
$1: Name of the IPv6 address pool. |
|
Severity level |
5 |
|
Example |
DHCPS6/5/ DHCPS6_IP_THRESHOLD_EXCEED: The IPv6 address usage of pool pool1 has reached or exceeded the threshold. |
|
Explanation |
The IPv6 address usage of that pool has reached or exceeded the threshold. |
|
Recommended action |
Replan address resources in the IPv6 address pool. |
DHCPS6_IP_THRESHOLD_ RECOVER
|
Message text |
The IPv6 address usage of pool [STRING] is below 90% of the threshold. |
|
Variable fields |
$1: Name of the IPv6 address pool. |
|
Severity level |
5 |
|
Example |
DHCPS6/5/DHCPS6_IP_THRESHOLD_ RECOVER: The IPv6 address usage of pool pool1 is below 90% of the threshold. |
|
Explanation |
The IPv6 address usage of that pool has dropped below 90% of the threshold. |
|
Recommended action |
N/A |
DHCPS6_IP_WARNING_EXHAUST
|
Message text |
IPv6 pool [STRING] has run out of addresses. |
|
Variable fields |
$1: Name of the IPv6 address pool. |
|
Severity level |
4 |
|
Example |
DHCPS6/4/DHCPS6_IP_WARNING_EXHAUST: IPv6 pool pool1 has run out of addresses. |
|
Explanation |
The IPv6 address pool has run out of IP addresses. |
|
Recommended action |
Replan address resources in the IPv6 address pool. |
DHCPS6_IP_WARNING_EXHAUSTRECOVER
|
Message text |
The IPv6 address usage of pool [STRING] has dropped to or below 90%. |
|
Variable fields |
$1: Name of the IPv6 address pool. |
|
Severity level |
5 |
|
Example |
DHCPS6/5/DHCPS6_IP WARNING_EXHAUSTRECOVER: The IPv6 address usage of pool pool1 has dropped to or below 90%. |
|
Explanation |
The IPv6 address usage of that pool has dropped to or below 90%. |
|
Recommended action |
N/A |
DHCPS6_PD_NET_EXHAUST
|
Message text |
Address pool [STRING] has run out of assignable IPv6 prefix ranges. |
|
Variable fields |
$1: IPv6 address pool name. |
|
Severity level |
4 |
|
Example |
DHCPS6/4/DHCPS6_PD_NET_EXHAUST: Address pool pool1 has run out of assignable IPv6 prefix ranges. |
|
Explanation |
The prefix range usage of the IPv6 pool has reached 100%. |
|
Recommended action |
Replan prefix resources in the IPv6 pool. |
DHCPS6_PD_NET_EXHAUSTREC
|
Message text |
The IPv6 prefix range usage of address pool [STRING] has descended to or dropped below 90%. |
|
Variable fields |
$1: IPv6 address pool name. |
|
Severity level |
5 |
|
Example |
DHCPS6/5/DHCPS6_PD_NET_EXHAUSTREC: The IPv6 prefix range usage of address pool [STRING] has descended to or dropped below 90%. |
|
Explanation |
The prefix range usage of the IPv6 pool has dropped to or below 90%. |
|
Recommended action |
N/A |
DHCPS6_PD_NET_THRESHOLD_EXCEED
|
Message text |
The prefix range usage of address pool [STRING] has reached or exceeded the threshold. |
|
Variable fields |
$1: IPv6 address pool name. |
|
Severity level |
5 |
|
Example |
DHCPS6/4/DHCPS6_PD_NET_THRESHOLD_EXCEED: The prefix range usage of address pool [STRING] has reached or exceeded the threshold. |
|
Explanation |
The prefix range usage of the IPv6 pool has reached or exceeded the threshold. |
|
Recommended action |
Replan prefix resources in the IPv6 pool. |
DHCPS6_PD_NET_THRESHOLD_REC
|
Message text |
The prefix range usage of pool [STRING] has descended to or dropped below 90% of the threshold. |
|
Variable fields |
$1: IPv6 address pool name. |
|
Severity level |
5 |
|
Example |
DHCPS6/5/DHCPS6_PD_NET_THRESHOLD_REC: The prefix range usage of pool [STRING] has descended to or dropped below 90% of the threshold. |
|
Explanation |
The prefix range usage of the IPv6 pool has dropped to or below 90% of the threshold. |
|
Recommended action |
N/A |
DHCPS6_PD_THRESHOLD_EXCEED
|
Message text |
The IPv6 prefix usage of pool [STRING] has reached or exceeded the threshold. |
|
Variable fields |
$1: Name of the IPv6 address pool. |
|
Severity level |
5 |
|
Example |
DHCPS6/5/DHCPS6_PD_THRESHOLD_EXCEED: The IPv6 prefix usage of pool pool1 has reached or exceeded the threshold. |
|
Explanation |
The prefix usage of that pool has reached or exceeded the threshold. |
|
Recommended action |
Replan prefix resources in the IPv6 address pool. |
DHCPS6_PD_THRESHOLD_ RECOVER
|
Message text |
The IPv6 prefix usage of pool [STRING] is below 90% of the threshold. |
|
Variable fields |
$1: Name of the IPv6 address pool. |
|
Severity level |
5 |
|
Example |
DHCPS6/5/DHCPS6_PD_THRESHOLD_RECOVER: The IPv6 prefix usage of pool pool1 is below 90% of the threshold. |
|
Explanation |
The prefix usage of that pool has dropped below 90% of the threshold. |
|
Recommended action |
N/A |
DHCPS6_PD_WARNING_EXHAUST
|
Message text |
IPv6 pool [STRING] has run out of prefix ranges. |
|
Variable fields |
$1: Name of the IPv6 address pool. |
|
Severity level |
4 |
|
Example |
DHCPS6/4/DHCPS6_PD_WARNING_EXHAUST: IPv6 pool pool1 has run out of prefix ranges. |
|
Explanation |
The IPv6 address pool has run out of prefixes. |
|
Recommended action |
Replan prefix resources in the IPv6 address pool. |
DHCPS6_PD_WARNING_EXHAUSTRECOVER
|
Message text |
The IPv6 prefix usage of pool [STRING] has dropped to or below 90%. |
|
Variable fields |
$1: Name of the IPv6 address pool. |
|
Severity level |
5 |
|
Example |
DHCPS6/5/DHCPS6_PD_WARNING_EXHAUSTRECOVER: The IPv6 prefix usage of pool pool1 has dropped to or below 90%. |
|
Explanation |
The prefix usage of that pool has dropped to or below 90%. |
|
Recommended action |
N/A |
DHCPS6_POOLGP_IP_EXHAUSTION
|
Message text |
Pool group [STRING] has run out of IPv6 addresses. |
|
Variable fields |
$1: Name of the IP address pool group. |
|
Severity level |
4 |
|
Example |
DHCPS6/4/DHCPS6_POOLGP_IP_EXHAUSTION: Pool group group1 has run out of IPv6 addresses. |
|
Explanation |
The IPv6 address pool group has run out of IPv6 addresses. |
|
Recommended action |
Replan the address resource of the IPv6 address pool group. |
DHCPS6_POOLGP_EXHAUSTION_RECOV
|
Message text |
IPv6 address usage of pool group [STRING] has dropped to or below 90%. |
|
Variable fields |
$1: Name of the IP address pool group. |
|
Severity level |
4 |
|
Example |
DHCPS/64/DHCPS6_POOLGP_EXHAUSTION_RECOV: IPv6 address usage of pool group group1 has dropped to or below 90%. |
|
Explanation |
The IPv6 address usage of the IPv6 address pool group has dropped to or below 90%. |
|
Recommended action |
No action is required. |
DHCPS6_POOLGP_THRESHOLD_EXCEED
|
Message text |
IPv6 address usage of pool group [STRING] has exceeded the threshold. |
|
Variable fields |
$1: Name of the IP address pool group. |
|
Severity level |
4 |
|
Example |
DHCPS6/4/DHCPS6_POOLGP_THRESHOLD_EXCEED: IPv6 address usage of pool group group1 has exceeded the threshold. |
|
Explanation |
The IPv6 address usage of the IPv6 address pool group has exceeded the threshold. |
|
Recommended action |
Replan the address resource of the IPv6 address pool group. |
DHCPS6_POOLGP_THRESHOLD_RECOV
|
Message text |
IPv6 address usage of pool group [STRING] has dropped to or below 90% of the threshold. |
|
Variable fields |
$1: Name of the IP address pool group. |
|
Severity level |
4 |
|
Example |
DHCPS6/4/DHCPS6_POOLGP_ THRESHOLD_RECOV: IPv6 address usage of pool group group1 has dropped to or below 90% of the threshold. |
|
Explanation |
The IPv6 address usage of the IPv6 address pool group has dropped to or below 90% of the threshold. |
|
Recommended action |
No action is required. |
DHCPS6_RECLAIM_ADDRESS
|
Message text |
DHCPv6 server reclaimed a [STRING] pool's lease(IPv6 address [IPADDR], lease [UINT32] seconds), which is allocated for the DHCPv6 client (DUID [HEX], IAID [HEX]). |
|
Variable fields |
$1: Name of the address pool to which the assigned IPv6 address belongs. $2: IPv6 address assigned to the DHCPv6 client. $3: Lease duration of the assigned IPv6 address. $4: DUID of the DHCPv6 client. $5: IAID of the DHCPv6 client. |
|
Severity level |
5 |
|
Example |
DHCPS6/5/DHCPS6_RECLAIM_ADDRESS: DHCPv6 server reclaimed a p1 pool’s lease(IPv6 address 2000::3, lease 60 seconds), which is allocated for the DHCPv6 client (DUID 0001000118137c37b4b52facab5a, IAID 10b4b52f). |
|
Explanation |
The DHCPv6 server reclaimed the IPv6 address assigned to a DHCPv6 client. |
|
Recommended action |
No action is required. |
DHCPS6_RECLAIM_PREFIX
|
Message text |
DHCPv6 server reclaimed a [STRING] pool’s lease(IPv6 prefix [IPADDR], lease [INTEGER] seconds), which is allocated for the DHCPv6 client (DUID [HEX], IAID [HEX]). |
|
Variable fields |
$1: Name of the address pool to which the assigned IPv6 prefix belongs. $2: IPv6 prefix assigned to the DHCPv6 client. $3: Lease duration of the assigned IPv6 prefix. $4: DUID of the DHCPv6 client. $5: IAID of the DHCPv6 client. |
|
Severity level |
5 |
|
Example |
DHCPS6/5/DHCPS6_RECLAIM_PREFIX: DHCPv6 server reclaimed a p1 pool’s lease(IPv6 prefix 2000::, lease 60 seconds), which is allocated for the DHCPv6 client (DUID 0001000118137c37b4b52facab5a, IAID 10b4b52f). |
|
Explanation |
The DHCPv6 server reclaimed the IPv6 prefix assigned to a DHCPv6 client. |
|
Recommended action |
No action is required. |
DHCPS6_ROUTE_ADD
|
Message text |
UNR route ( Destination [STRING], Nexthop [STRING], Tunnel-destination [STRING] ) added for pool [STRING]. |
|
Variable fields |
$1: Destination network. $2: Next hop of the network route. $3: Destination of the tunnel. If no tunnel is configured, this field displays N/A. $4: Name of the IPv6 address pool. |
|
Severity level |
6 |
|
Example |
DHCPS6/6/DHCPS6_ROUTE_ADD: UNR route ( Destination 10::1/64, Nexthop ::, Tunnel-destination N/A ) added for pool pool1. |
|
Explanation |
The local device has generated a UNR for the IP address pool. |
|
Recommended action |
No action is required. |
DHCPS6_ROUTE_DEL
|
Message text |
UNR route ( Destination [STRING], Nexthop [STRING], Tunnel-destination [STRING] ) deleted for pool [STRING]. |
|
Variable fields |
$1: Destination network. $2: Next hop of the network route. $3: Destination of the tunnel. If no tunnel is configured, this field displays N/A. $4: Name of the IPv6 address pool. |
|
Severity level |
6 |
|
Example |
DHCPS6/6/DHCPS6_ROUTE_DEL: UNR route ( Destination 10::1/64, Nexthop ::, Tunnel-destination N/A ) deleted for pool pool1. |
|
Explanation |
A UNR issued for the IPv6 address pool was deleted as the corresponding network was deleted. |
|
Recommended action |
No action is required. |
DHCPS6_ROUTE_UPADD
|
Message text |
Issued UNR route ( Destination [STRING], Nexthop [STRING], Tunnel-destination [STRING] ) for pool [STRING] to UP [UINT]. |
|
Variable fields |
$1: Destination network. $2: Next hop of the network route. $3: Destination of the tunnel. If no tunnel is configured, this field displays N/A. $4: Name of the IPv6 address pool. |
|
Severity level |
6 |
|
Example |
DHCPS6/6/DHCPS6_ROUTE_UPADD: Issued UNR route ( Destination 10::1/24, Nexthop ::, Tunnel-destination N/A ) for pool pool1 to UP 1024. |
|
Explanation |
After the CP assigns an IPv6 address to a DHCPv6 client, it issues a UNR for that client to the UP. The UNR can guide the downlink traffic of the client. |
|
Recommended action |
No action is required. |
DHCPS6_ROUTE_UPDEL
|
Message text |
Delete UNR route ( Destination [STRING], Nexthop [STRING], Tunnel-destination [STRING] ) for pool [STRING] issued to UP [UINT]. |
|
Variable fields |
$1: Destination network. $2: Next hop of the network route. $3: Destination of the tunnel. If no tunnel is configured, this field displays N/A. $4: Name of the IPv6 address pool. $5: UP ID. |
|
Severity level |
6 |
|
Example |
DHCPS6/6/DHCPS6_ROUTE_UPDEL: Delete UNR route ( Destination 10::1/24, Nexthop ::, Tunnel-destination N/A ) for pool pool1 issued to UP 1024. |
|
Explanation |
The CP deleted a UNR issued to the UP because the corresponding network was deleted. |
|
Recommended action |
No action is required. |
DHCPS6_ROUTE_SMOOTHSTART
|
Message text |
Route restore started. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
DHCPS6/6/DHCPS6_ROUTE_SMOOTHSTART: Route restore started. |
|
Explanation |
After the device or the process restarted, the device started restoring network routes issued for IPv6 address pools. |
|
Recommended action |
No action is required. |
DHCPS6_ROUTE_SMOOTHEND
|
Message text |
Route restore ended. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
DHCPS6/6/DHCPS6_ROUTE_SMOOTHEND: Route restore ended. |
|
Explanation |
The device finished restoring network routes issue for IPv6 address pools. |
|
Recommended action |
No action is required. |
DHCPS6_ROUTE_UPSMOOTHSTART
|
Message text |
The CP started synchronizing routes to UPs. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
DHCPS6/6/DHCPS6_ROUTE_UPSMOOTHSTART: The CP started synchronizing routes to UPs. |
|
Explanation |
The CP started synchronizing the network routes issued for IPv6 address pools to UPs. |
|
Recommended action |
No action is required. |
DHCPS6_ROUTE_UPSMOOTHEND
|
Message text |
The CP finished synchronizing routes to UPs. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
DHCPS6/6/DHCPS6_ROUTE_UPSMOOTHEND: The CP finished synchronizing routes to UPs. |
|
Explanation |
The CP finished synchronizing the network routes issued for IPv6 address pools to UPs. |
|
Recommended action |
No action is required. |
DHCPSP4
This section contains DHCP snooping messages.
DHCPSP4_FILE
|
Message text |
Failed to save DHCP client information due to lack of storage resources. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
DHCPSP4/4/DHCPSP4_FILE: Failed to save DHCP client information due to lack of storage resources. |
|
Explanation |
The DHCP snooping device failed to back up DHCP snooping entries to the backup file due to lack of storage resources. |
|
Recommended action |
Delete unnecessary files to release resources. |
DHCPSP6
This section contains DHCPv6 snooping messages.
DHCPSP6_FILE
|
Message text |
Failed to save DHCP client information due to lack of storage resources. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
DHCPSP6/4/DHCPSP6_FILE: Failed to save DHCP client information due to lack of storage resources. |
|
Explanation |
The DHCPv6 snooping device failed to back up DHCPv6 snooping entries to the backup file due to lack of storage resources. |
|
Recommended action |
Delete unnecessary files to release resources. |
DIAG messages
This section contains DIAG messages. These messages are output only if the system is configured to take an action in response to hardware failures.
FMEA_ERR_REBOOT
|
Message text |
Hardware error detected on slot [UINT32]. Rebooting the card… |
|
Variable fields |
$1: Slot number of the card in the device. |
|
Severity level |
2 (Critical) |
|
Example |
DIAG/2/FMEA_ERR_REBOOT: Hardware error detected on slot 2. Rebooting the card… |
|
Impact |
A large number of packets were lost. |
|
Cause |
FMEA detected an interface module hardware failure. The system was rebooting the interface module. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
FMEA_ERR
|
Message text |
Hardware error detected on slot [UINT32]. |
|
Variable fields |
$1: Slot number of the card in the device. |
|
Severity level |
4 (Warning) |
|
Example |
DIAG/4/FMEA_ERR: Hardware error detected on slot 2. |
|
Impact |
Error packets might exist. |
|
Cause |
FMEA detected an interface module hardware failure. The system only sent a log message and did not try to resolve the issue. |
|
Recommended action |
1. Identify whether the message is reported repeatedly. 2. If not, no action is required. If yes, go the next step. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
|
EMMC storage media error or storage insufficiency detected on slot [UINT32]. |
|
|
Variable fields |
$1: Slot number of the card in the device. |
|
Severity level |
3 (Error) |
|
Example |
DIAG/3/FMEA_ERR: -MDC=1; EMMC storage media error or storage insufficiency detected on slot 1. |
|
Impact |
The storage media became unavailable, system logs cannot be generated, and no configuration file can be created. |
|
Cause |
EMMC storage media error or storage insufficiency was detected. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
|
Message text |
LVDS timeout on slot [UINT32] was detected on slot [UINT32]. |
|
Variable fields |
$1: Slot number of the switching fabric module in the device. $1: Slot number of the interface module in the device. |
|
Severity level |
3 (Error) |
|
Example |
DIAG/3/FMEA_ERR: -Slot=10; LVDS timeout on slot 10 was detected on slot 4. |
|
Impact |
The module was restarted. |
|
Cause |
The CPLD on the interface module was faulty. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
|
Message text |
Pattern 1: I2C error detected on chassis [UINT32] slot [UINT32]. Pattern 2: I2C error detected on chassis [UINT32] slot [UINT32] subslot [UINT32]. |
|
Variable fields |
Pattern 1: $1: Chassis number of the device. $2: Slot number of the card in the device. Pattern 2: $1: Chassis number of the device. $2: Slot number of the card in the device. $3: Sub slot number of the sub card. |
|
Severity level |
3 (Error) |
|
Example |
DIAG/3/FMEA_ERR: I2C error detected on chassis 0 slot 5. |
|
Impact |
The system might be unable to obtain transceiver module, voltage, or temperature information on the card or sub card. |
|
Cause |
A hardware failure has occurred on the l2C channel. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
|
Message text |
I210 error detected on slot [UINT32]. |
|
Variable fields |
$1: Slot number of the card in the device. |
|
Severity level |
3 (Error) |
|
Example |
DIAG/3/FMEA_ERR: I210 error detected on slot 0. |
|
Impact |
The management interface became unavailable. |
|
Cause |
A chip failure has occurred. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
|
Message text |
A hardware error has occurred on slot [UINT32]. |
|
Variable fields |
$1: Slot number of the card in the device. |
|
Severity level |
3 (Error) |
|
Example |
DIAG/3/FMEA_ERR: -MDC=1; A hardware error has occurred on 2 slot 8. |
|
Impact |
Error packets might occur in the system. |
|
Cause |
This message indicates that the button on the ejector lever for the MPU is not released. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
DIAG messages
This section contains diagnostic messages.
CORE_EXCEED_THRESHOLD
|
Message text |
Usage of CPU [INT] core [INT] exceeded the threshold ([string]). |
|
Variable fields |
$1: CPU number. $2: CPU core number. $3: Severe usage alarm threshold. |
|
Severity level |
3 |
|
Example |
DIAG/3/CORE_EXCEED_THRESHOLD: Usage of CPU 0 core 2 exceeded the threshold (90%). |
|
Explanation |
The usage of the specified CPU core exceeded the severe usage alarm threshold. The CPU core usage was in severe alarm state. |
|
Recommended action |
1. Execute the display process cpu and monitor thread commands to display CPU usage information about all processes. 2. Contact the technical support. |
CORE_MINOR_RECOVERY
|
Message text |
Core usage minor alarm CPU [INT] core [INT] removed. |
|
Variable fields |
$1: CPU number. $2: CPU core number. |
|
Severity level |
5 |
|
Example |
DIAG/5/CORE_MINOR_RECOVERY: Core usage alarm CPU 0 core 1 removed. |
|
Explanation |
The usage of the specified CPU core dropped to or below the minor usage alarm threshold. The minor alarm was removed. |
|
Recommended action |
No action is required. |
CORE_MINOR_THRESHOLD
|
Message text |
Usage of CPU [INT] core [INT] exceeded the threshold ([string]). |
|
Variable fields |
$1: CPU number. $2: CPU core number. $3: Minor usage alarm threshold. |
|
Severity level |
4 |
|
Example |
DIAG/4/CORE_MINOR_THRESHOLD: Usage of CPU 0 core 2 exceeded the threshold (80%). |
|
Explanation |
The usage of the specified CPU core was greater than the minor usage alarm threshold. The CPU core usage was in minor alarm state. |
|
Recommended action |
1. Execute the display process cpu and monitor thread commands to display CPU usage information about all processes. 2. Contact the technical support. |
CORE_RECOVERY
|
Message text |
Core usage alarm CPU [INT] core [INT] removed. |
|
Variable fields |
$1: CPU number. $2: CPU core number. |
|
Severity level |
3 |
|
Example |
DIAG/3/CORE_RECOVERY: Core usage alarm CPU 0 core 1 removed. |
|
Explanation |
The usage of the specified CPU core dropped to or below the severe usage alarm threshold. The severe alarm was removed. |
|
Recommended action |
No action is required. |
CPU_MINOR_RECOVERY
|
Message text |
CPU usage recovered to normal state. |
|
Variable fields |
N/A |
|
Severity level |
5 |
|
Example |
DIAG/5/CPU_MINOR_THRESHOLD: CPU usage recovered to normal state. |
|
Explanation |
The CPU usage dropped to or below the recovery threshold. The minor alarm was removed. |
|
Recommended action |
No action is required. |
CPU_MINOR_THRESHOLD
|
Message text |
CPU usage is in minor alarm state. CPU usage: [UINT]% in last 1 minute. CPU usage thresholds: Minor: [UINT]% Severe: [UINT]% Recovery: [UINT]% Process info: JID PID PRI State FDs HH:MM:SS CPU Name [UINT] [UINT] [UINT] [CHAR] [UINT] [CHAR] [CHAR] [CHAR] Core states: ID Idle User Kernel Interrupt Busy CPU[UINT] [CHAR] [CHAR] [CHAR] [CHAR] [CHAR] |
|
Variable fields |
$1: CPU usage during the last minute. $2: Minor CPU usage alarm threshold. $3: Severe CPU usage alarm threshold. $4: CPU usage recovery threshold. $5: Job ID of the process. $6: PID of the process. $7: Priority of the process. $8: Status of the process. $9: Number of file handles. $10: Running time of the process. $11: CPU usage of the process. $12: Name of the process. $13: Core ID. $14: Idle time. $15: The amount of time used by processes in the user space. $16: The amount of time used by kernel threads. $17: The amount of time used by interrupts. |
|
Severity level |
4 |
|
Example |
DIAG/4/CPU_MINOR_THRESHOLD: CPU usage is in minor alarm state. CPU usage: 3% in last 1 minute. CPU usage thresholds: Minor: 1% Severe: 2% Recovery: 0% Process info: JID PID PRI State FDs HH:MM:SS CPU Name 108398 108398120 S 36 00:00:0 12.58% snmpd 52 52 102 S 0 00:01:2 2.58% [DRV_FWD] 371 371 120 S 95 00:18:5 0.17% pppd 90 90 120 R 18 00:12:0 0.34% diagd 109 109 119 S 41 00:11:1 0.00% vbrd Core states: ID Idle User Kernel Interrupt Busy CPU0 98.61% 0.24% 0.62% 0.53% 1.39% CPU1 99.88% 0.00% 0.03% 0.09% 0.12% |
|
Explanation |
The CPU usage rose above the minor alarm threshold and entered minor alarm state. In minor alarm state, the device sends this message regularly until the alarm is removed. |
|
Recommended action |
Configure the device to reduce CPU usage. |
CPU_SEVERE_RECOVERY
|
Message text |
CPU usage severe alarm removed. |
|
Variable fields |
N/A |
|
Severity level |
5 |
|
Example |
DIAG/5/CPU_RECOVERY: CPU usage severe alarm removed. |
|
Explanation |
The CPU usage dropped to or below the minor alarm threshold. The severe alarm was removed. |
|
Recommended action |
No action is required. |
CPU_SEVERE_THRESHOLD
|
Message text |
CPU usage is in severe alarm state. CPU usage: [UINT]% in last 1 minute. CPU usage thresholds: Minor: [UINT]% Severe: [UINT]% Recovery: [UINT]% Process info: JID PID PRI State FDs HH:MM:SS CPU Name [UINT] [UINT] [UINT] [CHAR] [UINT] [CHAR] [CHAR] [CHAR] Core states: ID Idle User Kernel Interrupt Busy CPU[UINT] [CHAR] [CHAR] [CHAR] [CHAR] [CHAR] |
|
Variable fields |
$1: CPU usage during the last minute. $2: Minor CPU usage alarm threshold. $3: Severe CPU usage alarm threshold. $4: CPU usage recovery threshold. $5: Job ID of the process. $6: PID of the process. $7: Priority of the process. $8: Status of the process. $9: Number of file handles. $10: Running time of the process. $11: CPU usage of the process. $12: Name of the process. $13: Core ID. $14: Idle time. $15: The amount of time used by processes in the user space. $16: The amount of time used by kernel threads. $17: The amount of time used by interrupts. $18: The total amount of time used. |
|
Severity level |
3 |
|
Example |
DIAG/3/CPU_THRESHOLD: CPU usage is in severe alarm state. CPU usage: 3% in last 1 minute. CPU usage thresholds: Minor: 1% Severe: 2% Recovery: 0% Process info: JID PID PRI State FDs HH:MM:SS CPU Name 108398 108398120 S 36 00:00:0 12.58% snmpd 52 52 102 S 0 00:01:2 2.58% [DRV_FWD] 371 371 120 S 95 00:18:5 0.17% pppd 90 90 120 R 18 00:12:0 0.34% diagd 109 109 119 S 41 00:11:1 0.00% vbrd Core states: ID Idle User Kernel Interrupt Busy CPU0 98.61% 0.24% 0.62% 0.53% 1.39% CPU1 99.88% 0.00% 0.03% 0.09% 0.12% |
|
Explanation |
The CPU usage rose above the severe alarm threshold and entered severe alarm state. In severe alarm state, the device sends this message regularly until the alarm is removed. |
|
Recommended action |
Use the display current-configuration | include "monitor cpu-usage" command to display the CPU alarm thresholds. If the settings are not appropriate, use the monitor cpu-usage command to change the settings. |
DIAG_DMA_MEM_CRITICAL_THRESHOLD
|
Message text |
Free DMA memory [UINT]KB is equal to or less than the critical threshold [UINT]KB. |
|
Variable fields |
N/A |
|
Severity level |
1 |
|
Example |
DIAG/1/DIAG_DMA_MEM_CRITICAL_THRESHOLD: Free DMA memory 1600KB is equal to or less than the critical threshold 800KB. |
|
Explanation |
The size of the free DMS memory dropped to or below the DMA memory alarm threshold. A DMA memory alarm occurred. |
|
Recommended action |
1. Verify that the DMA memory alarm threshold is appropriate. To set the alarm threshold, use the display memory-threshold dma command. 2. If the issue persists, contact H3C Support. |
DIAG_DMA_MEM_RECOVERY
|
Message text |
Free DMA memory [UINT]KB is greater than the normal threshold [UINT]KB. DMA memory alarm removed. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
DIAG/4/DIAG_DMA_MEM_RECOVERY: Free DMA memory 1600KB is greater than the normal threshold 1000KB. DMA memory alarm removed. |
|
Explanation |
The size of the free DMS memory rose above the DMA memory normal state threshold. The DMA memory alarm was removed. |
|
Recommended action |
No action is required. |
DIAG_FD_UPLIMIT_REACHED
|
Message text |
FD number upper limit already reached: Process name=[STRING], PID=[INTEGER]. |
|
Variable fields |
$1: Name of a process. $2: ID of the process. |
|
Severity level |
4 |
|
Example |
DIAG/4/DIAG_FD_UPLIMIT_REACHED: FD number upper limit already reached: Process name=snmpd, PID=244. |
|
Explanation |
The maximum number of file descriptors that a process can use has been reached. |
|
Recommended action |
No action is required. |
DIAG_FD_UPLIMIT_TO_REACH
|
Message text |
Number of FDs is about to reach the upper limit: Process name=[STRING], PID=[INTEGER]. |
|
Variable fields |
$1: Name of a process. $2: ID of the process. |
|
Severity level |
4 |
|
Example |
DIAG/4/DIAG_FD_UPLIMIT_TO_REACH: Number of FDs is about to reach the upper limit. Process name=snmpd, PID=244. |
|
Explanation |
The maximum number of file descriptors that a process can use was about to be reached. |
|
Recommended action |
No action is required. |
DIAG_STORAGE_BELOW_THRESHOLD
|
Message text |
The usage of [STRING] ([UINT32]%) was below or equal to the threshold of [UINT32]%. |
|
Variable fields |
$1: Name of the storage medium. $2: Usage of the storage medium. $3: Usage threshold of the storage medium. |
|
Severity level |
1 |
|
Example |
DIAG/1/DIAG_STORAGE_BELOW_THRESHOLD: The usage of flash (90%) was below or equal to the threshold of 95%. |
|
Explanation |
The usage of the storage medium was below or equal to the threshold. |
|
Recommended action |
No action is required. |
DIAG_STORAGE_EXCEED_THRESHOLD
|
Message text |
The usage of [STRING] ([UINT32]%) exceeded the threshold of [UINT32]%. |
|
Variable fields |
$1: Name of the storage medium. $2: Usage of the storage medium. $3: Usage threshold of the storage medium. |
|
Severity level |
1 |
|
Example |
DIAG/1/DIAG_STORAGE_EXCEED_THRESHOLD: The usage of flash (96%) exceeded the threshold of 95%. |
|
Explanation |
The usage of the storage medium exceeded the threshold. |
|
Recommended action |
For files not in use, for example, log files and history software packages, execute the delete /unreserved command to delete the files or back up the files and then execute the delete /unreserved command to delete the files. |
KERNEL_MEMFRAGMT_BELOW_THRESHOLD
|
Message text |
Free kernel memory fragment ratio[UINT]% is less than the threshold[UINT]%. |
|
Variable fields |
$1: Free kernel memory fragment ratio. $2: Alarm threshold for the free kernel memory fragment ratio. |
|
Severity level |
4 |
|
Example |
DIAG/4/KERNEL_MEMFRAGMT_BELOW_THRESHOLD:Free kernel memory fragment ratio 30% is less than the threshold 40%. |
|
Explanation |
The free kernel memory fragment ratio dropped below the alarm threshold. The alarm of free kernel memory fragment ratio was removed. |
|
Recommended action |
No action is required. |
KERNEL_MEMFRAGMT_EXCEED_THRESHOLD
|
Message text |
Free kernel memory fragment ratio [UINT]% is equal to or greater than the threshold [UINT]%. |
|
Variable fields |
$1: Free kernel memory fragment ratio. $2: Alarm threshold for the free kernel memory fragment ratio. |
|
Severity level |
1 |
|
Example |
DIAG/1/DIAG_STORAGE_EXCEED_THRESHOLD: The usage of flash (96%) exceeded the threshold of 95%. |
|
Explanation |
The free kernel memory fragment ratio reached or rose above the alarm threshold. An alarm of free kernel memory fragment ratio occurred. |
|
Recommended action |
1. Verify that the alarm threshold for the free kernel memory fragment ratio is appropriate. To set the alarm threshold, use the display kernel memory fragment free command. 2. If the issue persists, contact H3C Support. |
MEM_ALERT
|
Message text |
system memory info: total used free shared buffers cached Mem: [ULONG] [ULONG] [ULONG] [ULONG] [ULONG] [ULONG] -/+ buffers/cache: [ULONG] [ULONG] Swap: [ULONG] [ULONG] [ULONG] Lowmem: [ULONG] [ULONG] [ULONG] |
|
Variable fields |
· Mem—Memory information of the whole system: ¡ $1: Total size of allocatable physical memory. The system physical memory contains allocatable physical memory and unallocatable physical memory. Unallocatable physical memory is mainly used for kernel code storage, kernel management, and running of basic functions. Allocatable physical memory is used for such tasks as running service modules and storing files. The size of unallocatable physical memory is automatically calculated based on the system operation requirements. The size of allocatable physical memory is the total physical memory size minus the unallocatable physical memory size. ¡ $2: Size of the physical memory used by the system. ¡ $3: Size of free physical memory of the system. ¡ $4: Total size of physical memory shared by processes. ¡ $5: Size of physical memory used for buffers. ¡ $6: Size of physical memory used for caches. · -/+ buffers/cache—Memory usage information of applications: ¡ $7: -/+ Buffers/Cache:used = Mem:Used – Mem:Buffers – Mem:Cached, which indicates the size of physical memory used by applications. ¡ $8: -/+ Buffers/Cache:free = Mem:Free + Mem:Buffers + Mem:Cached, which indicates the size of physical memory available for applications. · Swap—Swap memory usage information: ¡ $9: Total size of swap memory. ¡ $10: Size of used swap memory. ¡ $11: Size of free swap memory. · Lowmem—Low memory usage information: ¡ $12: Total size of low memory. ¡ $13: Size of used low memory. ¡ $14: Size of free low memory. |
|
Severity level |
4 |
|
Example |
DIAG/4/MEM_ALERT: system memory info: total used free shared buffers cached Mem: 1784424 920896 863528 0 0 35400 -/+ buffers/cache: 885496 898928 Swap: 0 0 0 Lowmem: 735848 637896 97952 |
|
Explanation |
A memory alarm was generated, displaying memory usage information. The system generates this message when the used memory is greater than or equal to the minor, severe, or critical threshold of memory usage. |
|
Recommended action |
You can perform the following tasks to help remove the alarm: · Verify that appropriate alarm thresholds are set. To view the alarm thresholds, use the display memory-threshold command. Then you can use the memory-threshold command to modify the alarm thresholds if required. · Verify that the device is not under attack by checking the ARP table and routing table. · Examine and optimize the network, for example, reduce the number of routes, or replace the device with a higher-performance device. |
MEM_BELOW_THRESHOLD
|
Message text |
Memory usage has dropped below [STRING] threshold. |
|
Variable fields |
$1: Memory usage threshold name: minor, severe, critical, or early-warning. |
|
Severity level |
1 |
|
Example |
DIAG/1/MEM_BELOW_THRESHOLD: Memory usage has dropped below critical threshold. |
|
Explanation |
A memory alarm was removed. The message is sent when the system free memory is greater than a memory alarm recovery threshold. |
|
Recommended action |
No action is required. |
MEM_EXCEED_THRESHOLD
|
Message text |
Memory [STRING] threshold has been exceeded. |
|
Variable fields |
$1: Memory usage threshold name: minor, severe, critical, or early-warning. |
|
Severity level |
1 |
|
Example |
DIAG/1/MEM_EXCEED_THRESHOLD: Memory minor threshold has been exceeded. |
|
Explanation |
A memory alarm was notified. When the used memory size is greater than or equal to the minor, severe, critical, or early-warning threshold of memory usage, the system generates this message and notifies services modules to perform auto repair, such as releasing memory and stopping requesting memory. |
|
Recommended action |
You can perform the following tasks to help remove the alarm: · Verify that appropriate alarm thresholds are set. To view the alarm thresholds, use the display memory-threshold command. Then you can use the memory-threshold command to modify the alarm thresholds if required. · Verify that the device is not under attack by checking the ARP table and routing table. · Examine and optimize the network, for example, reduce the number of routes or replace the device with a higher-performance device. |
MEM_USAGE_RECOVERY
|
Message text |
Memory usage recovered to normal state. |
|
Variable fields |
N/A |
|
Severity level |
5 |
|
Example |
DIAG/5/MEM_USAGE_RECOVERY: Memory usage recovered to normal state. |
|
Explanation |
The memory usage of the device dropped to or below the memory usage threshold. The memory usage alarm was removed. |
|
Recommended action |
No action is required. |
MEM_USAGE_THRESHOLD
|
Message text |
Memory usage is in alarm state. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
DIAG/4/MEM_USAGE_THRESHOLD: Memory usage is in alarm state. |
|
Explanation |
The memory usage of the device increased above the memory usage threshold. A memory usage alarm was triggered. |
|
Recommended action |
You can perform the following tasks to help remove the alarm: 1. Verify that appropriate alarm thresholds are set. To view the alarm thresholds, use the display memory-threshold command. Then you can use the memory-threshold command to modify the alarm thresholds if required. 2. Verify that the device is not under attack by checking the ARP table and routing table. 3. Examine and optimize the network, for example, reduce the number of routes, or replace the device with a higher-performance device. |
DLDP messages
This section contains DLDP messages.
DLDP_AUTHENTICATION_FAILED
|
Message text |
The DLDP packet failed the authentication because of unmatched [STRING] field. |
|
Variable fields |
$1: Authentication field. · AUTHENTICATION PASSWORD—Authentication password mismatch. · AUTHENTICATION TYPE—Authentication type mismatch. · INTERVAL—Advertisement interval mismatch. |
|
Severity level |
5 |
|
Example |
DLDP/5/DLDP_AUTHENTICATION_FAILED: The DLDP packet failed the authentication because of unmatched INTERVAL field. |
|
Explanation |
The packet authentication failed. Possible reasons include unmatched authentication type, unmatched authentication password, and unmatched advertisement interval. |
|
Recommended action |
Check the DLDP authentication type, authentication password, and advertisement interval are consistent with peer end. |
DLDP_LINK_BIDIRECTIONAL
|
Message text |
DLDP detected a bidirectional link on interface [STRING]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
6 |
|
Example |
DLDP/6/DLDP_LINK_BIDIRECTIONAL: DLDP detected a bidirectional link on interface Ethernet1/1. |
|
Explanation |
DLDP detected a bidirectional link on an interface. |
|
Recommended action |
No action is required. |
DLDP_LINK_SHUTMODECHG
|
Message text |
DLDP automatically blocked the interface [STRING] because the port shutdown mode was changed to auto mode. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
5 |
|
Example |
DLDP/5/DLDP_LINK_SHUTMODECHG: DLDP automatically blocked the interface Ethernet1/1 because the port shutdown mode was changed to auto mode. |
|
Explanation |
DLDP automatically shut down the interface because the port shutdown mode was changed to auto mode. |
|
Recommended action |
No action is required. |
DLDP_LINK_UNIDIRECTIONAL
|
Message text |
DLDP detected a unidirectional link on interface [STRING]. [STRING]. |
|
Variable fields |
$1: Interface name. $2: Action according to the port shutdown mode: · DLDP automatically blocked the interface. · Please manually shut down the interface. |
|
Severity level |
3 |
|
Example |
DLDP/3/DLDP_LINK_UNIDIRECTIONAL: DLDP detected a unidirectional link on interface Ethernet1/1. DLDP automatically blocked the interface. |
|
Explanation |
DLDP detected a unidirectional link on an interface. |
|
Recommended action |
Check for incorrect cable connection, cable falloff, or other problems. |
DLDP_NEIGHBOR_AGED
|
Message text |
A neighbor on interface [STRING] was deleted because the neighbor was aged. The neighbor's system MAC is [MAC], and the port index is [UINT16]. |
|
Variable fields |
$1: Interface name. $2: MAC address. $3: Port index. |
|
Severity level |
5 |
|
Example |
DLDP/5/DLDP_NEIGHBOR_AGED: A neighbor on interface Ethernet1/1 was deleted because the neighbor was aged. The neighbor's system MAC is 000f-e269-5f21, and the port index is 1. |
|
Explanation |
The interface deleted an aged neighbor. |
|
Recommended action |
No action is required. |
DLDP_NEIGHBOR_CONFIRMED
|
Message text |
A neighbor was confirmed on interface [STRING]. The neighbor's system MAC is [MAC], and the port index is [UINT16]. |
|
Variable fields |
$1: Interface name. $2: MAC address. $3: Port index. |
|
Severity level |
6 |
|
Example |
DLDP/6/DLDP_NEIGHBOR_CONFIRMED: A neighbor was confirmed on interface Ethernet1/1. The neighbor's system MAC is 000f-e269-5f21, and the port index is 1. |
|
Explanation |
The interface detected a confirmed neighbor. |
|
Recommended action |
No action is required. |
DLDP_NEIGHBOR_DELETED
|
Message text |
A neighbor on interface [STRING] was deleted because a [STRING] packet arrived. The neighbor's system MAC is [MAC], and the port index is [UINT16]. |
|
Variable fields |
$1: Interface name. $2: Packet type, DISABLE or LINKDOWN. $3: MAC address. $4: Port index. |
|
Severity level |
5 |
|
Example |
DLDP/5/DLDP_NEIGHBOR_DELETED: A neighbor on interface Ethernet1/1 was deleted because a DISABLE packet arrived. The neighbor's system MAC is 000f-e269-5f21, and the port index is 1. |
|
Explanation |
The interface deleted a confirmed neighbor because it received a DISABLE or LINKDOWN packet. |
|
Recommended action |
No action is required. |
DOMAIN messages
This section contains DOMAIN messages.
DOMAIN_IP_LOWTHR_ALM
|
Message text |
-Domain=[STRING]-IPUsage=[STRING]-IPPoolLowerValue=[STRING]; IP resource usage reached or dropped below the lower threshold. |
|
Variable fields |
$1: ISP domain name. $2: IP address usage. $3: Lower alarm threshold for IP address usage. |
|
Severity level |
4 |
|
Example |
DOMAIN/4/DOMAIN_IP_LOWTHR_ALM: -Domain=abc-IPUsage=10%-IPPoolLowerValue=20%; IP resource usage reached or dropped below the lower threshold. |
|
Explanation |
A low-usage alarm was generated when the usage of IP addresses in the authorization IP pool or IP pool group for an ISP domain reached or dropped below the lower alarm threshold. |
|
Recommended action |
No action is required. |
DOMAIN_IP_LOWTHR_ALM_REMOVE
|
Message text |
-Domain=[STRING]-IPUsage=[STRING]-IPPoolLowerValue=[STRING]; Low IP resource usage alarm condition cleared. |
|
Variable fields |
$1: ISP domain name. $2: IP address usage. $3: Lower alarm threshold for IP address usage. |
|
Severity level |
4 |
|
Example |
DOMAIN/4/DOMAIN_IP_LOWTHR_ALM_REMOVE: -Domain=dom1-IPUsage=50%-IPPoolLowerValue=20%; Low IP resource usage alarm condition cleared. |
|
Explanation |
The low IP resource usage alarm was cleared when the usage of IP addresses in the authorization IP pool or IP pool group for an ISP domain reached or exceeded the value calculated by using the following formula: Lower alarm threshold + (upper alarm threshold – lower alarm threshold)*10%. |
|
Recommended action |
No action is required. |
DOMAIN_IP_UPTHR_ALM
|
Message text |
-Domain=[STRING]-IPUsage=[STRING]-IPPoolUpperValue=[STRING]; IP resource usage reached or exceeded the upper threshold. |
|
Variable fields |
$1: ISP domain name. $2: IP address usage. $3: Upper alarm threshold for IP address usage. |
|
Severity level |
4 |
|
Example |
DOMAIN/4/DOMAIN_IP_UPTHR_ALM: -Domain=dom1-IPUsage=90%-IPPoolUpperValue=80%; IP resource usage reached or exceeded the upper threshold. |
|
Explanation |
A high-usage alarm was generated when the usage of IP addresses in the authorization IP pool or IP pool group for an ISP domain reached or exceeded the upper alarm threshold. |
|
Recommended action |
Adjust available resources of the authorization IP pool or IP pool group in time. |
DOMAIN_IP_UPTHR_ALM_REMOVE
|
Message text |
-Domain=[STRING]-IPUsage=[STRING]-IPPoolUpperValue=[STRING]; High IP resource usage alarm condition cleared. |
|
Variable fields |
$1: ISP domain name. $2: IP address usage. $3: Upper alarm threshold for IP address usage. |
|
Severity level |
4 |
|
Example |
DOMAIN/4/DOMAIN_IP_UPTHR_ALM_REMOVE: -Domain=dom1-IPUsage=50%-IPPoolUpperValue=80%; High IP resource usage alarm condition cleared. |
|
Explanation |
The high IP resource usage alarm was cleared when the usage of IP addresses in the authorization IP pool or IP pool group for an ISP domain reached or dropped below the value calculated by using the following formula: Upper alarm threshold – (upper alarm threshold – lower alarm threshold)*10%. |
|
Recommended action |
No action is required. |
DOMAIN_IPV6_LOWTHR_ALM
|
Message text |
-Domain=[STRING]-IPv6Usage=[STRING]-IPv6PoolLowerValue=[STRING]; IPv6 address resource usage reached or dropped below the lower threshold. |
|
Variable fields |
$1: ISP domain name. $2: IPv6 address usage. $3: Lower alarm threshold for IPv6 address or prefix usage. |
|
Severity level |
4 |
|
Example |
DOMAIN/4/DOMAIN_IPV6_LOWTHR_ALM: -Domain=abc-IPv6Usage=10%-IPv6PoolLowerValue=20%; IPv6 address resource usage reached or dropped below the lower threshold. |
|
Explanation |
A low-usage alarm was generated when the usage of IPv6 addresses in the authorization IPv6 address pool or IPv6 address pool group for an ISP domain reached or dropped below the lower alarm threshold. |
|
Recommended action |
No action is required. |
DOMAIN_IPV6_LOWTHR_ALM_REMOVE
|
Message text |
-Domain=[STRING]-IPv6Usage=[STRING]-IPv6PoolLowerValue=[STRING]; Low IPv6 address resource usage alarm condition cleared. |
|
Variable fields |
$1: ISP domain name. $2: IPv6 address usage. $3: Lower alarm threshold for IPv6 address or prefix usage. |
|
Severity level |
4 |
|
Example |
DOMAIN/4/DOMAIN_IPV6_LOWTHR_ALM_REMOVE: -Domain=dom1-IPv6Usage=50%-IPv6PoolLowerValue=20%; Low IPv6 address resource usage alarm condition cleared. |
|
Explanation |
The low IPv6 address resource usage alarm was cleared when the usage of IPv6 addresses in the authorization IPv6 address pool or IPv6 address pool group for an ISP domain reached or exceeded the value calculated by using the following formula: Lower alarm threshold + (upper alarm threshold – lower alarm threshold)*10%. |
|
Recommended action |
No action is required. |
DOMAIN_IPV6_UPTHR_ALM
|
Message text |
-Domain=[STRING]-IPv6Usage=[STRING]-IPv6PoolUpperValue=[STRING]; IPv6 address resource usage reached or exceeded the upper threshold. |
|
Variable fields |
$1: ISP domain name. $2: IPv6 address usage. $3: Upper alarm threshold for IPv6 address or prefix usage. |
|
Severity level |
4 |
|
Example |
DOMAIN/4/DOMAIN_IPV6_UPTHR_ALM: -Domain=abc-IPv6Usage=90%-IPv6PoolUpperValue=80%; IPv6 address resource usage reached or exceeded the upper threshold. |
|
Explanation |
A high-usage alarm was generated when the usage of IPv6 addresses in the authorization IPv6 address pool or IPv6 address pool group for an ISP domain reached or exceeded the upper alarm threshold. |
|
Recommended action |
Adjust available resources of the authorization IPv6 pool or IPv6 pool group in time. |
DOMAIN_IPV6_UPTHR_ALM_REMOVE
|
Message text |
-Domain=[STRING]-IPv6Usage=[STRING]-IPv6PoolUpperValue=[STRING]; High IPv6 address resource usage alarm condition cleared. |
|
Variable fields |
$1: ISP domain name. $2: IPv6 address usage. $3: Upper alarm threshold for IPv6 address or prefix usage. |
|
Severity level |
4 |
|
Example |
DOMAIN/4/DOMAIN_IPV6_UPTHR_ALM_REMOVE: -Domain=dom1-IPv6Usage=50%-IPv6PoolUpperValue=80%; High IPv6 address resource usage alarm condition cleared. |
|
Explanation |
The high IPv6 address resource usage alarm was cleared when the usage of IPv6 addresses in the authorization IPv6 address pool or IPv6 address pool group for an ISP domain reached or dropped below the value calculated by using the following formula: Upper alarm threshold – (upper alarm threshold – lower alarm threshold)*10%. |
|
Recommended action |
No action is required. |
DOMAIN_IPV6_WEB_SERVER_ACCESS
|
Message text |
Domain=[STRING]-WebActiveServerIPv6URL=[STRING]; This trap is generated when the IPv6 Web server is restored to available. |
|
Variable fields |
$1: ISP domain name. $2: Current active IPv6 Web server URL. |
|
Severity level |
5 |
|
Example |
DOMAIN/5/DOMAIN_IPV6_WEB_SERVER_ACCESS: -MDC=1; -Domain=dom1-WebActiveServerIPv6URL=test.com; This trap is generated when the IPv6 Web server is restored to available. |
|
Explanation |
This notification is generated when the IPv6 URL of the Web server in a domain becomes available. |
|
Recommended action |
No action is required. |
DOMAIN_IPV6_WEB_SERVER_NOT_REACH
|
Message text |
-Domain=[STRING]-WebActiveServerIPv6URL=[STRING]; This trap is generated when the IPv6 Web server is unavailable. |
|
Variable fields |
$1: ISP domain name. $2: IPv6 Web server URL that became unavailable. |
|
Severity level |
4 |
|
Example |
DOMAIN/4/DOMAIN_IPv6_WEB_SERVER_NOT_REACH: -MDC=1; -Domain=1-WebActiveServerIPv6URL=test.com; This trap is generated when the IPv6 Web server is unavailable. |
|
Explanation |
This notification is generated when all IPv6 URLs of the Web server in a domain become unavailable. |
|
Recommended action |
· Verify that the link between the device and the Web server is operating correctly. · Verify that the IPv6 Web server URLs in the domain are configured correctly. |
DOMAIN_IPV6_WEB_SERVER_URL_SWITCH
|
Message text |
-Domain=[STRING]-WebActiveServerIPv6URL=[STRING]; This trap is generated when the valid IPv6 URL of the Web server changes. |
|
Variable fields |
$1: ISP domain name. $2: Current active IPv6 Web server URL. |
|
Severity level |
4 |
|
Example |
DOMAIN/4/DOMAIN_IPV6_WEB_SERVER_URL_SWITCH: -MDC=1; -Domain=dom1-WebActiveServerIPv6URL= test1.com; This trap is generated when the valid IPv6 URL of the Web server changes. |
|
Explanation |
This notification is generated when the IPv6 URL of the Web server in a domain changes for one of the following reasons: · The IPv6 URL of the active Web server changes. · The primary IPv6 Web server URL becomes inaccessible and the secondary IPv6 Web server URL takes over to provide services. · The primary IPv6 Web server URL restores its accessibility and preempts the secondary IPv6 Web server URL to provide services. |
|
Recommended action |
· Verify that the IPv6 Web server URLs in the domain are configured correctly as planned. · Verify that the link between the device and the Web server is operating correctly. |
DOMAIN_ND_PREF_LOWTHR_ALM
|
Message text |
-Domain=[STRING]-NDPrefixUsage=[STRING]-IPv6PoolLowerValue=[STRING]; ND prefix resource usage reached or dropped below the lower threshold. |
|
Variable fields |
$1: ISP domain name. $2: ND prefix usage. ND prefixes refer to IPv6 prefixes assigned by ND. $3: Lower alarm threshold for IPv6 address or prefix usage. |
|
Severity level |
4 |
|
Example |
DOMAIN/4/DOMAIN_ND_PREF_LOWTHR_ALM: -Domain=abc-NDPrefixUsage=10%-IPv6PoolLowerValue=20%; ND prefix resource usage reached or dropped below the lower threshold. |
|
Explanation |
A low-usage alarm was generated when the usage of ND prefixes in the authorization ND prefix pool or ND prefix pool group for an ISP domain reached or dropped below the lower alarm threshold. |
|
Recommended action |
No action is required. |
DOMAIN_ND_PREF_LOWTHR_ALM_REMOVE
|
Message text |
-Domain=[STRING]-NDPrefixUsage=[STRING]-IPv6PoolLowerValue=[STRING]; Low ND prefix resource usage alarm condition cleared. |
|
Variable fields |
$1: ISP domain name. $2: ND prefix usage. $3: Lower alarm threshold for IPv6 address or prefix usage. |
|
Severity level |
4 |
|
Example |
DOMAIN/4/DOMAIN_ND_PREF_LOWTHR_ALM_REMOVE: -Domain=abc-NDPrefixUsage=50%-IPv6PoolLowerValue=20%; Low ND prefix resource usage alarm condition cleared. |
|
Explanation |
The low ND prefix resource usage alarm was cleared when the usage of ND prefixes in the authorization ND prefix pool or ND prefix pool group for an ISP domain reached or exceeded the value calculated by using the following formula: Lower alarm threshold + (upper alarm threshold – lower alarm threshold)*10%. |
|
Recommended action |
No action is required. |
DOMAIN_ND_PREF_UPTHR_ALM
|
Message text |
-Domain=[STRING]-NDPrefixUsage=[STRING]-IPv6PoolUpperValue=[STRING]; ND prefix resource usage reached or exceeded the upper threshold. |
|
Variable fields |
$1: ISP domain name. $2: ND prefix usage. $3: Upper alarm threshold for IPv6 address or prefix usage. |
|
Severity level |
4 |
|
Example |
DOMAIN/4/DOMAIN_ND_PREF_UPTHR_ALM: -Domain=abc-NDPrefixUsage=90%-IPv6PoolUpperValue=80%; ND prefix resource usage reached or exceeded the upper threshold. |
|
Explanation |
A high-usage alarm was generated when the usage of ND prefixes in the authorization ND prefix pool or ND prefix pool group for an ISP domain reached or exceeded the upper alarm threshold. |
|
Recommended action |
Adjust available resources of the authorization ND prefix pool or ND prefix pool group in time. |
DOMAIN_ND_PREF_UPTHR_ALM_REMOVE
|
Message text |
-Domain=[STRING]-NDPrefixUsage=[STRING]-IPv6PoolUpperValue=[STRING]; High ND prefix resource usage alarm condition cleared. |
|
Variable fields |
$1: ISP domain name. $2: ND prefix usage. $3: Upper alarm threshold for IPv6 address or prefix usage. |
|
Severity level |
4 |
|
Example |
DOMAIN/4/DOMAIN_ND_PREF_UPTHR_ALM_REMOVE: -Domain=abc-NDPrefixUsage=50%-IPv6PoolUpperValue=80%; High ND prefix resource usage alarm condition cleared. |
|
Explanation |
The high ND prefix resource usage alarm was cleared when the usage of ND prefixes in the authorization ND prefix pool or ND prefix pool group for an ISP domain reached or dropped below the value calculated by using the following formula: Upper alarm threshold – (upper alarm threshold – lower alarm threshold)*10%. |
|
Recommended action |
No action is required. |
DOMAIN_PD_PREF_LOWTHR_ALM
|
Message text |
-Domain=[STRING]-PDPrefixUsage=[STRING]-IPv6PoolLowerValue=[STRING]; PD prefix resource usage reached or dropped below the lower threshold. |
|
Variable fields |
$1: ISP domain name. $2: PD prefix usage. PD prefixes refer to IPv6 prefixes assigned by DHCPv6 PD. $3: Lower alarm threshold for IPv6 address or prefix usage. |
|
Severity level |
4 |
|
Example |
DOMAIN/4/DOMAIN_PD_PREF_LOWTHR_ALM: -Domain=abc-PDPrefixUsage=10%-IPv6PoolLowerValue=20%; PD prefix resource usage reached or dropped below the lower threshold. |
|
Explanation |
A low-usage alarm was generated when the usage of PD prefixes in the authorization IPv6 address pool or IPv6 address pool group for an ISP domain reached or dropped below the lower alarm threshold. |
|
Recommended action |
No action is required. |
DOMAIN_PD_PREF_LOWTHR_ALM_REMOVE
|
Message text |
-Domain=[STRING]-PDPrefixUsage=[STRING]-IPv6PoolLowerValue=[STRING]; Low PD prefix resource usage alarm condition cleared. |
|
Variable fields |
$1: ISP domain name. $2: PD prefix usage. $3: Lower alarm threshold for IPv6 address or prefix usage. |
|
Severity level |
4 |
|
Example |
DOMAIN/4/DOMAIN_PD_PREF_LOWTHR_ALM_REMOVE: -Domain=abc-PDPrefixUsage=50%-IPv6PoolLowerValue=20%; Low PD prefix resource usage alarm condition cleared. |
|
Explanation |
The low PD prefix resource usage alarm was cleared when the usage of PD prefixes in the authorization IPv6 address pool or IPv6 address pool group for an ISP domain reached or exceeded the value calculated by using the following formula: Lower alarm threshold + (upper alarm threshold – lower alarm threshold)*10%. |
|
Recommended action |
No action is required. |
DOMAIN_PD_PREF_UPTHR_ALM
|
Message text |
-Domain=[STRING]-PDPrefixUsage=[STRING]-IPv6PoolUpperValue=[STRING]; PD prefix resource usage reached or exceeded the upper threshold. |
|
Variable fields |
$1: ISP domain name. $2: PD prefix usage. $3: Upper alarm threshold for IPv6 address or prefix usage. |
|
Severity level |
4 |
|
Example |
DOMAIN/4/DOMAIN_PD_PREF_UPTHR_ALM: -Domain=abc-PDPrefixUsage=90%-IPv6PoolUpperValue=80%; PD prefix resource usage reached or exceeded the upper threshold. |
|
Explanation |
A high-usage alarm was generated when the usage of PD prefixes in the authorization IPv6 address pool or IPv6 address pool group for an ISP domain reached or exceeded the upper alarm threshold. |
|
Recommended action |
Adjust available resources of the authorization IPv6 pool or IPv6 pool group in time. |
DOMAIN_PD_PREF_UPTHR_ALM_REMOVE
|
Message text |
-Domain=[STRING]-PDPrefixUsage=[STRING]-IPv6PoolUpperValue=[STRING]; High PD prefix resource usage alarm condition cleared. |
|
Variable fields |
$1: ISP domain name. $2: PD prefix usage. $3: Upper alarm threshold for IPv6 address or prefix usage. |
|
Severity level |
4 |
|
Example |
DOMAIN/4/DOMAIN_PD_PREF_UPTHR_ALM_REMOVE: -Domain=abc-PDPrefixUsage=50%-IPv6PoolUpperValue=80%; High PD prefix resource usage alarm condition cleared. |
|
Explanation |
The high PD prefix resource usage alarm was cleared when the usage of PD prefixes in the authorization IPv6 address pool or IPv6 address pool group for an ISP domain reached or dropped below the value calculated by using the following formula: Upper alarm threshold – (upper alarm threshold – lower alarm threshold)*10%. |
|
Recommended action |
No action is required. |
DOMAIN_WEB_SERVER_ACCESS
|
Message text |
-Domain=[STRING]-WebActiveServerURL=[STRING]; This trap is generated when the Web server is restored to available. |
|
Variable fields |
$1: ISP domain name. $2: URL of a Web server. |
|
Severity level |
5 |
|
Example |
DOMAIN/5/DOMAIN_WEB_SERVER_ACCESS: -MDC=1; -Domain=dom1-WebActiveServerURL=test.com; This trap is generated when the Web server is restored to available. |
|
Explanation |
This notification is generated when a Web server URL in an ISP domain becomes reachable. |
|
Recommended action |
No action is required. |
DOMAIN_WEB_SERVER_NOT_REACH
|
Message text |
-Domain=[STRING]-WebActiveServerURL=[STRING]; This trap is generated when the Web server is unavailable. |
|
Variable fields |
$1: ISP domain name. $2: URL of a Web server. |
|
Severity level |
4 |
|
Example |
DOMAIN/4/DOMAIN_WEB_SERVER_NOT_REACH: -MDC=1; -Domain=1-WebActiveServerURL=test.com; This trap is generated when the Web server is unavailable. |
|
Explanation |
This notification is generated when all Web server URLs in an ISP domain become unreachable. |
|
Recommended action |
1. Check the links between the device and the unreachable Web server for connectivity issues and resolve the issues. 2. Verify that the Web server URL configuration is correct in the ISP domain. |
DOMAIN_WEB_SERVER_URL_SWITCH
|
Message text |
-Domain=[STRING]-WebActiveServerURL=[STRING]; This trap is generated when the valid URL of the Web server changes. |
|
Variable fields |
$1: ISP domain name. $2: URL of the Web server in use. |
|
Severity level |
4 |
|
Example |
DOMAIN/4/DOMAIN_WEB_SERVER_URL_SWITCH: -MDC=1; -Domain=dom1-WebActiveServerURL= test1.com; This trap is generated when the valid URL of the Web server changes. |
|
Explanation |
This notification is generated when the URL of the Web server in use is changed to another URL in the following situations: · Configuration changes for the URL of the Web server in use. · The URL of the primary server becomes unreachable. The URL in use is changed to the URL of the secondary Web server. · The URL of the primary server becomes reachable. The URL in use is changed from the URL of the secondary Web server to the URL of the primary Web server. |
|
Recommended action |
1. Verify that the Web server URL settings are configured as expected in the ISP domain. 2. Check the links between the device and the unreachable Web server for connectivity issues and resolve the issues. |
DOT1X messages
This section contains 802.1X messages.
DOT1X_CLEAR_MAX_USER_THRESHOLD
|
Message text |
The max-user high alarm condition cleared when the percentage of online 802.1X users reached or dropped below the max-user clear threshold on interface [STRING]. |
|
Variable fields |
$1: Interface type and number. |
|
Severity level |
5 |
|
Example |
DOT1X/5/DOT1X_CLEAR_MAX_USER_THRESHOLD: The max-user high alarm condition cleared when the percentage of online 802.1X users reached or dropped below the max-user clear threshold on interface GigabitEthernet1/0/1. |
|
Explanation |
The percentage of current online 802.1X users to the maximum number of concurrent 802.1X users on the interface dropped to the alarm clear threshold from a value above or equal to the alarm threshold. |
|
Recommended action |
No action is required. |
DOT1X_LOGIN_FAILURE
|
Message text |
-IfName=[STRING]-MACAddr=[STRING]-SVLAN=[STRING]-CVLAN=[STRING]-Username=[STRING]; User failed 802.1X authentication. Reason:[STRING]. |
|
Variable fields |
$1: Interface type and number. $2: MAC address. $3: CVLAN ID. $4: SVLAN ID. $5: Username. $6: Authentication failure reason. Values include: ¡ Supplicant logoff. ¡ Port status error. ¡ Supplicant restart. ¡ Reauthentication failure. ¡ Deauthorization by the device. ¡ Port went down and then came up again. ¡ The port was administratively down. ¡ Account password error. ¡ Online handshake failure. ¡ Idle timeout. ¡ Session timeout. ¡ Server request. ¡ Real-time accounting failure. ¡ Default error. ¡ Port error. |
|
Severity level |
6 |
|
Example |
DOT1X/6/DOT1X_LOGIN_FAILURE:-IfName=GigabitEthernet1/0/4-MACAddr=0010-8400-22b9- SVLANID=444-CVLANID=555-Username=aaa; User failed 802.1X authentication. Reason: Supplicant logoff. |
|
Explanation |
The user failed 802.1X authentication. |
|
Recommended action |
Locate the failure cause and handle the issue according to the failure cause. |
DOT1X_LOGIN_SUCC
|
Message text |
-IfName=[STRING]-MACAddr=[STRING]-SVLAN=[STRING]-CVLAN=[STRING]-Username=[STRING]; User passed 802.1X authentication and came online. |
|
Variable fields |
$1: Interface type and number. $2: MAC address. $3: SVLAN ID. $4: CVLAN ID. $5: Username. |
|
Severity level |
6 |
|
Example |
DOT1X/6/DOT1X_LOGIN_SUCC:-IfName=GigabitEthernet1/0/4-MACAddr=0010-8400-22b9-SVLANID=444-CVLANID=555-Username=aaa; User passed 802.1X authentication and came online. |
|
Explanation |
The user passed 802.1X authentication. |
|
Recommended action |
No action is required. |
DOT1X_LOGOFF
|
Message text |
-IfName=[STRING]-MACAddr=[STRING]-SVLAN=[STRING]-CVLAN=[STRING]-Username=[STRING]; 802.1X user was logged off. |
|
Variable fields |
$1: Interface type and number. $2: MAC address. $3: SVLAN ID. $4: CVLAN ID. $5: Username. |
|
Severity level |
6 |
|
Example |
DOT1X/6/DOT1X_LOGOFF:-IfName=GigabitEthernet1/0/4-MACAddr=0010-8400-22b9-SVLANID=444-CVLANID=555-Username=aaa; 802.1X user was logged off. |
|
Explanation |
The 802.1X user was logged off. |
|
Recommended action |
No action is required. |
DOT1X_LOGOFF_ABNORMAL
|
Message text |
-IfName=[STRING]-MACAddr=[STRING]-SVLAN=[STRING]-CVLAN=[STRING]-Username=[STRING]; 802.1X user was logged off abnormally. Reason:[STRING]. |
|
Variable fields |
$1: Interface type and number. $2: MAC address. $3: SVLAN ID. $4: CVLAN ID. $5: Username. $6: 802.1X user logoff reason. Values include: ¡ Supplicant logoff. ¡ Port status error. ¡ Supplicant restart. ¡ Reauthentication failure. ¡ Deauthorization by the device. ¡ Port went down and then came up again. ¡ The port was administratively down. ¡ Account password error. ¡ Online handshake failure. ¡ Idle timeout. ¡ Session timeout. ¡ Server request. ¡ Real-time accounting failure. ¡ Default error. ¡ Port error. |
|
Severity level |
6 |
|
Example |
DOT1X/6/DOT1X_ ABNORMAL:-IfName=GigabitEthernet1/0/4-MACAddr=0010-8400-22b9-SVLANID=444-CVLANID=555-Username=aaa; 802.1X user was logged off abnormally. Reason: Supplicant logoff. |
|
Explanation |
The 802.1X user was abnormally logged off. |
|
Recommended action |
Locate the logoff cause and remove the issue. |
DOT1X_MAX_USER_THRESHOLD
|
Message text |
The percentage of online 802.1X users exceeded the max-user high alarm threshold on interface [STRING]. |
|
Variable fields |
$1: Interface type and number. |
|
Severity level |
4 |
|
Example |
DOT1X/4/DOT1X_MAX_USER_THRESHOLD: The percentage of online 802.1X users exceeded the max-user high alarm threshold on interface GigabitEthernet1/0/1. |
|
Explanation |
The percentage of current online 802.1X users to the maximum number of concurrent 802.1X users on the interface reached the specified alarm threshold for the first time, or increased to the alarm threshold from a value below or equal to the alarm clear threshold. |
|
Recommended action |
1. Use the display dot1x interface command to view the maximum number of concurrent 802.1X users on the interface. If the maximum number is too small, reconfigure by using the dot1x max-user command. 2. Use the display dot1x command to view the alarm threshold for online 802.1X users. If the alarm threshold is too low, reconfigure by using the dot1x max-user-alarm command. 3. Collect notification messages, log messages, and configuration information and contact Technical Support. |
DSYSM messages
This section contains DSYSM messages.
INNERLINK_EXCEPTION
|
Message text |
An exception has occured on an internal link. |
|
Variable fields |
N/A |
|
Severity level |
3 (Error) |
|
Example |
DSYSM/3/INNERLINK_EXCEPTION: -MDC=1; An exception has occured on an internal link. |
|
Impact |
The device cannot correctly communicate with other devices, which affects the running of user services. |
|
Cause |
A hardware fault occurred on the MPU, causing abnormal communication on an internal chip link between modules. |
|
Recommended action |
To resolve the issue, contact Technical Support for help. |
CTRL_CHANNEL_IS_ERR
|
Message text |
The control channel status was abnormal. |
|
Variable fields |
N/A |
|
Severity level |
3 (Error) |
|
Example |
DSYSM/3/CTRL_CHANNEL_IS_ERR: -MDC=1; The control channel status was abnormal. |
|
Impact |
Modules might have hardware failures and might not operate correctly. |
|
Cause |
The control channel remains in abnormal state and the massage is generated every 10 minutes. The reason might be hardware control link errors. |
|
Recommended action |
1. Reboot or replace modules. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
CTRL_CHANNEL_TO_OK
|
Message text |
The control channel status changed to normal. |
|
Variable fields |
N/A |
|
Severity level |
3 (Error) |
|
Example |
DSYSM/3/CTRL_CHANNEL_TO_OK: -MDC=1; The control channel status changed to normal. |
|
Impact |
No negative impact on the system. |
|
Cause |
The control channel state changed to normal. |
|
Recommended action |
No action is required. |
CTRL_CHANNEL_TO_ERR
|
Message text |
The control channel status changed to abnormal. |
|
Variable fields |
N/A |
|
Severity level |
3 (Error) |
|
Example |
DSYSM/3/CTRL_CHANNEL_TO_ERR: -MDC=1; The control channel status changed to abnormal. |
|
Impact |
No negative impact on the system. |
|
Cause |
The control channel state changed to abnormal, which might be caused by hardware control link errors. |
|
Recommended action |
1. Reboot or replace modules. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
SUBCARD_CONFLICT_SLOT
|
Message text |
The interface module inserted in slot [UINT16] cannot operate correctly because it conflicts with the interface module in slot [UINT16]. |
|
Variable fields |
$1: Slot number for inserted module. $2: Slot number for mutually exclusive module. |
|
Severity level |
2 (Critical) |
|
Example |
DSYSM/2/SUBCARD_CONFLICT_SLOT: The interface module inserted in slot 4 cannot operate correctly because it conflicts with the interface module in slot 6. |
|
Impact |
The interface module inserted in slot cannot operate correctly because it conflicts with the interface module in slot. |
|
Cause |
When an SRFP-A1 or SRFP-A2 service route forwarding processing module is installed in a CR16000-M8 device, if there is a conflict with the interface module in the slot, the system will log the event. |
|
Recommended action |
1. Identify the affected slot number and the associated mutually exclusive slot numbers. 2. Make sure there is no conflict with the interface module in the slot. 3. Select the correct module combinations for installation according to the compatibility guide. 4. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
EDEV messages
This section contains messages for extended-device management.
EDEV_FAILOVER_GROUP_STATE_CHANGE
|
Message text |
Status of stateful failover group [STRING] with ID [UINT32] changed to [STRING]. |
|
Variable fields |
$1: Failover group name. $2: Failover group ID. $3: Failover group state. |
|
Severity level |
5 |
|
Example |
|
|
Explanation |
The status of a failover group changed. |
|
Recommended action |
No action is required. |
EIGRP messages
This section contains EIGRP messages.
RID_CHANGE
|
Message text |
EIGRP [UINT32]: New elected router ID will take effect after EIGRP address family is reset. |
|
Variable fields |
$1: EIGRP process ID. |
|
Severity level |
5 |
|
Example |
EIGRP/5/RID_CHANGE: EIGRP 1: New elected router ID will take effect after EIGRP address family is reset. |
|
Explanation |
A change of interface IP address causes the change of router ID for the EIGRP router. You must restart the EIGRP IPv4 address family to make the new router ID take effect. |
|
Recommended action |
Execute the reset eigrp process command to make the new router ID take effect. |
PEER_CHANGE
|
Message text |
EIGRP [UINT32]: Neighbor [STRING] ([STRING]) is [STRING]: [STRING]. |
|
Variable fields |
$1: EIGRP process ID. $2: IP address of the neighbor router. $3: Interface that is connected to the neighbor router. $4: Neighbor state, Up or Down. $5: Reason for the EIGRP neighbor state change. For information about the neighbor state change reasons, see Table 6. |
|
Severity level |
5 |
|
Example |
EIGRP/5/PEER_CHANGE: EIGRP 2: Neighbor 100.100.10.2 (GigabitEthernet1/0/1) is Up: New neighbor. |
|
Explanation |
The EIGRP neighbor state changed for a specific reason. |
|
Recommended action |
Take an action according to the neighbor state change reason. For more information, see Table 6. |
Table 6 Neighbor state change reasons and recommended actions
|
Reason |
Remarks |
Recommended action |
|
New neighbor |
N/A |
No action is required. |
|
Interface down |
N/A |
Check the network connectivity. |
|
Reset operation |
The reset eigrp process or reset eigrp peer command was executed. |
No action is required. |
|
Delete operation |
The process or address family was deleted. |
No action is required. |
|
Hold timer expired |
N/A |
Check the network status or check whether the hold timer is appropriate. |
|
Maximum retransmission times reached |
N/A |
Check the network status. |
|
Inconsistent K values |
N/A |
Check whether the K values are consistent on both ends. |
|
Neighbor restart |
N/A |
Check the network status and check whether an operation that affects neighbor relationship has been performed on the neighbor router. |
|
Stuck in active |
N/A |
Check the network status and CPU usage on the neighbor router. |
|
Peer termination |
The neighbor actively terminated the neighbor relationship. |
Check whether an operation that affects neighbor relationship has been performed on the neighbor router. |
|
Configuration changed |
N/A |
Check whether the configuration is correct. |
|
Process switchover |
EIGRP process switchover occurred. |
No action is required. |
|
Insufficient memory |
The memory threshold was reached. |
Check system memory and release available memory by adjusting the modules that occupy too much memory. |
EKDM messages
This section contains EKDM messages.
EKDM_REBOOT_PREVNT
|
Message text |
Standby MPU in slot [UINT32] rebooted abnormally [UINT32] times and was prevented from rebooting again. |
|
Variable fields |
$1: Slot number of a standby MPU on the device. $2: Number of reboot times. |
|
Severity level |
2 (Critical) |
|
Example |
DEVD/2/EKDM_REBOOT_PREVNT: -MDC=1; Standby MPU in slot 1 rebooted abnormally 4 times and was prevented from rebooting again. |
|
Impact |
The standby MPU cannot operate correctly. |
|
Cause |
The system does not start the standby MPU again after the MPU has exceptionally rebooted four times. |
|
Recommended action |
1. Replace the standby MPU. 2. If the issue persists, contact Technical Support for help. |
ETH messages
This section contains Ethernet module messages.
ETH_VLAN_TERMINATION_FAILED
|
Message text |
The vlan-type dot1q configuration on [STRING] failed. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
ETH/4/ETH_VLAN_TERMINATION_FAILED: -MDC=1; The vlan-type dot1q configuration on GigabitEthernet1/0/1.1 failed. |
|
Explanation |
The system failed to assign an interface the VLAN termination configuration commands started with the vlan-type dot1q keywords. The possible reason is insufficient hardware resources. |
|
Recommended action |
Please contact H3C Support. |
ETH_VLAN_TERMINATION_NOT_SUPPORT
|
Message text |
The vlan-type dot1q configuration on [STRING] is not supported. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
ETH/4/ETH_VLAN_TERMINATION_NOT_SUPPORT: -MDC=1; The vlan-type dot1q configuration on GigabitEthernet1/0/1.1 is not supported. |
|
Explanation |
An interface does not support VLAN termination configuration commands started with the vlan-type dot1q keywords. |
|
Recommended action |
Verify that the card where the interface resides supports VLAN termination. |
ETH_VMAC_INEFFECTIVE
|
Message text |
Interface [STRING] failed to add a virtual MAC: [STRING]. |
|
Variable fields |
$1: Interface name. $2: Reason why the device failed to add a virtual MAC address to the interface. |
|
Severity level |
3 |
|
Example |
ETH/3/ETH_VMAC_INEFFECTIVE: Interface GigabitEthernet1/0/1 failed to add a virtual MAC: Insufficient hardware resources. |
|
Explanation |
The device failed to add a virtual MAC address to an interface. |
|
Recommended action |
Troubleshoot the operation failure. For example, if hardware resources are insufficient because the number of virtual MAC addresses for VRRP on an interface has reached the upper limit, remove free VRRP groups to release resources. |
ETHOAM messages
This section contains Ethernet OAM messages.
ETHOAM_CONNECTION_FAIL_DOWN
|
Message text |
The link is down on interface [string] because a remote failure occurred on peer interface. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
5 |
|
Example |
ETHOAM/5/ETHOAM_CONNECTION_FAIL_DOWN: The link is down on interface Ethernet1/0/1 because a remote failure occurred on peer interface. |
|
Explanation |
The link goes down because a remote failure occurred on the peer interface. |
|
Recommended action |
Check the link status or the OAM status on the peer. |
ETHOAM_CONNECTION_FAIL_TIMEOUT
|
Message text |
Interface [string] removed the OAM connection because it received no Information OAMPDU before the timer times out. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
5 |
|
Example |
ETHOAM/5/ETHOAM_CONNECTION_FAIL_TIMEOUT: Interface Ethernet1/0/1 removed the OAM connection because it received no Information OAMPDU before the timer times out. |
|
Explanation |
The interface removed the OAM connection because it had not received Information OAMPDUs before the timer timed out. |
|
Recommended action |
Check the link status or the OAM status on the peer. |
ETHOAM_CONNECTION_FAIL_UNSATISF
|
Message text |
Interface [string] failed to establish an OAM connection because the peer doesn’t match the capacity of the local interface. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
3 |
|
Example |
ETHOAM/3/ETHOAM_CONNECTION_FAIL_UNSATISF: Interface Ethernet1/0/1 failed to establish an OAM connection because the peer doesn’t match the capacity of the local interface. |
|
Explanation |
Failed to establish an OAM connection because the peer does not match the OAM protocol state of the local interface. |
|
Recommended action |
Check the State field of the OAMPDUs sent from both ends. |
ETHOAM_CONNECTION_SUCCEED
|
Message text |
An OAM connection is established on interface [string]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
6 |
|
Example |
ETHOAM/6/ETHOAM_CONNECTION_SUCCEED: An OAM connection is established on interface Ethernet1/0/1. |
|
Explanation |
An OAM connection is established. |
|
Recommended action |
No action is required. |
ETHOAM_DISABLE
|
Message text |
Ethernet OAM is now disabled on interface [string]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
6 |
|
Example |
ETHOAM/6/ETHOAM_DISABLE: Ethernet OAM is now disabled on interface Ethernet1/0/1. |
|
Explanation |
Ethernet OAM is disabled. |
|
Recommended action |
No action is required. |
ETHOAM_DISCOVERY_EXIT
|
Message text |
OAM interface [string] quit the OAM connection. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
5 |
|
Example |
ETHOAM/5/ ETHOAM_DISCOVERY_EXIT: OAM interface Ethernet1/0/1 quit the OAM connection. |
|
Explanation |
The local interface ended the OAM connection. |
|
Recommended action |
No action is required. |
ETHOAM_ENABLE
|
Message text |
Ethernet OAM is now enabled on interface [string]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
6 |
|
Example |
ETHOAM/6/ETHOAM_ENABLE: Ethernet OAM is now enabled on interface Ethernet1/0/1. |
|
Explanation |
Ethernet OAM is enabled. |
|
Recommended action |
No action is required. |
ETHOAM_ENTER_LOOPBACK_CTRLLED
|
Message text |
The local OAM entity enters remote loopback as controlled DTE on OAM interface [string]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
6 |
|
Example |
ETHOAM/6/ ETHOAM_ENTER_LOOPBACK_CTRLLED: The local OAM entity enters remote loopback as controlled DTE on OAM interface Ethernet1/0/1. |
|
Explanation |
The local OAM entity enters remote loopback as controlled DTE after you enable OAM loopback on the peer end. |
|
Recommended action |
No action is required. |
ETHOAM_ENTER_LOOPBACK_CTRLLING
|
Message text |
The local OAM entity enters remote loopback as controlling DTE on OAM interface [string]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
6 |
|
Example |
ETHOAM/6/ ETHOAM_ENTER_LOOPBACK_CTRLLING: The local OAM entity enters remote loopback as controlling DTE on OAM interface Ethernet1/0/1. |
|
Explanation |
The local OAM entity enters remote loopback as controlling DTE after you enable OAM loopback on the interface. |
|
Recommended action |
No action is required. |
ETHOAM_LOCAL_DYING_GASP
|
Message text |
A local Dying Gasp event has occurred on [string]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
ETHOAM/4/ETHOAM_LOCAL_DYING_GASP: A local Dying Gasp event occurred on interface Ethernet1/0/1. |
|
Explanation |
A local Dying Gasp event occurs when you reboot the local device or shut down the interface. |
|
Recommended action |
Do not use the link until it recovers. |
ETHOAM_LOCAL_ERROR_FRAME
|
Message text |
An errored frame event occurred on local interface [string]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
6 |
|
Example |
ETHOAM/6/ETHOAM_LOCAL_ERROR_FRAME: An errored frame event occurred on local interface Ethernet1/0/1. |
|
Explanation |
An errored frame event occurred on the local interface. |
|
Recommended action |
Check the link between the local and peer ends. |
ETHOAM_LOCAL_ERROR_FRAME_PERIOD
|
Message text |
An errored frame period event occurred on local interface [string]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
6 |
|
Example |
ETHOAM/6/ETHOAM_LOCAL_ERROR_FRAME_PERIOD: An errored frame period event occurred on local interface Ethernet1/0/1. |
|
Explanation |
An errored frame period event occurred on the local interface. |
|
Recommended action |
Check the link between the local and peer ends. |
ETHOAM_LOCAL_ERROR_FRAME_SECOND
|
Message text |
An errored frame seconds event occurred on local interface [string]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
6 |
|
Example |
ETHOAM/6/ETHOAM_LOCAL_ERROR_FRAME_SECOND: An errored frame seconds event occurred on local interface Ethernet1/0/1. |
|
Explanation |
An errored frame seconds event occurred on the local interface. |
|
Recommended action |
Check the link between the local and peer ends. |
ETHOAM_LOCAL_LINK_FAULT
|
Message text |
A local Link Fault event occurred on interface [string]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
ETHOAM/4/ETHOAM_LOCAL_LINK_FAULT: A local Link Fault event occurred on interface Ethernet1/0/1. |
|
Explanation |
A local Link Fault event occurred when the local link goes down. |
|
Recommended action |
Re-connect the Rx end of the fiber on the local interface. |
ETHOAM_LOOPBACK_EXIT
|
Message text |
OAM interface [string] quit remote loopback. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
ETHOAM/4/ETHOAM_LOOPBACK_EXIT: OAM interface Ethernet1/0/1 quit remote loopback. |
|
Explanation |
The OAM interface ended remote loopback after one of the following events occurred: · Remote loopback was disabled on the interface before the OAM connection was established. · The established OAM connection was torn down. |
|
Recommended action |
No action is required. |
ETHOAM_LOOPBACK_EXIT_ERROR_STATU
|
Message text |
OAM interface [string] quit remote loopback due to incorrect multiplexer or parser status. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
6 |
|
Example |
ETHOAM/6/ETHOAM_LOOPBACK_EXIT_ERROR_STATU: OAM interface Ethernet1/0/1 quit remote loopback due to incorrect multiplexer or parser status. |
|
Explanation |
OAM interface Ethernet1/0/1 ended remote loopback due to incorrect multiplexer or parser status. |
|
Recommended action |
Disable and then re-enable Ethernet OAM on the OAM entity. |
ETHOAM_LOOPBACK_NO_RESOURCE
|
Message text |
OAM interface [string] can’t enter remote loopback due to insufficient resources. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
ETHOAM/4/ETHOAM_LOOPBACK_NO_RESOURCE: OAM interface Ethernet1/0/1 can’t enter remote loopback due to insufficient resources. |
|
Explanation |
The OAM interface cannot enter remote loopback due to insufficient resources when you execute the oam remote-loopback start command on the local or remote OAM entity. |
|
Recommended action |
To enable remote loopback on an interface, you must set the hardware forwarding resources on the interface. Enabling remote loopback on a large number of interfaces might cause insufficient resources. Disable remote loopback on other interfaces, and execute the oam remote-loopback start command on the interface again. |
ETHOAM_LOOPBACK_NOT_SUPPORT
|
Message text |
OAM interface [string] can’t enter remote loopback because the operation is not supported. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
ETHOAM/4/ETHOAM_LOOPBACK_NOT_SUPPORT: OAM interface Ethernet1/0/1 can't enter remote loopback because the operation is not supported. |
|
Explanation |
The OAM interface cannot enter remote loopback because the operation is not supported on the device. |
|
Recommended action |
No action is required. |
ETHOAM_QUIT_LOOPBACK_CTRLLED
|
Message text |
The local OAM entity quit remote loopback as controlled DTE on OAM interface [string]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
6 |
|
Example |
ETHOAM/6/ ETHOAM_QUIT_LOOPBACK_CTRLLED: The local OAM entity quit remote loopback as controlled DTE on OAM interface Ethernet1/0/1. |
|
Explanation |
As the Loopback Control OAMPDUs receiving end, the local end quit remote loopback after you disabled OAM loopback on the peer end. |
|
Recommended action |
No action is required. |
ETHOAM_QUIT_LOOPBACK_CTRLLING
|
Message text |
The local OAM entity quit remote loopback as controlling DTE on OAM interface [string]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
6 |
|
Example |
ETHOAM/6/ETHOAM_QUIT_LOOPBACK_CONTROLLING: The local OAM entity quit remote loopback as controlling DTE on OAM interface Ethernet1/0/1. |
|
Explanation |
The local end quit remote loopback after you disabled OAM loopback on the local interface. |
|
Recommended action |
No action is required. |
ETHOAM_REMOTE_CRITICAL
|
Message text |
A remote Critical event occurred on interface [string]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
ETHOAM/4/ETHOAM_REMOTE_CRITICAL: A remote Critical event occurred on interface Ethernet1/0/1. |
|
Explanation |
A remote critical event occurred. |
|
Recommended action |
Do not use the link until it recovers. |
ETHOAM_REMOTE_DYING_GASP
|
Message text |
A remote Dying Gasp event occurred on interface [string]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
ETHOAM/4/ETHOAM_REMOTE_DYING_GASP: A remote Dying Gasp event occurred on interface Ethernet1/0/1. |
|
Explanation |
A remote Dying Gasp event occurred when you reboot the remote device and shut down the interface. |
|
Recommended action |
Do not use this link until it recovers. |
ETHOAM_REMOTE_ERROR_FRAME
|
Message text |
An errored frame event occurred on the peer interface [string]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
6 |
|
Example |
ETHOAM/6/ETHOAM_REMOTE_ERROR_FRAME: An errored frame event occurred on the peer interface Ethernet1/0/1. |
|
Explanation |
An errored frame event occurred on the peer. |
|
Recommended action |
Check the link between the local and peer ends. |
ETHOAM_REMOTE_ERROR_FRAME_PERIOD
|
Message text |
An errored frame period event occurred on the peer interface [string]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
6 |
|
Example |
ETHOAM/6/ETHOAM_REMOTE_ERROR_FRAME_PERIOD: An errored frame period event occurred on the peer interface Ethernet1/0/1. |
|
Explanation |
An errored frame period event occurred on the peer interface. |
|
Recommended action |
Check the link between the local and peer ends. |
ETHOAM_REMOTE_ERROR_FRAME_SECOND
|
Message text |
An errored frame seconds event occurred on the peer interface [string]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
6 |
|
Example |
ETHOAM/6/ETHOAM_REMOTE_ERROR_FRAME_SECOND: An errored frame seconds event occurred on the peer interface Ethernet1/0/1. |
|
Explanation |
An errored frame seconds event occurred on the peer. |
|
Recommended action |
Check the link between the local and peer ends. |
ETHOAM_REMOTE_ERROR_SYMBOL
|
Message text |
An errored symbol event occurred on the peer interface [string]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
6 |
|
Example |
ETHOAM/6/ETHOAM_REMOTE_ERROR_SYMBOL: An errored symbol event occurred on the peer interface Ethernet1/0/1. |
|
Explanation |
An errored symbol event occurred on the peer. |
|
Recommended action |
Check the link between the local and peer ends. |
ETHOAM_REMOTE_EXIT
|
Message text |
OAM interface [string] quit OAM connection because Ethernet OAM is disabled on the peer interface. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
5 |
|
Example |
ETHOAM/5/ ETHOAM_REMOTE_EXIT: OAM interface Ethernet1/0/1 quit OAM connection because Ethernet OAM is disabled on the peer interface. |
|
Explanation |
The local interface ended the OAM connection because Ethernet OAM was disabled on the peer interface. |
|
Recommended action |
No action is required. |
ETHOAM_REMOTE_FAILURE_RECOVER
|
Message text |
Peer interface [string] recovered. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
5 |
|
Example |
ETHOAM/5/ ETHOAM_REMOTE_FAILURE_RECOVER: Peer interface Ethernet1/0/1 recovered. |
|
Explanation |
The Link fault was cleared from the peer interface and the OAM connection was restored. |
|
Recommended action |
No action is required. |
ETHOAM_REMOTE_LINK_FAULT
|
Message text |
A remote Link Fault event occurred on interface [string]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
ETHOAM/4/ETHOAM_REMOTE_LINK_FAULT: A remote Link Fault event occurred on interface Ethernet1/0/1. |
|
Explanation |
A remote Link Fault event occurred when the remote link went down. |
|
Recommended action |
Reconnect the Rx end of the fiber on the remote interface. |
ETHOAM_NO_ENOUGH_RESOURCE
|
Message text |
The configuration failed on OAM interface [string] because of insufficient resources. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
ETHOAM/4/ ETHOAM_NO_ENOUGH_RESOURCE: The configuration failed on OAM interface Ethernet1/0/1 because of insufficient resources. |
|
Explanation |
The configuration failed on the OAM interface because of insufficient system resources. |
|
Recommended action |
Remove useless configurations to release the resources, and execute the command again. |
ETHOAM_NOT_CONNECTION_TIMEOUT
|
Message text |
Interface [string] quit Ethernet OAM because it received no Information OAMPDU before the timer times out. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
5 |
|
Example |
ETHOAM/5/ ETHOAM_NOT_CONNECTION_TIMEOUT: Interface Ethernet1/0/1 quit Ethernet OAM because it received no Information OAMPDU before the timer times out. |
|
Explanation |
The local interface ended Ethernet OAM because it had not received Information OAMPDUs before the timer timed out. |
|
Recommended action |
Check the link status and the OAM status on the peer. |
EVPN messages
This section contains EVPN messages.
FDB/3/EVPN_MACMOVE_REPORT
|
Message text |
Reporting of the local MAC address [STRING] in VSI index [UNIT32] is suppressed. |
|
Variable fields |
$1: MAC address $2: VSI index. |
|
Severity level |
6 (Informational) |
|
Example |
FDB/6/EVPN_MACMOVE_REPORT: Reporting of the local MAC address 0001-0001-0001 in VSI index 0 is suppressed. |
|
Impact |
Suppression of local EVPN MAC move reports for business traffic might result in the discarding of business packets. |
|
Cause |
The PE detects that the migration times of a MAC address exceeds the report suppression threshold within a detection interval, and suppresses local move reports for the MAC address. |
|
Recommended action |
1. Make sure the user devices attached to the PE use unique MAC addresses. 2. If MAC address migrations are unavoidable, execute the evpn mac-move local-suppression command to set the report suppression threshold to 100 or higher. 3. If this message persists, execute the evpn mac-move local-suppression check-interval 0 command to disable suppression of local EVPN MAC move reports. |
FDB/3/EVPN_MACMOVE_LOG
|
Message text |
The remaining EVPN_MACMOVE_REPORT logs will not be printed because the number of logs exceeds 100 within 3 minutes. |
|
Variable fields |
N/A |
|
Severity level |
6 (Informational) |
|
Example |
FDB/6/EVPN_MACMOVE_REPORT: Reporting of the local MAC address 0001-0001-0001 in VSI index 0 is suppressed. FDB/6/EVPN_MACMOVE_REPORT: Reporting of the local MAC address 0001-0001-0002 in VSI index 0 is suppressed. ... FDB/6/EVPN_MACMOVE_LOG: The remaining EVPN_MACMOVE_REPORT logs will not be printed because the number of logs exceeds 100 within 3 minutes. |
|
Impact |
None. |
|
Cause |
A large number of MAC address migrations occur within a short period in the EVPN network, which triggers suppression of local EVPN MAC move reports. |
|
Recommended action |
If the issue persists, collect the configuration file, log messages, and alarm information, and then contact Technical Support. |
FDB messages
This section contains FDB messages.
MAC_REACH_LIMIT
|
Message text |
Pattern 1: The number of mac address received in interface [STRING] reaches the upper limit. Pattern 2: The number of mac address received in VLAN [INT32] reaches the upper limit. |
|
Variable fields |
Pattern 1: $1: Interface name. Pattern 2: $1: VLAN ID. |
|
Severity level |
6 (Informational) |
|
Example |
FDB/6/MAC_REACH_LIMIT: -MDC=1-Slot=3; The number of mac address received in interface Ten-GigabitEthernet3/0/5 reaches the upper limit. |
|
Impact |
The number of MAC addresses has exceeded the upper limit for hardware. New MAC addresses cannot be learned. |
|
Cause |
The number of MAC addresses learned by an interface or VLAN has reached the upper limit. |
|
Recommended action |
1. Verify that the number of configured MAC addresses does not exceed the upper limit for hardware. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
FIB messages
This section contains FIB messages.
FIB_BOARDMSG_CONGEST
|
Message text |
· Pattern 1: The FIB message on the board is congested: SlotID=[UINT32]. · Pattern 2: The FIB message on the board is congested: Chassis=[UINT32], SlotID=[UINT32]. |
|
Variable fields |
In pattern 1: $1: Slot number. In pattern 2: $1: Chassis number. $2: Slot number. |
|
Severity level |
4 |
|
Example |
· Text 1: FIB/4/FIB_BOARDMSG_CONGEST: The FIB message on the board is congested: SlotID=2. · Text 2: FIB/4/FIB_BOARDMSG_CONGEST: The FIB message on the board is congested: Chassis=1, SlotID=2. |
|
Explanation |
Packet forwarding congestion occurred on the current card. |
|
Recommended action |
Check for packet attacks. |
FIB_BOARDMSG_CONGESTRESUME
|
Message text |
· Pattern 1: The FIB message congestion is resolved: SlotID=[UINT32]. · Pattern 2: The FIB message congestion is resolved: Chassis=[UINT32], SlotID=[UINT32]. |
|
Variable fields |
In pattern 1: $1: Slot number. In pattern 2: $1: Chassis number. $2: Slot number. |
|
Severity level |
5 |
|
Example |
· Pattern 1: FIB/4/FIB_BOARDMSG_CONGESTRESUME: The FIB message congestion is resolved: SlotID =2. · Pattern 2: FIB/4/FIB_BOARDMSG_CONGESTRESUME: The FIB message congestion is resolved: Chassis=1, SlotID =2. |
|
Explanation |
Packet forwarding congestion was resolved on the current card. |
|
Recommended action |
No action is required. |
FIB_FILE
|
Message text |
Failed to save the IP forwarding table due to lack of storage resources. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
FIB/4/FIB_FILE: -MDC=1; Failed to save the IP forwarding table due to lack of storage resources. |
|
Explanation |
Failed to save the IP forwarding table due to lack of storage resources. |
|
Recommended action |
Delete unused files to release storage space. |
FIB_OVERLOAD_FORWARD
|
Message text |
The system is in the overload forwarding state because the FIB module is overloaded: FibOverloadModule=[STRING]. |
|
Variable fields |
$1: FIB entry type: · FIB4—The number of IPv4 FIB entries has reached 80% of the upper limit. · FIB6—The number of IPv6 FIB entries has reached 80% of the upper limit. |
|
Severity level |
4 |
|
Example |
FIB/4/FIB_OVERLOAD_FORWARD: The system is in the overload forwarding state because the FIB module is overloaded: FibOverloadModule=FIB4. |
|
Explanation |
The number of FIB entries has reached 80% of the upper limit on the device. |
|
Recommended action |
Check for packet attacks. |
FIB_OVERLOAD_FORWARDRESUME
|
Message text |
|
|
Variable fields |
$1: FIB entry type: · FIB4—The number of IPv4 FIB entries has dropped to 50% of the upper limit. · FIB6—The number of IPv6 FIB entries has dropped to 50% of the upper limit. |
|
Severity level |
5 |
|
Example |
FIB/4/FIB_OVERLOAD_FORWARDRESUME: The system changes from the overload forwarding state to the normal state: FibOverloadModule=FIB4. |
|
Explanation |
The number of FIB entries has restored to normal on the device. |
|
Recommended action |
No action is required. |
FILTER messages
This section contains filter messages.
FILTER_EXECUTION_ICMP
|
Message text |
RcvIfName(1023)=[STRING];Direction(1070)=[STRING];AclType(1067)=[STRING];Acl(1068)=[STRING];Protocol(1001)=[STRING];SrcIPAddr(1003)=[IPADDR];DstIPAddr(1007)=[IPADDR];IcmpType(1062)=[STRING]([UINT16]);IcmpCode(1063)=[UINT16];MatchAclCount(1069)=[UINT32];Event(1048)=[STRING]; |
|
Variable fields |
$1: Receiving interface name. $2: Direction. $3: ACL type. $4: ACL number or name. $5: Layer 4 protocol name. $6: Source IP address. $7: Destination IP address. $8: ICMP message type. $9: ICMP message code. $10: Match count. $11: Event information. |
|
Severity level |
6 |
|
Example |
FILTER/6/FILTER_EXECUTION_ICMP: RcvIfName(1023)=GigabitEthernet2/0/2;Direction(1067)=inbound;AclType(1064)=ACL;Acl(1065)=3000;Protocol(1001)=ICMP;SrcIPAddr(1003)=100.1.1.1;DstIPAddr(1007)=200.1.1.1;IcmpType(1059)=Echo(8);IcmpCode(1060)=0;MatchAclCount(1066)=1000;Event(1048)=Permit; |
|
Explanation |
ICMP packets matched the packet filter. This message is sent when the first ICMP packet of a flow matches the packet filter, and it will be sent regularly for the flow. |
|
Recommended action |
No action is required. |
FILTER_EXECUTION_ICMPV6
|
Message text |
RcvIfName(1023)=[STRING];Direction(1070)=[STRING];AclType(1067)=[STRING];Acl(1068)=[STRING];Protocol(1001)=[STRING];SrcIPv6Addr(1036)=[IPADDR];DstIPv6Addr(1037)=[IPADDR];Icmpv6Type(1064)=[STRING]([UINT16]);Icmpv6Code(1065)=[UINT16];MatchAclCount(1069)=[UINT32];Event(1048)=[STRING]; |
|
Variable fields |
$1: Receiving interface name. $2: Direction. $3: ACL type. $4: ACL number or name. $5: Layer 4 protocol name. $6: Source IPv6 address. $7: Destination IPv6 address. $8: ICMPv6 message type. $9: ICMPv6 message code. $10: Match count. $11: Event information. |
|
Severity level |
6 |
|
Example |
FILTER/6/FILTER_EXECUTION_ICMPV6: RcvIfName(1023)=GigabitEthernet2/0/2;Direction(1067)=inbound;AclType(1064)=ACL;Acl(1065)=3000;Protocol(1001)=ICMPV6;SrcIPv6Addr(1036)=2001::1;DstIPv6Addr(1037)=3001::1;Icmpv6Type(1064)=Echo(128);Icmpv6Code(1065)=0;MatchAclCount(1066)=1000;Event(1048)=Permit; |
|
Explanation |
ICMPv6 packets matched the packet filter. This message is sent when the first ICMPv6 packet of a flow matches the packet filter, and it will be sent regularly for the flow. |
|
Recommended action |
No action is required. |
FILTER_IPV4_EXECUTION
|
Message text |
RcvIfName(1023)=[STRING];Direction(1070)=[STRING];AclType(1067)=[STRING];Acl(1068)=[STRING];Protocol(1001)=[STRING];SrcIPAddr(1003)=[IPADDR];SrcPort(1004)=[UINT16];DstIPAddr(1007)=[IPADDR];DstPort(1008)=[UINT16];MatchAclCount(1069)=[UINT32];Event(1048)=[STRING]; |
|
Variable fields |
$1: Receiving interface name. $2: Direction. $3: ACL type. $4: ACL number or name. $5: Layer 4 protocol name. $6: Source IP address. $7: Source port. $8: Destination IP address. $9: Destination port number. $10: Match count. $11: Event information. |
|
Severity level |
6 |
|
Example |
FILTER/6/FILTER_IPV4_EXECUTION: RcvIfName(1023)=GigabitEthernet2/0/2;Direction(1070)=inbound;AclType(1067)=ACL;Acl(1068)=3000;Protocol(1001)=TCP;SrcIPAddr(1003)=100.1.1.1;SrcPort(1004)=1025;DstIPAddr(1007)=200.1.1.1;DstPort(1008)=1026;MatchAclCount(1069)=1000;Event(1048)=Permit; |
|
Explanation |
Packets other than ICMP packets matched the packet filter. This message is sent when the first packet of a flow matches the packet filter, and it will be sent regularly for the flow. |
|
Recommended action |
No action is required. |
FILTER_IPV6_EXECUTION
|
Message text |
RcvIfName(1023)=[STRING];Direction(1070)=[STRING];AclType(1067)=[STRING];Acl(1068)=[STRING];Protocol(1001)=[STRING];SrcIPv6Addr(1036)=[IPADDR];SrcPort(1004)=[UINT16];DstIPv6Addr(1037)=[IPADDR];DstPort(1008)=[UINT16];MatchAclCount(1069)=[UINT32];Event(1048)=[STRING]; |
|
Variable fields |
$1: Receiving interface name. $2: Direction. $3: ACL type. $4: ACL number or name. $5: Layer 4 protocol name. $6: Source IPv6 address. $7: Source port number. $8: Destination IPv6 address. $9: Destination port number. $10: Match count. $11: Event information. |
|
Severity level |
6 |
|
Example |
FILTER/6/FILTER_IPV6_EXECUTION: RcvIfName(1023)=GigabitEthernet2/0/2;Direction(1070)=inbound;AclType(1067)=ACL;Acl(1068)=3000;Protocol(1001)=TCP;SrcIPv6Addr(1036)=2001::1;SrcPort(1004)=1025;DstIPv6Addr(1037)=3001::1;DstPort(1008)=1026;MatchAclCount(1069)=1000;Event(1048)=Permit; |
|
Explanation |
Packets other than ICMPv6 packets matched the packet filter. This message is sent when the first packet of a flow matches the packet filter, and it will be sent regularly for the flow. |
|
Recommended action |
No action is required. |
FTP messages
This section contains File Transfer Protocol messages.
FTP_ACL_DENY
|
Message text |
The FTP Connection [IPADDR]([STRING]) request was denied according to ACL rules. |
|
Variable fields |
$1: IP address of the FTP client. $2: VPN instance to which the FTP client belongs. |
|
Severity level |
5 |
|
Example |
FTP/5/FTP_ACL_DENY: The FTP Connection 1.2.3.4(vpn1) request was denied according to ACL rules. |
|
Explanation |
The FTP server denied a connection request based on the access control ACL.. |
|
Recommended action |
No action is required. |
FTPD_REACH_SESSION_LIMIT
|
Message text |
FTP client [STRING] failed to log in. The current number of FTP sessions is [NUMBER]. The maximum number allowed is ([NUMBER]). |
|
Variable fields |
$1: IP address of the FTP client. $2: Current number of FTP sessions. $3: Maximum number of FTP sessions allowed by the device. |
|
Severity level |
|
|
Example |
|
|
Explanation |
The number of FTP connections reached the limit. |
|
Recommended action |
1. Use the display current-configuration | include session-limit command to view the current limit for FTP connections. If the command does not display the limit, the device is using the default setting. 2. If you want to set a greater limit, execute the aaa session-limit command. If you think the limit is proper, no action is required. |
FTPC_FILETRANS_FINISH
|
Message text |
FTP file transfer finished: IPAddress=[STRING], LocalFileName=[STRING], RemoteFileName=[STRING], RetCode=[NUMBER], TransSize=[UINT32] bytes, TransPeriod=[UINT32] seconds. |
|
Variable fields |
$1: IP address of the FTP client. $2: Local file name. $3: Remote file name. $4: File transfer return code. ¡ 0: The file transfer succeeded. ¡ 14: User canceled the file transfer. ¡ 20: The file transfer was interrupted. $5: Size of the transferred file. $6: File transfer duration. |
|
Severity level |
6 |
|
Example |
FTP/6/FTPC_FILETRANS_FINISH: FTP file transfer finished: IPAddress=1.1.1.1, LocalFileName=aa, RemoteFileName=aa, RetCode=0, TransSize=2048 bytes, TransPeriod=10 seconds. |
|
Explanation |
A file transfer over FTP finished. |
|
Recommended action |
No action is required. |
FTPS_RENAME_CMD
|
Message text |
The [STRING] command was executed on the FTP client: FromFileName=[STRING], ToFileName=[STRING], UserName=[STRING], UserAddress=[STRING], LocalAddress=[STRING], VpnInstanceName=[STRING], ClientDataPort=[UINT32], Result=[STRING]. |
|
Variable fields |
$1: Command name. $2: Original file name. $3: New file name. $4: User name of the client. $5: IP address of the client. $6: IP address of the server. $7: VPN instance name. $8: Data port of the client. $9: Command execution result. |
|
Severity level |
5 |
|
Example |
FTPS/5/FTPS_RENAME_CMD: The rename command was executed on the FTP client: FromFileName=aa, ToFileName=bb, UserName=admin, UserAddress=1.1.1.2, LocalAddress=1.1.1.1, VpnInstanceName=vpn1, ClientDataPort=10000, Result=Succeeded. |
|
Explanation |
The rename command was executed on an FTP client. This command was output from the FTP server. |
|
Recommended action |
No action is required. |
FTPS_USER_LOGIN
|
Message text |
The user logged in successfully: UserName=[STRING], UserAddress=[STRING], LocalAddress=[STRING], VpnInstanceName=[STRING]. |
|
Variable fields |
$1: Username of the FTP client. $2: IP address of the FTP client. $3: IP address of the FTP server. $4: VPN instance name. |
|
Severity level |
5 |
|
Example |
FTPS/5/FTPS_USER_LOGIN: The user logged in successfully: UserName=admin, UserAddress=1.1.1.2, LocalAddress=1.1.1.1, VpnInstanceName=vpn1. |
|
Explanation |
An FTP client logged in to the FTP server successfully. |
|
Recommended action |
No action is required. |
FTPS_FILE_OVERWRITE
|
Message text |
File [STRING] was overwritten: UserName=[STRING], UserAddress=[STRING], LocalAddress=[STRING], VpnInstanceName=[STRING]. |
|
Variable fields |
$1: Name of the file on the server. $2: Username. $3: User's IP address. $4: Local IP address $5: VPN instance name. |
|
Severity level |
4 |
|
Example |
FTPS/4/FTPS_FILE_OVERWRITE: File aa was overwritten: UserName=admin, UserAddress=1.1.1.2, LocalAddress=1.1.1.1, VpnInstanceName=vpn1. |
|
Explanation |
A file on the FTP server was overwritten by a new file uploaded by a user. |
|
Recommended action |
No action is required. |
FTPS_CMD_EXECUTION
|
Message text |
The [STRING] command was executed on the FTP client: FileName/Dir=[STRING], UserName=[STRING], UserAddress=[STRING], LocalAddress=[STRING], VpnInstanceName=[STRING], ClientDataPort=[UINT32], TransSize=[NUMBER] bytes, TransPeriod=[UINT32] seconds, Result=[STRING]. |
|
Variable fields |
$1: Command name. $2: Original file/directory name. $3: User name of the client. $4: IP address of the client. $5: IP address of the server. $6: VPN instance name. $7: Data port of the client. $8: Size of the transferred file. $9: File transfer duration $9: Command execution result. |
|
Severity level |
5 |
|
Example |
FTPS/5/FTPS_CMD_EXECUTION: The get command was executed on the FTP client: FileName/Dir=aa, UserName=admin, UserAddress=1.1.1.2, LocalAddress=1.1.1.1, VpnInstanceName=vpn1, ClientDataPort=10000, TransSize=2048 bytes, TransPeriod=10 seconds, Result=Succeeded. |
|
Explanation |
A command was executed on an FTP client. This log is output from the FTP server. |
|
Recommended action |
No action is required. |
FTPS_TRS_FAIL
|
Message text |
The user failed to transfer data: UserName=[STRING], UserAddress=[STRING], LocalAddress=[STRING], VpnInstanceName=[STRING], Reason=[STRING]. |
|
Variable fields |
$1: Username. $2: User's IP address. $3: Local IP address. $4: VPN instance name. $5: Reason for the file transfer failure. |
|
Severity level |
3 |
|
Example |
FTPS/3/FTPS_TRS_FAIL: The user failed to transfer data: UserName=admin, UserAddress=1.1.1.2, LocalAddress=1.1.1.1, VpnInstanceName=vpn1, Reason=I can only retrieve regular files. |
|
Explanation |
A user failed to transfer a file over FTP. |
|
Recommended action |
1. Ensure network connectivity. 2. If the issue persists, contact Technical Support. |
gRPC messages
This section contains gRPC messages.
GRPC_DIALIN_CLI
|
Message text |
Processed a CLI operation request from user [STRING] at [STRING]: Session ID=[INT32], Result=[STRING], Error code=[STRING], Used time=[STRING]. |
|
Variable fields |
$1: Username of a user. $2: IPv4 or IPv6 address of a gRPC client. $3: gRPC session ID. $4: RPC operation result: ¡ Succeeded. ¡ Failed. $5: Error code. This field displays OK if the operation succeeded. $6: Time used, in seconds. |
|
Severity level |
6 |
|
Example |
GRPC/6/GRPC_DIALIN_CLI: Processed a CLI operation request from user test at ipv4:192.168.100.20:50051: Session ID=1, Result=Succeeded, Error code=OK, Used time=0.02s. |
|
Explanation |
The device processed a CLI operation requested by a gRPC client. |
|
Recommended action |
· If the operation succeeded, no action is required. · If the operation failed, contact H3C Support. |
GRPC_DIALIN_GET
|
Message text |
Processed a GET operation request from user [STRING] at [STRING]: Session ID=[INT32], Path=[STRING]/[STRING], Result=[STRING], Used time=[STRING]. |
|
Variable fields |
$1: Username of a user. $2: IPv4 or IPv6 address of a gRPC client. $3: gRPC session ID. $4: Module name in an Xpath path. $5: Table name in the Xpath path. $6: RPC operation result: ¡ Succeeded. ¡ Failed. $6: Time used, in seconds. |
|
Severity level |
6 |
|
Example |
GRPC/6/GRPC_DIALIN_GET: Processed a GET operation request from user test at ipv6:[11::86]: 50051: Session ID=1, Path=ACL/ACLBase, Result=Succeeded, Used time=0.02s. |
|
Explanation |
The device processed a Get operation requested by a gRPC client. |
|
Recommended action |
No action is required. |
GRPC_DIALOUT_EVENT
|
Message text |
Pushed event-triggered data to a collector: Collector IP=[STRING], Port=[STRING], VPN instance=[STRING], Source interface=[STRING], Sensor path=[STRING]. |
|
Variable fields |
$1: IPv4 or IPv6 address of a collector in a destination group. $2: Listening port of the collector. $3: VPN instance to which the collector belongs. This field displays N/A if the collector belongs to the public network. $4: Source interface for packets sent to the collector. $5: Name of a sensor path. |
|
Severity level |
6 |
|
Example |
GRPC/6/GRPC_DIALOUT_EVENT: Pushed event-triggered data to a collector: Collector IP=192.168.100.20, Port=50050, VPN instance=N/A, Source interface=loopback0, Sensor path=ifmgr/interfaceevent. |
|
Explanation |
The device pushed data collected by event-triggered sampling to a collector. |
|
Recommended action |
No action is required. |
GRPC_DIALOUT_SAMPLE
|
Message text |
Pushed periodic data to a collector: Collector IP=[STRING], Port=[STRING], VPN instance=[STRING], Source interface=[STRING], Sensor path=[STRING]. |
|
Variable fields |
$1: IPv4 or IPv6 address of a collector in a destination group. $2: Listening port of the collector. $3: VPN instance to which the collector belongs. This field displays N/A if the collector belongs to the public network. $4: Source interface for packets sent to the collector. $5: Name of a sensor path. |
|
Severity level |
6 |
|
Example |
GRPC/6/GRPC_DIALOUT_EVENT: Pushed event-triggered data to a collector: Collector IP=192.168.100.20, Port=50050, VPN instance=N/A, Source interface=loopback0, Sensor path=ifmgr/interfaceevent. |
|
Explanation |
The device pushed data collected by periodic sampling to a gRPC client. |
|
Recommended action |
No action is required. |
GRPC_ENABLE_WITHOUT_TLS
|
Message text |
PKI domain [STRING] isn't associated with a valid local certificate. The gRPC process will start without the PKI domain. |
|
Variable fields |
$1: PKI domain name. |
|
Severity level |
4 |
|
Example |
GRPC/4/GRPC_ENABLE_WITHOUT_TLS: PKI domain xxx isn't associated with a valid local certificate. The gRPC process will start without the PKI domain. |
|
Explanation |
Because the specified PKI domain was not associated with a valid local certificate, gRPC could not use the PKI domain to establish a secure connection to the collector. The connection between the device and collector would not provide data encryption service. |
|
Recommended action |
No action is required. |
GRPC_GNMI_CAPABILITY
|
Message text |
Processed a gNMI Capabilities operation request from user [STRING] at [STRING]: Session ID=[INT32], Result=[STRING], Used time=[STRING]. |
|
Variable fields |
$1: Username of a user. $2: IPv4 or IPv6 address of a gRPC client. $3: gRPC session ID. $4: RPC operation result: ¡ Succeeded. ¡ Failed. $5: Time used, in seconds. |
|
Severity level |
6 |
|
Example |
GRPC/6/GRPC_GNMI_CAPABILITY: Processed a gNMI Capabilities operation request from user test at ipv4:192.168.100.20:50051: Session ID=1, Result=Succeeded, Used time=1.01s. |
|
Explanation |
The device processed a gNMI Capabilities operation requested by a gRPC client. |
|
Recommended action |
No action is required. |
GRPC_GNMI_GET
|
Message text |
Processed a gNMI Get operation request from user [STRING] at [STRING]: Session ID=[INT32], Data type=[STRING], Encoding=[STRING], Prefix=[STRING], Path=[STRING], Result=[STRING], Error code=[STRING], Used time=[STRING]. |
|
Variable fields |
$1: Username of a user. $2: IPv4 or IPv6 address of a gRPC client. $3: gRPC session ID. $4: Data type: ¡ ALL—All types of data. ¡ CONFIG—Read-write data ¡ STATE—Read-only data. $5: Encoding format: ¡ JSON. ¡ BYTES. ¡ PROTO. ¡ ASCII. ¡ JSON_IETF. $6: Prefix for an Xpath path, which represents the name of a module. For example, ifmgr indicates the interface management module. This field might not be displayed if the operation fails. $7: Xpath path, which identifies a node in a data structure. This field might not be displayed if the operation fails. $8: RPC operation result: ¡ Succeeded. ¡ Failed. $9: Error code. This field displays OK if the operation succeeded. $10: Time used, in seconds. |
|
Severity level |
6 |
|
Example |
GRPC/6/GRPC_GNMI_GET: Processed a gNMI Get operation request from user test at ipv4:192.168.100.20: 50051: Session ID=1, Data type=CONFIG, Encoding=JSON, Prefix=ifmgr, Path=interfaceevent, Result=Succeeded, Error code=OK, Used time=1.25s. |
|
Explanation |
The device processed a gNMI Get operation requested by a gRPC client. |
|
Recommended action |
· If the operation succeeded, no action is required. · If the operation failed, contact H3C Support. |
GRPC_GNMI_SET
|
Message text |
Processed a gNMI Set operation request from user [STRING] at [STRING]: Session ID=[INT32], Operation=[STRING], Result=[STRING], Error code=[STRING], Used time=[STRING]. |
|
Variable fields |
$1: Username of a user. $2: IPv4 or IPv6 address of a gRPC client. $3: gRPC session ID. $4: Single operation or operation list. Each operation includes the type of the operation, Xpath expression, and index of a table or row. If the operation fails, this field might not be correctly displayed. Operation types include the following: ¡ delete—Deletes the table or row. ¡ update—Edit the table or row. ¡ replace—Replace the table or row. $5: RPC operation result: ¡ Succeeded. ¡ Failed. $6: Error code. This field displays OK if the operation succeeded. $7: Time used, in seconds. |
|
Severity level |
6 |
|
Example |
GRPC/6/GRPC_GNMI_SET: Processed a gNMI Set operation request from user test at ipv6:[11::86]: 50051: Session ID=1, Operation=delete, VLAN/VLANS(ID=3), Result=Succeeded, Error code=OK, Used time=3.25s. GRPC/6/GRPC_GNMI_SET: Processed a gNMI Set operation request from user test at ipv4:192.168.100.20:50051: Session ID=1, Operation=delete, Ifmgr/interfaces(IfIndex=258) Operation=delete, Ifmgr/interfaces(IfIndex=259), Result=Succeeded, Error code=OK, Used time=3.25s. GRPC/6/GRPC_GNMI_SET: Processed a gNMI Set operation request from user test at ipv4:192.168.100.20:50051: Session ID=1, Operation=update, system/logging/remote-servers/remote-server(host=1.1.1.20)/config/ Operation=update, system/logging/remote-servers/remote-server(host=1.1.1.20)/selectors/selector/, Result=Succeeded, Error code=OK, Used time=3.25s. |
|
Explanation |
The device processed a gNMI Set operation requested by a gRPC client. |
|
Recommended action |
· If the operation succeeded, no action is required. · If the operation failed, contact H3C Support. |
GRPC_GNMI_SUBSCRIBE
|
Message text |
Processed a gNMI Subscribe operation request from user [STRING] at [STRING]: Session ID=[INT32], Mode=[STRING], Encoding=[STRING], Prefix=[STRING], Path=[STRING], Result=[STRING], Error code=[STRING], Used time=[STRING]. |
|
Variable fields |
$1: Username of a user. $2: IPv4 or IPv6 address of a gRPC client. $3: gRPC session ID. $4: Subscription type: ¡ ONCE—The device pushes data only once. ¡ POLL—The device pushes data upon receiving a poll request. ¡ STREAM—The device periodically pushes data at an interval. $5: Encoding format: ¡ JSON. ¡ BYTES. ¡ PROTO. ¡ ASCII. ¡ JSON_IETF. $6: Prefix for an Xpath path, which represents the name of a module. For example, ifmgr indicates the interface management module. This field might not be displayed if the operation fails. $7: Xpath path, which identifies a node in a data structure. This field might not be displayed if the operation fails. $8: RPC operation result: ¡ Succeeded. ¡ Failed. $9: Error code. This field displays OK if the operation succeeded. $10: Time used, in seconds. |
|
Severity level |
6 |
|
Example |
GRPC/6/GRPC_GNMI_SUBSCRIBE: Processed a gNMI Subscribe operation request from user test at ipv4:192.168.100.20:50051: Session ID=1, Mode=POLL, Encoding=JSON, Prefix=ifmgr, Path=interfaceevent, Result=Succeeded, Error code=OK, Used time=1.01s. |
|
Explanation |
The device processed a gNMI Subscribe operation requested by a gRPC client. |
|
Recommended action |
· If the operation succeeded, no action is required. · If the operation failed, contact H3C Support. |
GRPC_LOGIN
|
Message text |
[STRING] logged in from [STRING], session id [INT32]. |
|
Variable fields |
$1: Username. $2: Client ID. $3: Session ID. |
|
Severity level |
6 |
|
Example |
GRPC/6/GRPC_LOGIN: user logged in from 127.0.0.1, session id 1. |
|
Explanation |
A user logged in successfully. |
|
Recommended action |
No action is required. |
GRPC_LOGIN_FAILED
|
Message text |
[STRING] from [STRING] login failed. Or: [STRING] from [STRING] login failed. [STRING] |
|
Variable fields |
$1: Username. $2: Client ID. $3: Login failure reason. The value might be Number of the gRPC sessions reached the limit. |
|
Severity level |
4 |
|
Example |
GRPC/4/GRPC_LOGIN_FAILED: user from 127.0.0.1 login failed. |
|
Explanation |
A user failed to log in. |
|
Recommended action |
1. If no failure reason is displayed, verify that the user is configured and the user entered the correct username and password. 2. If the maximum number of gRPC sessions was already reached, release gRPC sessions as required. |
GRPC_LOGOUT
|
Message text |
[STRING] logged out, session id [INT32]. |
|
Variable fields |
$1: Username. $2: Session ID. |
|
Severity level |
6 |
|
Example |
GRPC/6/GRPC_LOGOUT: user logged out, session id 1. |
|
Explanation |
A user logged out successfully. |
|
Recommended action |
No action is required. |
GRPC_PKI_UNAVAILABLE
|
Message text |
The PKI domain [STRING] is unavailable. When it’s available, the gRPC process will restart. |
|
Variable fields |
$1: PKI domain name. |
|
Severity level |
6 |
|
Example |
GRPC/6/GRPC_PKI_UNAVAILABLE: The PKI domain grpc-tls is unavailable. When it’s available, the gRPC process will restart. |
|
Explanation |
The PKI domain specified for gRPC is unavailable. After the PKI domain becomes available, the gRPC process will restart. |
|
Recommended action |
No action is required. |
GRPC_PKI_AVAILABLE
|
Message text |
The PKI domain [STRING] is now available, the gRPC process is restarting. |
|
Variable fields |
$1: PKI domain name. |
|
Severity level |
6 |
|
Example |
GRPC/6/GRPC_PKI_AVAILABLE: The PKI domain grpc-tls is now available, the gRPC process is restarting. |
|
Explanation |
The PKI domain specified for gRPC is now available and the gRPC process is restarting. |
|
Recommended action |
No action is required. |
GRPC_SERVER_FAILED
|
Message text |
Failed to enable gRPC server. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
GRPC/4/GRPC_SERVER_FAILED: Failed to enable gRPC server. |
|
Explanation |
A port conflict caused a gRPC server connection failure. |
|
Recommended action |
Identify whether a port conflict exist. If yes, modify the port settings as required. |
GRPC_SUBSCRIBE_EVENT_FAILED
|
Message text |
Failed to subscribe event [STRING]. |
|
Variable fields |
$ 1: Event name. |
|
Severity level |
4 |
|
Example |
GRPC/4/GRPC_SUBSCRIBE_EVENT_FAILED: Failed to subscribe event syslog. |
|
Explanation |
Failed to subscribe to an event. |
|
Recommended action |
No action is required. |
GRPC_RECEIVE_SUBSCRIPTION
|
Message text |
Received a subscription of module [STRING]. |
|
Variable fields |
$ 1: Module name. |
|
Severity level |
6 |
|
Example |
GRPC/6/GRPC_RECEIVE_SUBSCRIPTION: Received a subscription of module syslog. |
|
Explanation |
The device received a subscription request for a module. |
|
Recommended action |
No action is required. |
HA messages
This section contains HA messages.
HA_BATCHBACKUP_FINISHED
|
Message text |
Batch backup of standby board in [STRING] has finished. |
|
Variable fields |
$1: MPU location if the MPU supports only one CPU, or CPU location if the MPU supports multiple CPUs. |
|
Severity level |
5 |
|
Example |
HA/5/HA_BATCHBACKUP_FINISHED: Batch backup of standby board in slot 1 CPU 0 has finished. |
|
Explanation |
Batch backup from the active MPU to the standby MPU or a CPU on the standby MPU has finished. |
|
Recommended action |
No action is required. |
HA_BATCHBACKUP_STARTED
|
Message text |
Batch backup of standby board in [STRING] started. |
|
Variable fields |
$1: MPU location if the MPU supports only one CPU, or CPU location if the MPU supports multiple CPUs. |
|
Severity level |
5 |
|
Example |
HA/5/HA_BATCHBACKUP_STARTED: Batch backup of standby board in slot 1 CPU 0 started. |
|
Explanation |
Batch backup from the active MPU to the standby MPU or a CPU on the standby MPU has started. |
|
Recommended action |
No action is required. |
HA_STANDBY_NOT_READY
|
Message text |
Standby board in [STRING] is not ready, reboot ... |
|
Variable fields |
$1: MPU location if the MPU supports only one CPU, or CPU location if the MPU supports multiple CPUs. |
|
Severity level |
4 |
|
Example |
HA/4/HA_STANDBY_NOT_READY: Standby board in slot 1 CPU 0 is not ready, reboot ... |
|
Explanation |
This message appears on the standby MPU. When batch backup is not complete on the standby MPU or a CPU on the standby MPU, performing active and standby MPU switchover results in restart of the active and standby MPUs. |
|
Recommended action |
Do not perform active and standby MPU switchover before batch backup is complete on the standby MPU or a CPU on the standby MPU. |
HA_STANDBY_TO_MASTER
|
Message text |
Standby board in [STRING] changed to the master. |
|
Variable fields |
$1: MPU location if the MPU supports only one CPU, or CPU location if the MPU supports multiple CPUs. |
|
Severity level |
4 |
|
Example |
HA/4/HA_STANDBY_TO_MASTER: Standby board in slot 1 CPU 0 changed to the master. |
|
Explanation |
An active and standby MPU switchover occurs. The standby MPU or a CPU on the standby MPU changed to the active MPU or CPU. |
|
Recommended action |
No action is required. |
HQOS messages
This section contains HQoS messages.
HQOS_DP_SET_FAIL
|
Message text |
Failed to set drop profile [STRING] globally. |
|
Variable fields |
$1: Drop profile name. |
|
Severity level |
4 |
|
Example |
HQOS/4/HQOS_DP_SET_FAIL: Failed to set drop profile b globally. |
|
Explanation |
The system failed to perform one of the following actions: · Apply a drop profile globally. · Modify a drop profile applied globally. |
|
Recommended action |
Check the drop profile settings. |
HQOS_FP_SET_FAIL
|
Message text |
Failed to set [STRING] in forwarding profile [STRING] globally. |
|
Variable fields |
$1: Policy type: · gts. · bandwidth. · queue. · drop profile. $2: Forwarding profile name. |
|
Severity level |
4 |
|
Example |
HQOS/4/HQOS_FP_SET_FAIL: Failed to set gts in forwarding profile b globally. |
|
Explanation |
The system failed to perform one of the following actions: · Apply a forwarding profile globally. · Modify a forwarding profile applied globally. |
|
Recommended action |
Examine the forwarding profile, and make sure it is supported and has no conflicted contents. |
HQOS_POLICY_APPLY_FAIL
|
Message text |
Failed to apply some forwarding classes or forwarding groups in scheduler policy [STRING] to the [STRING] direction of interface [STRING]. |
|
Variable fields |
$1: Scheduler policy name. $2: Policy direction: inbound or outbound. $3: Interface name. |
|
Severity level |
4 |
|
Example |
HQOS/4/HQOS_POLICY_APPLY_FAIL: Failed to apply some forwarding classes or forwarding groups in scheduler policy b to the inbound direction of interface Ethernet3/1/2. |
|
Explanation |
The system failed to perform one of the following actions: · Apply a scheduler policy to a specific direction of an interface. · Modify a scheduler policy applied to a specific direction of an interface. |
|
Recommended action |
Use the display qos scheduler-policy diagnosis interface command to identify the nodes that failed to be applied and the failure causes, and modify the running configuration. |
HQOS_POLICY_APPLY_FAIL
|
Message text |
Failed to recover scheduler policy [STRING] to the [STRING] direction of interface [STRING] due to [STRING]. |
|
Variable fields |
$1: Scheduler policy name. $2: Policy direction: inbound or outbound. $3: Interface name. $4: Cause. |
|
Severity level |
4 |
|
Example |
HQOS/4/HQOS_POLICY_RECOVER_FAIL: Failed to recover scheduler policy b to the outbound direction of interface Ethernet3/1/2 due to conflicting with QoS configuration. |
|
Explanation |
The system failed to recover an applied scheduler policy after the card or device rebooted, because the scheduler policy conflicted with the QoS configuration on the interface. |
|
Recommended action |
Check the scheduler policy configuration according to the failure cause. |
HTTPD messages
This section contains HTTP daemon messages.
HTTPD_CONNECT
|
Message text |
[STRING] client [STRING] connected to the server successfully. |
|
Variable fields |
$1: Connection type, HTTP or HTTPS. $2: Client IP address. |
|
Severity level |
6 |
|
Example |
HTTPD/6/HTTPD_CONNECT: HTTP client 192.168.30.117 connected to the server successfully. |
|
Explanation |
The HTTP or HTTPS server accepted the request from a client. An HTTP or HTTPS connection was set up. |
|
Recommended action |
No action is required. |
HTTPD_CONNECT_TIMEOUT
|
Message text |
[STRING] client [STRING] connection idle timeout. |
|
Variable fields |
$1: Connection type, HTTP or HTTPS. $2: Client IP address. |
|
Severity level |
6 |
|
Example |
HTTPD/6/HTTPD_CONNECT_TIMEOUT: HTTP client 192.168.30.117 connection to server idle timeout. |
|
Explanation |
An HTTP or HTTPS connection was disconnected because the idle timeout timer expires. |
|
Recommended action |
No action is required. |
HTTPD_DISCONNECT
|
Message text |
[STRING] client [STRING] disconnected from the server. |
|
Variable fields |
$1: Connection type, HTTP or HTTPS. $2: Client IP address. |
|
Severity level |
6 |
|
Example |
HTTPD/6/HTTPD_DISCONNECT: HTTP client 192.168.30.117 disconnected from the server. |
|
Explanation |
An HTTP or HTTPS client was disconnected from the server. |
|
Recommended action |
No action is required. |
HTTPD_FAIL_FOR_ACL
|
Message text |
[STRING] client [STRING] failed the ACL check and could not connect to the server. |
|
Variable fields |
$1: Connection type, HTTP or HTTPS. $2: Client IP address. |
|
Severity level |
6 |
|
Example |
HTTPD/6/HTTPD_FAIL_FOR_ACL: HTTP client 192.168.30.117 failed the ACL check and cannot connect to the server. |
|
Explanation |
An HTTP or HTTPS client was filtered by the ACL. |
|
Recommended action |
No action is required. |
HTTPD_FAIL_FOR_ACP
|
Message text |
[STRING] client [STRING] was denied by the certificate access control policy and could not connect to the server. |
|
Variable fields |
$1: Connection type, HTTP or HTTPS. $2: Client IP address. |
|
Severity level |
6 |
|
Example |
HTTPD/6/HTTPD_FAIL_FOR_ACP: HTTP client 192.168.30.117 was denied by the certificate attribute access control policy and could not connect to the server. |
|
Explanation |
An HTTP or HTTPS client was denied by the certificate access control policy. |
|
Recommended action |
No action is required. |
HTTPD_REACH_CONNECT_LIMIT
|
Message text |
[STRING] client [STRING] failed to connect to the server, because the number of connections reached the upper limit. |
|
Variable fields |
$1: Connection type, HTTP or HTTPS. $2: Client IP address. |
|
Severity level |
6 |
|
Example |
HTTPD/6/HTTPD_REACH_CONNECT_LIMIT: HTTP client 192.168.30.117 failed to connect to the server, because the number of connections reached the upper limit. |
|
Explanation |
The number of connections reached the limit. |
|
Recommended action |
1. Use the display current-configuration | include session-limit command to view the current limit for connections of the specified type. If the command does not display the limit, the device is using the default setting. 2. If you want to specify a greater limit, execute the aaa session-limit command. If you think the limit is proper, no action is required. |
IBC
This section contains IBC messages.
CTRL_PATH_FAULT
|
Message text |
A link fault occurred on a control path. |
|
Variable fields |
N/A |
|
Severity level |
3 (Error) |
|
Example |
IBC/3/CTRL_PATH_FAULT: -MDC=1; A link fault occurred on a control path. |
|
Impact |
The system might get stuck. |
|
Cause |
A link fault occurred on a control path of the device. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help |
IF
This section contains interface management messages.
IF_BDG_FWD_NOTSPT
|
Message text |
Pattern 1: Interfaces of this board don’t support the bridge-forwarding enable command. Pattern 2: Some member ports of [STRING] don't support the bridge-forwarding enable command. |
|
Variable fields |
Pattern 1: N/A Pattern 2: $1: Layer 3 aggregation group name. |
|
Severity level |
3 (Error) |
|
Example |
Pattern 1: LIF/3/IF_BDG_FWD_NOTSPT: -MDC=1-Slot=3; Interfaces of this board don’t support the bridge-forwarding enable command. Pattern 2: LIF/3/IF_BDG_FWD_NOTSPT: -MDC=1-Slot=3; Some member ports of Route-Aggregation1 don't support the bridge-forwarding enable command. |
|
Impact |
Pattern 1: Layer 2 forwarding cannot be enabled for the Layer 3 interfaces on the card. Pattern 2: Layer 2 forwarding cannot be enabled on the Layer 3 aggregate interfaces, because some member ports of the Layer 3 aggregation group do not support the bridge-forwarding enable command. |
|
Cause |
Pattern 1: Layer 3 Ethernet interfaces on the specified card do not support the bridge-forwarding enable command. Pattern 2: Some member ports of the Layer 3 aggregation group do not support the bridge-forwarding enable command because of the limitation of the cards where the member ports are located. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. Only |
IF_RAGG_NOTSPT
|
Message text |
Pattern 1: Cannot assign [STRING] to [STRING] that was configured with the bridge-forwarding enable command. Pattern 2: The interface can't be assigned to Route-Aggregation that was configured with the bridge-forwarding enable command. |
|
Variable fields |
$1: Interface name. $2: Layer 3 aggregate interface name. |
|
Severity level |
3 (Error) |
|
Example |
Pattern 1: LIF/3/IF_RAGG_NOTSPT: -MDC=1; Cannot assign GigabitEthernet3/1/1 to Route-Aggregation1 that was configured with the bridge-forwarding enable command. Pattern 2: LIF/3/IF_RAGG_NOTSPT: -MDC=1-Slot=3; The interface can't be assigned to Route-Aggregation when the route-aggregation different-mac-address enable command is configured. |
|
Impact |
This Layer 3 Ethernet interface cannot be assigned to a Layer 3 aggregation group. |
|
Cause |
A Layer 3 Ethernet interface that does not support the bridge-forwarding enable command cannot be assigned to a Layer 3 aggregation group enabled with Layer 2 forwarding. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
INT_QINQ_NORES
|
Message text |
Not enough resources for [STRING]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
6 (Informational) |
|
Example |
LIF/6/INT_QINQ_NORES: -MDC=1-Slot=5; Not enough resources for Route-Aggregation1.1. |
|
Impact |
QinQ termination feature became unavailable on the interface. |
|
Cause |
QinQ termination feature is unavailable because of insufficient hardware resources. |
|
Recommended action |
1. Use the display current-configuration | include second-dot1q command to display the current QinQ termination configuration. 2. Use the undo vlan-type dot1q vid second-dot1q command to disable QinQ termination to release resources. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
MACADDR_CFG_NOTSPT
|
Message text |
This board doesn't support VE-L3VPN interfaces configured with the mac-address command. |
|
Variable fields |
N/A |
|
Severity level |
3 (Error) |
|
Example |
LIF/3/MACADDR_CFG_NOTSPT: -MDC=1-Slot=3; This board doesn't support VE-L3VPN interfaces configured with the mac-address command. |
|
Impact |
VE-L3VPN interfaces configured with the mac-address command cannot be configured on this card. |
|
Cause |
This card does not support VE-L3VPN interfaces configured with the mac-address command. |
|
Recommended action |
1. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
MACADDR_NOTSPT_INT
|
Message text |
[STRING] can't be assigned to [STRING] configured with a MAC address. |
|
Variable fields |
$1: Interface name. If the device fails to obtain the interface name, The interface is displayed. $2: Layer 3 aggregate interface name. If the device fails to obtain the interface name, the interface number is not displayed. |
|
Severity level |
3 (Error) |
|
Example |
LIF/3/MACADDR_NOTSPT_INT: -MDC=1-Slot=3; Ten-GigabitEthernet3/0/5 can't be assigned to Route-Aggregation100 configured with a MAC address. |
|
Impact |
The Layer 3 Ethernet interface cannot be assigned to a Layer 3 aggregate group configured with a MAC address. |
|
Cause |
Layer 3 Ethernet interfaces on specific cards cannot be assigned to a Layer 3 aggregate interface if the aggregate interface has been assigned a MAC address by using the mac-address command. |
|
Recommended action |
1. Assign a Layer 3 Ethernet interface that supports the mac-address command to a Layer 3 aggregate interface. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help.
|
MACADDR_NOTSPT_RAGG
|
Message text |
[STRING] has been configured with a MAC address and can't be assigned to [STRING]. |
|
Variable fields |
$1: Interface name. If the device fails to obtain the interface name, The interface is displayed. $2: Layer 3 aggregate interface name. If the device fails to obtain the interface name, the interface number is not displayed. |
|
Severity level |
3 (Error) |
|
Example |
LIF/3/MACADDR_NOTSPT_RAGG: -MDC=1-Slot=3; Ten-GigabitEthernet3/0/5 has been configured with a MAC address and can't be assigned to Route-Aggregation100. LIF/3/MACADDR_NOTSPT_RAGG: -MDC=1-Slot=3; The interface has been configured with a MAC address and can't be assigned to Route-Aggregation. |
|
Impact |
The Layer 3 Ethernet interface cannot be assigned to a Layer 3 aggregation group. |
|
Cause |
A Layer 3 Ethernet interface cannot be assigned to an aggregation group if it has been assigned a MAC address by using the mac-address command. |
|
Recommended action |
1. Execute the undo mac-address command to delete the MAC address of the Layer 3 Ethernet interface before you assign it to an aggregation group. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
OP_INF_NORES
|
Message text |
Operation failed because of insufficient hardware resources. |
|
Variable fields |
N/A |
|
Severity level |
3 (Error) |
|
Example |
LIF/3/OP_INF_NORES: -MDC=1-Slot=4; Operation failed because of insufficient hardware resources. |
|
Impact |
The interface became unavailable. |
|
Cause |
A created interface (for example, a VLAN interface) is unavailable because of insufficient hardware resources. |
|
Recommended action |
1. Use the undo command to delete the interface. 2. Use the display interface interface-type brief command to displays brief interface information. 3. Delete unnecessary interfaces to release resources and re-create the interface. 4. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
OP_SUBINT_NORES
|
Message text |
Operation failed on [STRING] because of insufficient hardware resources. |
|
Variable fields |
$1: Interface name or VLAN number. |
|
Severity level |
3 (Error) |
|
Example |
LIF/3/OP_SUBINT_NORES: -MDC=1-Slot=4; Operation failed on Route-Aggregation3.2 because of insufficient hardware resources. LIF/3/OP_SUBINT_NORES: -MDC=1-Slot=4; Operation failed on VLAN222 because of insufficient hardware resources. |
|
Impact |
The interface became unavailable. |
|
Cause |
A created interface (for example, a Layer 3 aggregate subinterface) or sub-VLAN is unavailable because of insufficient hardware resources. |
|
Recommended action |
1. Use the undo command to delete the interface or VLAN. 2. Use the display interface interface-type brief command to displays brief interface information. Alternatively, use the display supervlan command to display information about super VLANs and their associated sub-VLANs. 3. Delete unnecessary interfaces or sub-VLANs to release resources and re-create the interface or VLAN. 4. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
PORT_MACADDR_NOTSPT
|
Message text |
Some member ports of [STRING] don't support the mac-address command. |
|
Variable fields |
$1: Layer 3 aggregate interface name. If the device fails to obtain the interface name, the interface number is not displayed. |
|
Severity level |
3 (Error) |
|
Example |
LIF/3/PORT_MACADDR_NOTSPT: -MDC=1-Slot=3; Some member ports of Route-Aggregation100 don't support the mac-address command. LIF/3/PORT_MACADDR_NOTSPT: -MDC=1-Slot=3; Some member ports of Route-Aggregation don't support the mac-address command. |
|
Impact |
The mac-address command cannot be executed on the Layer 3 aggregate interface. |
|
Cause |
Layer 3 Ethernet interfaces on specific cards do not support the mac-address command. |
|
Recommended action |
· If a Layer 3 aggregate interface is already assigned a MAC address by using the mac-address command, remove the Layer 3 Ethernet interfaces that do not support MAC address configuration from the Layer 3 aggregation group and the assign a MAC address to the aggregate interface. Make sure the Layer 3 Ethernet interfaces in the aggregation group belong to the following cards: , , , . · If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
RAGG_MACADDR_NOTSPT
|
Message text |
Member port of Route-Aggregation doesn't support the mac-address command. |
|
Variable fields |
N/A |
|
Severity level |
3 (Error) |
|
Example |
LIF/3/RAGG_MACADDR_NOTSPT: -MDC=1-Slot=3; Member port of Route-Aggregation doesn't support the mac-address command. |
|
Impact |
The mac-address command cannot be configured on a Layer 3 Ethernet interface. |
|
Cause |
The mac-address command cannot be executed on a Layer 3 Ethernet interface that is already assigned to an aggregation group. |
|
Recommended action |
1. Execute the mac-address command on the Layer 3 Ethernet interface after you remove the Layer 3 Ethernet interface from the Layer 3 aggregation group. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
RAGGSUB_L2VPN_CONFLICT
|
Message text |
The operation is not supported because configuration conflicts on [INT32] |
|
Variable fields |
$1: Interface type + interface number or interface index. |
|
Severity level |
2 (Critical) |
|
Example |
LIF/2/RAGGSUB_L2VPN_ CONFLICT: -MDC=1-Slot=3; The operation is not supported because configuration conflicts on Route-Aggregation1.1. |
|
Impact |
The traffic statistics feature cannot be enabled on the interface or subinterface because of the configuration conflicts on the interface or subinterface. |
|
Cause |
The traffic statistics feature on the interface or subinterface and the L2VPN feature on the Layer 3 aggregate subinterface are mutually exclusive. If you configure both of the features, the traffic statistics feature on the interface or subinterface does not take effect. |
|
Recommended action |
1. Use the undo traffic-statistic enable command to disable the traffic statistics feature for the interface or subinterface. 2. Clear the IPoE L2VPN configuration for the Layer 3 aggregate subinterface. 3. Execute the traffic-statistic enable command for the interface or subinterface. 4. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
RAGGSUB_NORES
|
Message text |
Operation failed because of insufficient resources on [INT32] |
|
Variable fields |
$1: Interface type + interface number or interface index. |
|
Severity level |
2 (Critical) |
|
Example |
LIF/2/RAGGSUB_NORES: -MDC=1-Slot=2; Operation failed because of insufficient resources on Route-Aggregation1.1. |
|
Impact |
· The traffic statistics feature cannot be enabled on the interface or subinterface. · The traffic statistics feature failed to take effect on the interface or subinterface after you execute the traffic-statistic enable command on the interface or subinterface. |
|
Cause |
· The traffic statistics feature cannot be enabled on the interface or subinterface. · System resources were not enough to enable the traffic statistics feature. |
|
Recommended action |
1. Use the undo traffic-statistic enable command to disable the traffic statistics feature for the interface or subinterface. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
iFIT messages
This section contains in-situ Flow Information Telemetry (iFIT) messages.
IFIT_COUNTER_NORES
|
Message text |
Not enough counter resource. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
IFIT/4/IFIT_COUNTER_NORES: Not enough counter resource. |
|
Impact |
The system cannot perform iFIT measurement on target flows that are newly learned. |
|
Cause |
Counter resources were exhausted for the system to measure new target flows by using iFIT. |
|
Recommended action |
1. Execute the display this command in iFIT view to view the iFIT instance information. 2. Execute the undo instance instance-name command to remove the iFIT instances corresponding to unused dynamic flows to release counter resources. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
IFIT_FLOW_NORES
|
Message text |
Not enough Flow resource. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
IFIT/4/IFIT_FLOW_NORES: Not enough Flow resource. |
|
Impact |
The system cannot perform iFIT measurement on target flows that are newly learned. |
|
Cause |
The amount of target flows for iFIT measurement exceeded the system upper limit, which causes resource exhaustion. The system cannot measure the newly-learned target flows by using iFIT. |
|
Recommended action |
1. Execute the display this command in iFIT view to view the iFIT instance information. 2. Execute the undo instance instance-name command to remove the iFIT instances corresponding to unused dynamic flows to decrease the number iFIT target flows in the system. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
IFIT_MAPPING_NORES
|
Message text |
Not enough iFit Mapping resource. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
IFIT/4/IFIT_MAPPING_NORES: Not enough iFit Mapping resource. |
|
Impact |
The system cannot perform iFIT measurement on target flows that are newly learned. |
|
Cause |
iFIT mapping resources were exhausted for the system to measure the newly-learned target flows by using iFIT. |
|
Recommended action |
1. Execute the display this command in iFIT view to view the iFIT instance information. 2. Execute the undo instance instance-name command to remove the iFIT instances corresponding to unused dynamic flows to release iFIT mapping resources in the system. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
IFIT_ACL_NORES
|
Message text |
Not enough ACL resource. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
IFIT/4/IFIT_ACL_NORES: Not enough ACL resource. |
|
Impact |
The system cannot perform iFIT measurement on target flows that are newly learned. |
|
Cause |
ACL resources were exhausted for the system to measure the newly-learned target flows by using iFIT. |
|
Recommended action |
1. Execute the display this command in iFIT view to view the iFIT instance information. 2. Execute the undo instance instance-name command to delete unnecessary iFIT configurations to release ACL resources. 3. Delete other unnecessary service configurations that use ACL to release ACL resources. 4. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
iFIT messages
This section contains in-situ Flow Information Telemetry (iFIT) messages.
IFIT_GLOBAL_FAILURE
|
Message text |
Failed to issue the ifit enable command to the driver. |
|
Severity level |
5 |
|
Example |
IFIT/5/IFIT_GLOBAL_FAILURE: Failed to issue the ifit enable command to the driver. |
|
Explanation |
The message is sent when the system fails to issue the ifit enable command to the driver after the command is executed successfully. |
|
Recommended action |
Please contact H3C Support. |
IFIT_INST_ACTIVE
|
Message text |
iFIT measurement for instance [STRING] is active. |
|
Variable fields |
$1: Instance name. |
|
Severity level |
6 |
|
Example |
IFIT/6/IFIT_INST_ACTIVE: iFIT measurement for instance A is active. |
|
Explanation |
The message is sent when iFIT measurement for the instance becomes active and the system measures the packet loss and packet delay of the instance. |
|
Recommended action |
No action is required. |
IFIT_INST_FAILURE
|
Message text |
Failed to issue the configuration of the flow [UINT] to the driver. |
|
Variable fields |
$1: Flow ID. |
|
Severity level |
5 |
|
Example |
IFIT/5/IFIT_INST_FAILURE: Failed to issue the configuration of flow 4097 to the driver. |
|
Explanation |
This message is sent when the system fails to issue the flow configuration to the driver after the flow is configured successfully. |
|
Recommended action |
1. Use the display qos-acl resource command to verify that the ACL resources are sufficient. 2. If the resources are not sufficient, delete unnecessary ACLs and execute the measure enable command to enable iFIT measurement. |
IFIT_INST_INACTIVE
|
Message text |
iFIT measurement for instance [STRING] is inactive. Reason: [TEXT]. |
|
Variable fields |
$1: instance name. $2: Reason: · The bound interfaces are invalid. · The VPN instance does not exist. · VPN [STRING] does not exist. · Xconnect-group [STRING] connection [STRING] does not exist. · VSI [STRING] does not exist. |
|
Severity level |
5 |
|
Example |
IFIT/5/IFIT_INST_INACTIVE: iFIT measurement for instance a is inactive. Reason: The bound interfaces are invalid. |
|
Explanation |
This message is sent when iFIT measurement for the iFIT instance is enabled but not active. |
|
Recommended action |
· Verify that the interfaces bound to the instance are up. If the interfaces are not up, verify that the corresponding links are normal. · Verify that the VPN instance, VSI, and cross-connect group configured for the flow monitored by the instance exist. If not, create a VPN instance, VSI, or cross-connect group as needed. |
IFIT_NO_RESOURCE
|
Message text |
Failed to configure the flow [UINT] due to insufficient resources. |
|
Variable fields |
$1: Flow ID. |
|
Severity level |
5 |
|
Example |
IFIT/5/IFIT_NO_RESOURCE: Failed to configure the flow 4097 due to insufficient resources. |
|
Explanation |
This message is sent when the system fails to configure the flow to be monitored by the instance due to insufficient driver resources. |
|
Recommended action |
Delete the currently unused iFIT instances and restart iFIT measurement for the instance. |
IFIT_NO_SUPPORT
|
Message text |
iFIT is not supported in this slot. |
|
Severity level |
5 |
|
Example |
IFIT/5/IFIT_NO_SUPPORT: -slot=2; iFIT is not supported in this slot. |
|
Explanation |
This message is sent when iFIT measurement is not supported in the current slot. |
|
Recommended action |
Enable iFIT measurement in the slot that supports iFIT measurement. |
IFMON
This section contains interface monitoring messages.
CRC_BIT_ERROR_RECOVERY
|
Message text |
The value of CRC error ratio dropped below the lower threshold: Interface name=[STRING]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
IFMON/4/CRC_BIT_ERROR_RECOVERY: -Slot=2; The value of CRC error ratio dropped below the lower threshold: Interface name=GigabitEthernet1/0/1. |
|
Explanation |
This log message was generated when the number of CRC bit error packets detected within a statistics collection interval dropped below the lower threshold and the alarm was cleared. |
|
Recommended action |
No action is required. |
CRC_BIT_ERROR_THRESHOLD
|
Message text |
The CRC error ratio exceeds the upper threshold: Interface name=[STRING], upper threshold=[UINT32], CRC bit error ratio value=[STRING]. |
|
Variable fields |
$1: Interface name. $2: Upper bit error rate threshold. $3: Number of CRC bit error packets detected within the latest statistics collection interval. |
|
Severity level |
4 |
|
Example |
IFMON/4/CRC_BIT_ERROR_THRESHOLD: -MDC=1-Slot=2; The CRC error ratio exceeds the upper threshold: Interface name=Ten-GigabitEthernet1/0/1, upper threshold=1E-3, CRC bit error ratio value=4E-1. |
|
Explanation |
This log message was generated when the number of CRC bit error packets detected within a statistics collection interval exceeded the upper threshold. Typically, this issue occurs because the threshold is set improperly or too many error packets appear because data is destroyed during transmission. |
|
Recommended action |
· Identify whether the upper threshold is set properly. · Identify whether the link environment quality is good. |
CRC_ERROR_RECOVERY
|
Message text |
The number of CRC error packets dropped below the lower threshold: Interface name=[STRING]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
IFMON/4/CRC_ERROR_RECOVERY: The number of CRC error packets dropped below the lower threshold: Interface name=GigabitEthernet1/0/1. |
|
Explanation |
This log message was generated when the number of CRC error packets detected within a statistics collection interval dropped below the threshold and the alarm was cleared. |
|
Recommended action |
No action is required. |
CRC_ERROR_THRESHOLD
|
Message text |
The number of CRC error packets exceeded the upper threshold: Interface name=[STRING], upper threshold=[UINT32], number of CRC error packets=[UINT64], interval=[UINT32]s. |
|
Variable fields |
$1: Interface name. $2: Upper threshold for the alarm or the upper bit error rate threshold. $3: Number of CRC error packets detected within the latest statistics collection interval. $4: Collection and comparison interval for CRC error packets, in seconds. |
|
Severity level |
4 |
|
Example |
IFMON/4/CRC_ERROR_THRESHOLD: The number of CRC error packets exceeded the upper threshold: Interface name=GigabitEthernet1/0/1, upper threshold=100, number of CRC error packets=200, interval=10s. |
|
Explanation |
This log message was generated when the number of CRC error packets within a statistics collection interval exceeded the upper threshold. Typically, this issue occurs because the threshold is set improperly or too many error packets appear because data is destroyed during transmission. |
|
Recommended action |
· Identify whether the upper threshold is set properly. · Identify whether the link environment quality is good. |
BGTRAFFIC_SEND_BEGIN
|
Message text |
Interface [STRING] began sending background traffic. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
6 |
|
Example |
IFMON/6/BGTRAFFIC_SEND_BEGIN: Interface GigabitEthernet1/0/1 began sending background traffic. |
|
Explanation |
When the outgoing traffic rate of an interface drops below 100 Mbps, the interface starts sending background traffic. |
|
Recommended action |
No action is required. |
BGTRAFFIC_SEND_END
|
Message text |
Interface [STRING] stopped sending background traffic. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
6 |
|
Example |
IFMON/6/BGTRAFFIC_SEND_END: Interface GigabitEthernet1/0/1 stopped sending background traffic. |
|
Explanation |
When the outgoing traffic rate of an interface exceeds 300 Mbps, the interface stops sending background traffic. |
|
Recommended action |
No action is required. |
INPUT_BUFFER_DROP_RECOVERY
|
Message text |
The number of input buffer drop packets dropped below the lower threshold: Interface name=[STRING], upper threshold=[UINT32], lower threshold=[UINT32], number of input buffer drop packets=[UINT64], interval=[UINT32]s. |
|
Variable fields |
$1: Interface name. $2: Upper threshold for the alarm. $3: Lower threshold for the alarm. $4: Number of input packets dropped in the data buffer detected within the latest statistics collection interval. $5: Collection and comparison interval for input packets dropped in the data buffer, in seconds. |
|
Severity level |
4 |
|
Example |
IFMON/4/INPUT_BUFFER_DROP_RECOVERY: The number of input buffer drop packets dropped below the lower threshold: Interface name=GigabitEthernet0/0/2, upper threshold=5000, lower threshold=1000, number of input buffer drop packets=25552, interval=30s. |
|
Explanation |
This log message was generated when the number of input packets dropped in the data buffer detected within a statistics collection interval dropped below the lower threshold and the alarm was cleared. |
|
Recommended action |
No action is required. |
INPUT_BUFFER_DROP_THRESHOLD
|
Message text |
The number of input buffer drop packets exceeded the upper threshold: Interface name=[STRING], upper threshold=[UINT32], lower threshold=[UINT32], number of inout buffer drop packets=[UINT64], interval=[UINT32]s. |
|
Variable fields |
$1: Interface name. $2: Upper threshold for the alarm. $3: Lower threshold for the alarm. $4: Number of input packets dropped in the data buffer detected within the latest statistics collection interval. $5: Collection and comparison interval for input packets dropped in the data buffer, in seconds. |
|
Severity level |
4 |
|
Example |
IFMON/4/INPUT_BUFFER_DROP_THRESHOLD: The number of input buffer drop packets exceeded the upper threshold: Interface name=GigabitEthernet0/0/2, upper threshold=5000, lower threshold=1000, number of inout buffer drop packets=25552, interval=30s. |
|
Explanation |
This log message was generated when the number of input packets dropped in the data buffer detected within a statistics collection interval exceeded the upper threshold. Typically, this issue occurs because the threshold is set improperly or too many packets are lost during transmission. |
|
Recommended action |
· Identify whether the upper threshold is set properly. · Identify whether the link environment quality is good. |
INPUT_ERROR_RECOVERY
|
Message text |
The number of input error packets dropped below the lower threshold: Interface name=[STRING]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
IFMON/4/INPUT_ERROR_RECOVERY: The number of input error packets dropped below the lower threshold: Interface name=GigabitEthernet1/0/1. |
|
Explanation |
This log message was generated when the number of input error packets within a statistics collection interval dropped below the lower threshold, and this alarm was cleared. |
|
Recommended action |
No action is required. |
INPUT_ERROR_THRESHOLD
|
Message text |
The number of input error packets exceeded the upper threshold: Interface name=[STRING], upper threshold=[UINT32], number of input error packets=[UINT64], interval=[UINT32] s. |
|
Variable fields |
$1: Interface name. $2: Upper threshold for alarms. $3: Number of input error packets within the latest statistics collection interval. $4: Statistics collection and comparison interval for input error packets in seconds. |
|
Severity level |
4 |
|
Example |
IFMON/4/INPUT_ERROR_THRESHOLD: The number of input error packets exceeded the upper threshold: Interface name=HundredGigE1/0/1, upper threshold=100, number of input error packets=200, Interval=10 s. |
|
Explanation |
This log message was generated when the number of input error packets within a statistics collection interval exceeded the upper threshold. Typically, the reason is that the upper threshold is set improperly or data is damaged during transmission and the number of error packets increases. |
|
Recommended action |
· Verify that the upper threshold is set properly. · Verify that the link environment quality is good. |
OUTPUT_BUFFER_DROP_RECOVERY
|
Message text |
The number of output buffer drop packets dropped below the lower threshold: Interface name=[STRING], upper threshold=[UINT32], lower threshold=[UINT32], number of output buffer drop packets=[UINT64], interval=[UINT32]s. |
|
Variable fields |
$1: Interface name. $2: Upper threshold for the alarm. $3: Lower threshold for the alarm. $4: Number of output packets dropped in the data buffer detected within the latest statistics collection interval. $5: Collection and comparison interval for output packets dropped in the data buffer, in seconds. |
|
Severity level |
4 |
|
Example |
IFMON/4/OUTPUT_BUFFER_DROP_RECOVERY: The number of output buffer drop packets dropped below the lower threshold: Interface name=GigabitEthernet0/0/2, upper threshold=5000, lower threshold=1000, number of output buffer drop packets=25552, interval=30s. |
|
Explanation |
This log message was generated when the number of output packets dropped in the data buffer detected within a statistics collection interval dropped below the lower threshold and the alarm was cleared. |
|
Recommended action |
No action is required. |
OUTPUT_BUFFER_DROP_THRESHOLD
|
Message text |
The number of output buffer drop packets exceeded the upper threshold: Interface name=[STRING], upper threshold=[UINT32], lower threshold=1000, number of output buffer drop packets=[UINT64], interval=[UINT32]s. |
|
Variable fields |
$1: Interface name. $2: Upper threshold for the alarm. $3: Lower threshold for the alarm. $4: Number of output packets dropped in the data buffer detected within the latest statistics collection interval. $5: Collection and comparison interval for output packets dropped in the data buffer, in seconds. |
|
Severity level |
4 |
|
Example |
IFMON/4/OUTPUT_BUFFER_DROP_THRESHOLD: The number of output buffer drop packets exceeded the upper threshold: Interface name=GigabitEthernet0/0/2, upper threshold=5000, lower threshold=1000, number of inout buffer drop packets=25552, interval=30s. |
|
Explanation |
This log message was generated when the number of output packets dropped in the data buffer detected within a statistics collection interval exceeded the upper threshold. Typically, this issue occurs because the threshold is set improperly or too many packets are lost during transmission. |
|
Recommended action |
· Identify whether the upper threshold is set properly. · Identify whether the link environment quality is good. |
OUTPUT_ERROR_RECOVERY
|
Message text |
The number of output error packets dropped below the lower threshold: Interface name=[STRING]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
IFMON/4/OUTPUT_ERROR_RECOVERY: The number of output error packets dropped below the lower threshold: Interface name=GigabitEthernet1/0/1. |
|
Explanation |
This log message was generated when the number of output error packets within a statistics collection interval dropped below the lower threshold, and this alarm was cleared. |
|
Recommended action |
No action is required. |
OUTPUT_ERROR_THRESHOLD
|
Message text |
The number of output error packets exceeded the upper threshold: Interface name=[STRING], upper threshold=[UINT32], number of output error packets=[UINT64], interval=[UINT32] s. |
|
Variable fields |
$1: Interface name. $2: Upper threshold for alarms. $3: Number of output error packets within the latest statistics collection interval. $4: Statistics collection and comparison interval for output error packets in seconds. |
|
Severity level |
4 |
|
Example |
IFMON/4/OUTPUT_ERROR_THRESHOLD: The number of output error packets exceeded the upper threshold: Interface name=HundredGigE1/0/1, upper threshold=100, number of output error packets=200, interval=10 s. |
|
Explanation |
This log message was generated when the number of output error packets within a statistics collection interval exceeded the upper threshold. Typically, the reason is that the upper threshold is set improperly or data is damaged during transmission and the number of error packets increases. |
|
Recommended action |
· Verify that the upper threshold is set properly. · Verify that the link environment quality is good. |
SLOT_PACKETDROP_RECOVERY
|
Message text |
The number of drop packets dropped below the lower threshold: Slot=[UINT32], upper threshold=[UINT32], lower threshold=[UINT32], number of drop packets=[UINT64], interval=[UINT32]s. |
|
Variable fields |
$1: Card information. $2: Upper threshold for the alarm. $3: Lower threshold for the alarm. $4: Number of output packets dropped on a card detected within the latest statistics collection interval. $5: Collection and comparison interval for packets dropped on a card, in seconds. |
|
Severity level |
4 |
|
Example |
IFMON/4/SLOT_PACKETDROP_RECOVERY: The number of drop packets dropped below the lower threshold: Slot=3, upper threshold=5000, lower threshold=1000, number of drop packets=25552, interval=30s. |
|
Explanation |
This log message was generated when the number of packets dropped on a card within a statistics collection interval dropped below the lower threshold and the alarm was cleared. |
|
Recommended action |
No action is required. |
SLOT_PACKETDROP_THRESHOLD
|
Message text |
The number of drop packets exceeded the upper threshold: Slot=[UINT32], upper threshold=[UINT32], lower threshold=[UINT32], number of packet drop packets=[UINT64], interval=[UINT32]s. |
|
Variable fields |
$1: Card information. $2: Upper threshold for the alarm. $3: Lower threshold for the alarm. $4: Number of packets dropped on a card detected within the latest statistics collection interval. $5: Collection and comparison interval for packets dropped on a card, in seconds. |
|
Severity level |
4 |
|
Example |
IFMON/4/SLOT_PACKETDROP_THRESHOLD: The number of drop packets exceeded the upper threshold: Slot=3, upper threshold=5000, lower threshold=1000, number of packet drop packets=25552, interval=30s. |
|
Explanation |
This log message was generated when the number of packets dropped on a card within a statistics collection interval exceeded the upper threshold. Typically, this issue occurs because the threshold is set improperly or too many packets are lost during transmission. |
|
Recommended action |
· Identify whether the upper threshold is set properly. · Identify whether the link environment quality is good. |
IFNET messages
This section contains interface management messages.
VLAN_MODE_CHG
|
Message text |
Dynamic VLAN [INT32] has changed to a static VLAN. |
|
Variable fields |
$1: VLAN ID. |
|
Severity level |
5 (Notification) |
|
Example |
IFNET/5/VLAN_MODE_CHG: -MDC=1; Dynamic VLAN 20 has changed to a static VLAN. |
|
Impact |
N/A |
|
Cause |
Creating a VLAN interface changes the corresponding dynamic VLAN to a static VLAN. |
|
Recommended action |
No action is required. |
IFNET messages
This section contains interface management messages.
FLEXE_BANDWIDTH_MISMATCH
|
Message text |
The bandwidth of local FlexE logical interface [STRING] did not match the bandwidth of the peer interface with the same client ID. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
IFNET/4/FLEXE_BANDWIDTH_MISMATCH: The bandwidth of local FlexE logical interface FlexE2/1/129 did not match the bandwidth of the peer interface with the same client ID. |
|
Explanation |
FlexE logical interfaces configured with the same client ID on two ends were configured with different available bandwidth. |
|
Recommended action |
Use the flexe-group bandwidth command to modify the available bandwidth of FlexE interfaces to ensure configuration consistency. |
FLEXE_BANDWIDTH_MISMATCH_RECOVER
|
Message text |
The bandwidth of local FlexE logical interface [STRING] matched the bandwidth of the peer interface with the same client ID. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
5 |
|
Example |
IFNET/5/FLEXE_BANDWIDTH_MISMATCH_RECOVER: The bandwidth of local FlexE logical interface FlexE2/1/129 matched the bandwidth of the peer interface with the same client ID. |
|
Explanation |
FlexE logical interfaces configured with the same client ID on two ends were configured with the same available bandwidth. |
|
Recommended action |
No action is required. |
FLEXE_BANDWIDTH_REDUCE
|
Message text |
The actual bandwidth [INT32] Gbps of FlexE logical interface [STRING] became less than the configured bandwidth. |
|
Variable fields |
$1: Interface bandwidth. $2: Interface name. |
|
Severity level |
4 |
|
Example |
IFNET/4/FLEXE_BANDWIDTH_REDUCE: The actual bandwidth 50 Gbps of FlexE logical interface FlexE2/1/129 became less than the configured bandwidth. |
|
Explanation |
A FlexE physical interface went down. As a result, the bandwidth of the corresponding FlexE logical interface became less. |
|
Recommended action |
Check the physical connection of the FlexE physical interface and identify whether the link fails. |
FLEXE_BANDWIDTH_REDUCE_RECOVER
|
Message text |
The actual bandwidth [INT32] Gbps of FlexE logical interface [STRING] became equal to the configured bandwidth. |
|
Variable fields |
$1: Interface bandwidth. $2: Interface name. |
|
Severity level |
5 |
|
Example |
IFNET/5/FLEXE_BANDWIDTH_REDUCE_RECOVER: The actual bandwidth 100 Gbps of FlexE logical interface FlexE2/1/129 became equal to the configured bandwidth. |
|
Explanation |
A FlexE physical interface came up. As a result, the bandwidth of the corresponding FlexE logical interface recovered. |
|
Recommended action |
No action is required. |
FLEXE_CLIENTID_MISMATCH
|
Message text |
The client ID of local FlexE logical interface [STRING] did not match the client ID of a peer interface. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
IFNET/4/FLEXE_CLIENTID_MISMATCH: The client ID of local FlexE logical interface FlexE2/1/129 did not match the client ID of a peer interface. |
|
Explanation |
FlexE logical interfaces on two ends were configured with different client IDs. |
|
Recommended action |
Use the flexe client-id command to modify the client IDs of FlexE logical interfaces to ensure configuration consistency. |
FLEXE_CLIENTID_MISMATCH_RECOVER
|
Message text |
The client ID of local FlexE logical interface [STRING] matched the client ID of a peer interface. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
5 |
|
Example |
IFNET/5/FLEXE_CLIENTID_MISMATCH_RECOVER: The client ID of local FlexE logical interface FlexE2/1/129 matched the client ID of a peer interface. |
|
Explanation |
The FlexE logical interfaces on two ends were configured with the same client ID. |
|
Recommended action |
No action is required. |
FLEXE_GROUP_FAULT
|
Message text |
FlexE interface group [INT32] state changed to fault. |
|
Variable fields |
$1: FlexE interface group number. |
|
Severity level |
4 |
|
Example |
IFNET/4/FLEXE_GROUP_FAULT: FlexE interface group 1 state changed to fault. |
|
Explanation |
All FlexE physical interfaces in an FlexE interface group went down. As a result, the FlexE interface group failed. |
|
Recommended action |
Check the physical connections of the FlexE physical interfaces and identify whether the link fails. |
FLEXE_GROUP_FAULT_RECOVER
|
Message text |
FlexE interface group [INT32] state changed to normal |
|
Variable fields |
$1: FlexE interface group number. |
|
Severity level |
5 |
|
Example |
IFNET/5/FLEXE_GROUP_FAULT_RECOVER: FlexE interface group 1 state changed to normal. |
|
Explanation |
FlexE physical interfaces in up state existed in the FlexE interface group, and the FlexE interface group recovered. |
|
Recommended action |
No action is required. |
FLEXE_GROUPMEMBER_FAULT
|
Message text |
FlexE physical interface [STRING] in FlexE interface group [INT32] failed. |
|
Variable fields |
$1: Interface name. $2: FlexE interface group number. |
|
Severity level |
4 |
|
Example |
IFNET/4/FLEXE_GROUPMEMBER_FAULT: FlexE physical interface FlexE-50G2/1/1 in FlexE interface group 1 failed. |
|
Explanation |
FlexE physical interfaces in the FlexE interface group failed. |
|
Recommended action |
1. Check the physical connection of the FlexE physical interface and identify whether the link fails. 2. Identify whether the peer device fails. |
FLEXE_GROUPMEMBER_FAULT_RECOVER
|
Message text |
FlexE physical interface [STRING] in FlexE interface group [INT32] recovered. |
|
Variable fields |
$1: Interface name. $2: FlexE interface group number. |
|
Severity level |
5 |
|
Example |
IFNET/5/FLEXE_GROUPMEMBER_FAULT_RECOVER: FlexE physical interface FlexE-50G2/1/1 in FlexE interface group 1 recovered. |
|
Explanation |
FlexE physical interfaces in the FlexE interface group recovered. |
|
Recommended action |
No action is required. |
FLEXE_PHYFCSSD_ALARM
|
Message text |
FCS-SD error occurred on local FlexE physical interface [STRING]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
IFNET/4/FLEXE_PHYFCSSD_ALARM: FCS-SD error occurred on local FlexE physical interface FlexE-50G2/1/1. |
|
Explanation |
An FCS-SD error occurred on a FlexE physical interface. |
|
Recommended action |
Identify whether the physical link of the FlexE physical interface is normal. |
FLEXE_PHYFCSSD_ALARM_RECOVER
|
Message text |
FCS-SD error on local FlexE physical interface [STRING] was cleared. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
5 |
|
Example |
IFNET/5/FLEXE_PHYFCSSD_ALARM_RECOVER: FCS-SD error on local FlexE physical interface FlexE-50G2/1/1 was cleared. |
|
Explanation |
The FCS-SD error on a FlexE physical interface was cleared. |
|
Recommended action |
No action is required. |
FLEXE_PHYGROUP_MISMATCH
|
Message text |
FlexE interface group [INT32] of local FlexE physical interface [STRING] did not match the FlexE interface group [INT32] of the peer interface. |
|
Variable fields |
$1: Local FlexE interface group number. $2: Interface name. $3: Peer FlexE interface group number. |
|
Severity level |
4 |
|
Example |
IFNET/4/FLEXE_PHYGROUP_MISMATCH: FlexE interface group 1 of local FlexE physical interface FlexE-50G2/1/1 did not match the FlexE interface group 2 of the peer interface. |
|
Explanation |
Two FlexE physical interfaces interconnected were in different FlexE interface groups. |
|
Recommended action |
Use the port flexe-group command to modify the FlexE interface groups of FlexE physical interfaces and assign the two interconnected FlexE physical interfaces to the same FlexE interface group. |
FLEXE_PHYGROUP_MISMATCH_RECOVER
|
Message text |
FlexE interface group [INT32] of local FlexE physical interface [STRING] matched the FlexE interface group [INT32] of the peer interface. |
|
Variable fields |
$1: Local FlexE interface group number. $2: Interface name. $3: Peer FlexE interface group number. |
|
Severity level |
5 |
|
Example |
IFNET/5/FLEXE_PHYGROUP_MISMATCH_RECOVER: FlexE interface group 1 of local FlexE physical interface FlexE-50G2/1/1 matched the FlexE interface group 1 of the peer interface. |
|
Explanation |
Two interconnected FlexE physical interfaces were assigned to the same FlexE interface group. |
|
Recommended action |
No action is required. |
FLEXE_PHYLOCAL_FAULT
|
Message text |
Local FlexE physical interface [STRING] failed and a port failure alarm was sent to the peer interface. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
IFNET/4/FLEXE_PHYLOCAL_FAULT: Local FlexE physical interface FlexE-50G2/1/1 failed and a port failure alarm was sent to the peer interface. |
|
Explanation |
A failure occurred on a local FlexE physical interface and an alarm was generated to notify the peer FlexE physical interface. |
|
Recommended action |
Identify whether the physical connection of the local FlexE physical interface is normal or whether the local FlexE physical interface is manually shut down. |
FLEXE_PHYLOCAL_FAULT_RECOVER
|
Message text |
Local FlexE physical interface [STRING] recovered. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
5 |
|
Example |
IFNET/5/FLEXE_PHYLOCAL_FAULT_RECOVER: Local FlexE physical interface FlexE-50G2/1/1 recovered. |
|
Explanation |
The failure on the local FlexE physical interface recovered. |
|
Recommended action |
No action is required. |
FLEXE_PHYNUM_MISMATCH
|
Message text |
PHY number [INT32] of local FlexE physical interface [STRING] did not match the PHY number [INT32] of the peer interface. |
|
Variable fields |
$1: PHY number for the local FlexE physical interface. $2: Interface name. $3: PHY number for the peer FlexE physical interface. |
|
Severity level |
4 |
|
Example |
IFNET/4/FLEXE_PHYNUM_MISMATCH: PHY number 10 of local FlexE physical interface Flex-50GE-2/1/1 did not match the PHY number 20 of the peer interface. |
|
Explanation |
Two interconnected FlexE physical interfaces were configured with different PHY numbers. |
|
Recommended action |
Use the phy-number command to modify PHY numbers of FlexE physical interfaces to ensure configuration consistency. |
FLEXE_PHYNUM_MISMATCH_RECOVER
|
Message text |
PHY number [INT32] of local FlexE physical interface [STRING] matched the PHY number [INT32] of the peer interface. |
|
Variable fields |
$1: PHY number for the local FlexE physical interface. $2: Interface name. $3: PHY number for the peer FlexE physical interface. |
|
Severity level |
5 |
|
Example |
IFNET/5/FLEXE_PHYNUM_MISMATCH_RECOVER: PHY number 10 of local FlexE physical interface FlexE-50G2/1/1 matched the PHY number 10 of the peer interface. |
|
Explanation |
Two interconnected FlexE physical interfaces were configured with the same PHY number. |
|
Recommended action |
No action is required. |
FLEXE_PHYREMOTE_FAULT
|
Message text |
The peer interface of local FlexE physical interface [STRING] failed. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
IFNET/4/FLEXE_PHYREMOTE_FAULT: The peer interface of local FlexE physical interface FlexE-50G2/1/1 failed. |
|
Explanation |
The peer FlexE physical interface failed. |
|
Recommended action |
Identify whether the physical connection of the peer FlexE physical interface is normal or whether the peer FlexE physical interface is manually shut down. |
FLEXE_PHYREMOTE_FAULT_RECOVER
|
Message text |
The peer interface of local FlexE physical interface [STRING] recovered. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
5 |
|
Example |
IFNET/5/FLEXE_PHYREMOTE_FAULT_RECOVER: The peer interface of local FlexE physical interface FlexE-50G2/1/1 recovered. |
|
Explanation |
The peer FlexE physical interface recovered. |
|
Recommended action |
No action is required. |
FLEXE_STSG_MISMATCH
|
Message text |
The sub-timeslot granularity [INT32] Gbps of the subcard where local FlexE physical interface [STRING] resides did not match that of the subcard where the peer interface resides. |
|
Variable fields |
$1: Sub-timeslot granularity. $2: Interface name. |
|
Severity level |
4 |
|
Example |
IFNET/4/FLEXE_STSG_MISMATCH: The sub-timeslot granularity 5 Gbps of the subcard where local FlexE interface FlexE-50G2/1/1 resides did not match that of the subcard where the peer interface resides. |
|
Explanation |
The subcards of two interconnected FlexE physical interfaces were configured with different sub-timeslot granularities. |
|
Recommended action |
Use the flexe sub-time-slot granula command to modify the sub-timeslot granularities of two interconnected devices to ensure configuration consistency. |
FLEXE_STSG_MISMATCH_RECOVER
|
Message text |
The sub-timeslot granularity [INT32] Gbps of the subcard where local FlexE physical interface [STRING] resides matched that of the subcard where the peer interface resides. |
|
Variable fields |
$1: Sub-timeslot granularity. $2: Interface name. |
|
Severity level |
5 |
|
Example |
IFNET/5/FLEXE_STSG_MISMATCH_RECOVER: The sub-timeslot granularity 5 Gbps of the subcard where local FlexE interface FlexE-50G2/1/1 resides matched that of the subcard where the peer interface resides. |
|
Explanation |
The subcards of two interconnected FlexE physical interfaces were configured with the same sub-timeslot granularity. |
|
Recommended action |
No action is required. |
IF_JUMBOFRAME_WARN
|
Message text |
The specified size of jumbo frames on the aggregate interface [STRING] is not supported on the member port [STRING]. |
|
Variable fields |
$1: Aggregate interface name. $1: Member port name. |
|
Severity level |
3 |
|
Example |
IFNET/3/IF_JUMBOFRAME_WARN: -MDC=1-Slot=3; The specified size of jumbo frames on the aggregate interface Bridge-Aggregation1 is not supported on the member port GigabitEthernet1/0/1. |
|
Explanation |
Some member ports do not support the jumbo frame size configured on the aggregate interface. |
|
Recommended action |
1. Identity the value range for the jumbo frame size supported on member ports. 2. Specify a jumbo frame size supported by member ports for the aggregate interface. |
IFMGR_SMOOTH_IF_FAILED
|
Message text |
Failed to smooth interfaces to UP [STRING]. Total failed interfaces: [STRING]. Recently failed to smooth [STRING] interfaces: [STRING]. |
|
Variable fields |
$1: UP ID. $2: Total number of interfaces failing to be smoothed. $3: Number of interfaces failing to be smoothed recently. $4: List of interfaces failing to be smoothed. |
|
Severity level |
5 |
|
Example |
IFNET/5/IFMGR_SMOOTH_IF_FAILED: Failed to smooth interfaces to UP 1024. Total failed interfaces: 510. Recently failed to smooth 2 interfaces: GE1/1/0, GE1/2/0. |
|
Explanation |
The CP failed to smooth interface information to a UP. |
|
Recommended action |
1. Verify that the interfaces exist on the UP. 2. Verify that the protocol channel, management channel, and control channel between the CP and UP operate properly. 3. Contact Technical Support. |
INTERFACE_NOTSUPPRESSED
|
Message text |
Interface [STRING] is not suppressed. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
6 |
|
Example |
IFNET/6/INTERFACE_NOTSUPPRESSED: Interface GigabitEthernet1/0/1 is not suppressed. |
|
Explanation |
The interface changed from suppressed state to unsuppressed state. When the interface is unsuppressed, the upper-layer services can detect the physical state changes of the interface. |
|
Recommended action |
No action is required. |
INTERFACE_SUPPRESSED
|
Message text |
Interface [STRING] was suppressed. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
5 |
|
Example |
IFNET/5/INTERFACE_SUPPRESSED: Interface GigabitEthernet1/0/1 was suppressed. |
|
Explanation |
The interface was suppressed because its state frequently changed. When the interface is suppressed, the upper-layer services cannot detect the physical state changes of the interface. |
|
Recommended action |
1. Check whether the network cable of the interface or peer interface is frequently plugged and unplugged. 2. Configure physical state change suppression to adjust the suppression parameters. |
LINK_UPDOWN
|
Message text |
Line protocol state on the interface [STRING] changed to [STRING]. |
|
Variable fields |
$1: Interface name. $2: State of link layer protocol, which can be up or down. |
|
Severity level |
4 |
|
Example |
IFNET/4/LINK_UPDOWN: Line protocol state on the interface GigabitEthernet1/0/1 changed to down. |
|
Explanation |
The link layer protocol state changed on an interface. |
|
Recommended action |
When the link layer protocol state of an interface is down, use the display interface command to display the link layer protocol state and locate the reason for which the link layer protocol state changed to down on the interface. |
PFC_WARNING
|
Message text |
On interface [STRING], the rate of [STRING] PFC packets of 802.1p priority [INTEGER] exceeded the PFC early-warning threshold [INTEGER] pps. The current rate is [INTEGER]. |
|
Variable fields |
$1: Interface name. $2: Alarm direction, which can be input or output. $3: 802.1p priority. $4: Rate threshold at which the interface receives or sends PFC frames, in pps. $5: Rate at which the interface receives or sends PFC frames, in pps. |
|
Severity level |
4 |
|
Example |
IFNET/4/PFC_WARNING: On interface GigabitEthernet1/0/1, the rate of input PFC packets of 802.1p priority 1 exceeded the PFC early-warning threshold 50 pps. The current rate is 60. |
|
Explanation |
The rate at which the interface receives or sends PFC frames reaches the early-warning threshold. |
|
Recommended action |
No action is required. |
PHY_UPDOWN
|
Message text |
Physical state on the interface [STRING] changed to [STRING]. |
|
Variable fields |
$1: Interface name. $2: Link state, which can be up or down. |
|
Severity level |
3 |
|
Example |
IFNET/3/PHY_UPDOWN: Physical state on the GigabitEthernet1/0/1 changed to down. |
|
Explanation |
The physical state changed on an interface. |
|
Recommended action |
When the interface is physically down, check whether a physical link is present or whether the link fails. |
PROTOCOL_UPDOWN
|
Message text |
Protocol [STRING] state on the interface [STRING] changed to [STRING]. |
|
Variable fields |
$1: Protocol name. $2: Interface name. $3: Protocol state, which can be up or down. |
|
Severity level |
5 |
|
Example |
IFNET/5/PROTOCOL_UPDOWN: Protocol IPX state on the interface GigabitEthernet1/0/1 changed to up. |
|
Explanation |
The state of a protocol has been changed on an interface. |
|
Recommended action |
When the state of a network layer protocol is down, check the network layer protocol configuration. |
STORM_CONSTRAIN_BELOW
|
Message text |
[STRING] is in controlled status, [STRING] flux falls below its lower threshold [STRING]. |
|
Variable fields |
$1: Interface name. $2: Packet type, which can be BC, MC, or UC. $3: Lower suppression threshold: · lowerlimit% · lowerlimit pps · lowerlimit kbps |
|
Severity level |
1 |
|
Example |
IFNET/1/STORM_CONSTRAIN_BELOW: GigabitEthernet1/0/1 is in controlled status, BC flux falls below its lower threshold 90%. |
|
Explanation |
The port is in controlled state. Any type of traffic on the port drops below the lower threshold from above the upper threshold. |
|
Recommended action |
No action is required. |
STORM_CONSTRAIN_CONTROLLED
|
Message text |
[STRING] turned into controlled status, port status is controlled, packet type is [STRING], upper threshold is [STRING]. |
|
Variable fields |
$1: Interface name. $2: Packet type, which can be BC, MC, or UC. $3: Upper suppression threshold: · upperlimit% · upperlimit pps · upperlimit kbps |
|
Severity level |
1 |
|
Example |
IFNET/1/STORM_CONSTRAIN_CONTROLLED: GigabitEthernet1/0/1 turned into controlled status, port status is controlled, packet type is BC, upper threshold is 90%. |
|
Explanation |
The port is in controlled state. Any type of traffic on the port exceeds the upper threshold. |
|
Recommended action |
No action is required. |
STORM_CONSTRAIN_EXCEED
|
Message text |
[STRING] is in controlled status, [STRING] flux exceeds its upper threshold [STRING]. |
|
Variable fields |
$1: Interface name. $2: Packet type, which can be BC, MC, or UC. $3: Upper suppression threshold: · upperlimit% · upperlimit pps · upperlimit kbps |
|
Severity level |
1 |
|
Example |
IFNET/1/STORM_CONSTRAIN_EXCEED: GigabitEthernet1/0/1 is in controlled status, BC flux exceeds its upper threshold 90%. |
|
Explanation |
The port is in controlled state. Any type of traffic on the port drops below the lower threshold from above the upper threshold. |
|
Recommended action |
No action is required. |
STORM_CONSTRAIN_NORMAL
|
Message text |
[STRING] returned to normal status, port status is [STRING], packet type is [STRING], lower threshold is [STRING]. |
|
Variable fields |
$1: Interface name. $2: Packet type, which can be BC, MC, or UC. $3: Lower suppression threshold: · lowerlimit% · lowerlimit pps · lowerlimit kbps |
|
Severity level |
1 |
|
Example |
IFNET/1/STORM_CONSTRAIN_NORMAL: GigabitEthernet1/0/1 returned to normal status, port status is normal, packet type is BC, lower threshold is 10%. |
|
Explanation |
The port is in normal state. Any type of traffic on the port drops below the lower threshold from above the upper threshold. |
|
Recommended action |
No action is required. |
VLAN_MODE_CHANGE
|
Message text |
Dynamic VLAN [INT32] has changed to a static VLAN. |
|
Variable fields |
$1: VLAN ID. |
|
Severity level |
5 |
|
Example |
IFNET/5/VLAN_MODE_CHANGE: Dynamic VLAN 20 has changed to a static VLAN. |
|
Explanation |
Creating a VLAN interface for a VLAN cause the dynamic VLAN to become a static VLAN. |
|
Recommended action |
No action is required. |
IGMP
This section contains IGMP messages.
IGMP_UNICFG_SMOOTH_FAIL
|
Message text |
Failed to smooth configuration with UP (UP-ID:[INTEGER]) from BRAS-VM. |
|
Variable fields |
$1: UP ID |
|
Severity level |
4 |
|
Example |
IGMP/4/IGMP_UNICFG_SMOOTH_FAIL: Failed to smooth configuration with UP (UP-ID:1024) from BRAS-VM. |
|
Explanation |
The system failed to smooth configuration with a UP-VM from the BRAS-VM. |
|
Recommended action |
Verify that the NETCONF channel and CUSP channel between the BRAS-VM and UP-VM are operating correctly. |
IKE messages
This section contains IKE messages.
IKE_P1_SA_ESTABLISH_FAIL
|
Message text |
Failed to establish phase 1 SA for the reason of [STRING]. The SA's source address is [STRING], and its destination address is [STRING]. |
|
Variable fields |
$1: no matching proposal | invalid ID information | unavailable certificate | unsupported DOI | unsupported situation | invalid proposal syntax | invalid SPI | invalid protocol ID | invalid certificate | authentication failure | invalid message header | invalid transform ID | malformed payload | retransmission timeout | incorrect configuration. $2: Source address. $3: Destination address. |
|
Severity level |
6 |
|
Example |
IKE/6/IKE_P1_SA_ESTABLISH_FAIL: Failed to establish phase 1 SA for the reason of no matching proposal. The SA’s source address is 1.1.1.1 and its destination address is 2.2.2.2. |
|
Explanation |
An IKE SA cannot be established in phase 1. The failure reason is displayed. |
|
Recommended action |
Check the IKE configuration on the local and remote devices. |
IKE_P2_SA_ESTABLISH_FAIL
|
Message text |
Failed to establish phase 2 SA for the reason of [STRING]. The SA's source address is [STRING], and its destination address is [STRING]. |
|
Variable fields |
$1: invalid key information | invalid ID information | unavailable proposal | unsupported DOI | unsupported situation | invalid proposal syntax | invalid SPI | invalid protocol ID | invalid hash information | invalid message header | malformed payload | retransmission timeout | incorrect configuration. $2: Source address. $3: Destination address. |
|
Severity level |
6 |
|
Example |
IKE/6/IKE_P2_SA_ESTABLISH_FAIL: Failed to establish phase 2 SA for the reason of invalid key information. The SA’s source address is 1.1.1.1, and its destination address is 2.2.2.2. |
|
Explanation |
An IPsec SA cannot be established in phase 2. The failure reason is displayed. |
|
Recommended action |
Check the IKE and IPsec configurations on the local and remote devices. |
IKE_P2_SA_TERMINATE
|
Message text |
The IKE phase 2 SA was deleted for the reason of [STRING]. The SA's source address is [STRING], and its destination address is [STRING]. |
|
Variable fields |
$1: Reason that the SA is deleted, which is SA expiration. $2: Source address. $3: Destination address. |
|
Severity level |
6 |
|
Example |
IKE/6/IKE_P2_SA_TERMINATE: The IKE phase 2 SA was deleted for the reason of SA expiration. The SA’s source address is 1.1.1.1, and its destination address is 2.2.2.2. |
|
Explanation |
An IPsec SA is deleted in phase 2 because it expires. |
|
Recommended action |
No action is required. |
INQA messages
This section contains iNQA messages.
INQA_COUNTER_NORES
|
Message text |
Not enough counter resource. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
INQA/4/INQA_COUNTER_NORES: Not enough counter resource. |
|
Impact |
The system failed to perform iNQA operations on the newly learned target flows. |
|
Cause |
The system failed to perform iNQA operations on the newly learned target flows because of insufficient counter resources. |
|
Recommended action |
1. Use the display this command in iNQA view to view configured iNQA instances. 2. Use the undo instance instance-id command to delete unnecessary instances, thus releasing counter resources. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
INQA_ACL_NORES
|
Message text |
Not enough ACL resource. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
INQA/4/INQA_ACL_NORES: Not enough ACL resource. |
|
Impact |
The system failed to perform iNQA operations on the newly learned target flows. |
|
Cause |
The system failed to perform iNQA operations on the newly learned target flows because of insufficient ACL resources. |
|
Recommended action |
1. Use the display this command in iNQA view to view configured iNQA instances. 2. Use the undo instance instance-id command to delete unnecessary instances, thus releasing ACL resources. 3. Delete other unnecessary services that occupy ACL resources. 4. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
iNQA messages
iNQA
This section contains Intelligent Network Quality Analyzer (iNQA) messages.
INQA_BWD_LOSS_EXCEED
|
Message text |
Packet loss rate of the backward flow in instance [UINT] exceeded the upper limit. |
|
Variable fields |
$1: Instance ID. |
|
Severity level |
5 |
|
Example |
INQA/5/INQA_BWD_LOSS_EXCEED: Packet loss rate of the backward flow in instance 1 exceeded the upper limit. |
|
Explanation |
The message is sent when the packet loss rate of the backward flow exceeds the upper limit. |
|
Recommended action |
Examine the network and verify the physical connections are correct. |
INQA_BWD_LOSS_RECOV
|
Message text |
Packet loss rate of the backward flow in instance [UINT] recovered. |
|
Variable fields |
$1: Instance ID. |
|
Severity level |
6 |
|
Example |
INQA/6/INQA_BWD_LOSS_RECOV: Packet loss rate of the backward flow in instance 1 recovered. |
|
Explanation |
The message is sent when the packet loss rate of the backward flow drops down below the upper limit. |
|
Recommended action |
N/A |
INQA_DEBUG_FAIL
|
Message text |
Setting debugging switch to drive failed. |
|
Severity level |
5 |
|
Example |
INQA/5/INQA_DEBUG_FAIL: Setting debugging switch to drive failed. |
|
Explanation |
This message is sent when the system fails to set iNQA debugging switch to drive. |
|
Recommended action |
Delete the iNQA debugging switch setting and reconfigure the debugging. |
INQA_FLAG_DIFF
|
Message text |
Flags of collectors bound with the analyzer instance [UINT] are inconsistent. |
|
Variable fields |
$1: ID of the analyzer instance. |
|
Severity level |
5 |
|
Example |
INQA/5/INQA_FLAG_DIFF: Flags of collectors bound with the analyzer instance 1 are inconsistent. |
|
Explanation |
This message is sent when iNQA detects that the flag bit settings on the collectors bound to analyzer instance 1 are inconsistent. |
|
Recommended action |
Verify that the same flag bit is set on all collectors that are bound to the analyzer instance. |
INQA_FLAG_FAIL
|
Message text |
Setting coloring bit to drive failed. |
|
Severity level |
5 |
|
Example |
INQA/5/INQA_FLAG_FAIL: Setting coloring bit to drive failed. |
|
Explanation |
This message is sent when the system fails to set the color bit setting to the drive. |
|
Recommended action |
1. Use the display qos-acl resource command to verify that the ACL resources are sufficient. 2. If the resources are not sufficient, delete unnecessary ACLs and reconfigure the instance. |
INQA_FLOW_DIFF
|
Message text |
Flows of collectors bound with the analyzer instance [UINT] are inconsistent. |
|
Variable fields |
$1: ID of the analyzer instance. |
|
Severity level |
5 |
|
Example |
INQA/5/INQA_FLOW_DIFF: Flows of collectors bound with the analyzer instance 1 are inconsistent. |
|
Explanation |
This message is sent when iNQA detects that the target flows in statistics packets reported by the collectors bound to analyzer instance 1 are inconsistent. |
|
Recommended action |
Verify that the same target flow is defined on all collectors that are bound to the analyzer instance. |
INQA_FWD_LOSS_EXCEED
|
Message text |
Packet loss rate of the forward flow in instance [UINT] exceeded the upper limit. |
|
Variable fields |
$1: Instance ID. |
|
Severity level |
5 |
|
Example |
INQA/5/INQA_FWD_LOSS_EXCEED: Packet loss rate of the forward flow in instance 1 exceeded the upper limit. |
|
Explanation |
The message is sent when the packet loss rate of the forward flow exceeds the upper limit. |
|
Recommended action |
Examine the network and verify the physical connections are correct. |
INQA_FWD_LOSS_RECOV
|
Message text |
Packet loss rate of the forward flow in instance [UINT] recovered. |
|
Variable fields |
$1: Instance ID. |
|
Severity level |
6 |
|
Example |
INQA/6/INQA_FWD_LOSS_RECOV: Packet loss rate of the forward flow in instance 1 recovered. |
|
Explanation |
The message is sent when the packet loss rate of the forward flow drops down below the upper limit. |
|
Recommended action |
N/A |
INQA_INST_FAIL
|
Message text |
Setting instance [UINT] information to drive failed. |
|
Variable fields |
$1: Instance ID. |
|
Severity level |
5 |
|
Example |
INQA/5/INQA_INST_FAIL: Setting instance 1 information to drive failed. |
|
Explanation |
This message is sent when the system fails to send the instance configuration to the drive. |
|
Recommended action |
1. Use the display qos-acl resource command to verify that the ACL resources are sufficient. 2. If the resources are not sufficient, delete unnecessary ACLs and reconfigure the instance. |
INQA_INTVL_DIFF
|
Message text |
Intervals of collectors bound with analyzer instance [UINT] are inconsistent. |
|
Variable fields |
$1: ID of the analyzer instance. |
|
Severity level |
5 |
|
Example |
INQA/5/INQA_INTVL_DIFF: Intervals of collectors bound with analyzer instance 1 are inconsistent. |
|
Explanation |
This message is sent when iNQA detects that the measurement intervals in statistics packets reported by the collectors bound to analyzer instance 1 are inconsistent. |
|
Recommended action |
Verify that the same measurement intervals are configured on all collectors that are bound to the analyzer instance. |
INQA_NO_RESOURCE
|
Message text |
Failed to configure instance [UINT] due to insufficient resources. |
|
Variable fields |
$1: ID of the instance. |
|
Severity level |
5 |
|
Example |
INQA/5/INQA_NO_RESOURCE: Failed to configure instance 1 due to insufficient resources. |
|
Explanation |
This message is sent when iNQA fails to configure an instance due to insufficient ACL resources. |
|
Recommended action |
Release ACL resources by deleting unused iNQA instances or unused ACL resources, and then configure the instance. |
INQA_NO_SUPPORT
|
Message text |
iNQA is not supported in this slot. |
|
Severity level |
5 |
|
Example |
INQA/5/INQA_NO_SUPPORT: iNQA is not supported in this slot. |
|
Explanation |
This message is sent when the specified slot does not support iNQA. |
|
Recommended action |
Install an iNQA-capable module in the slot or switch the traffic for iNQA measurement to another slot that supports iNQA. |
INQA_SMOOTH_BEGIN_FAIL
|
Message text |
Setting smoothing beginning to kernel failed. |
|
Severity level |
5 |
|
Example |
INQA/5/INQA_SMOOTH_BEGIN_FAIL: Setting smoothing beginning to the kernel failed. |
|
Explanation |
This message is sent when iNQA fails to notify the kernel of the start of the smooth. |
|
Recommended action |
Please contact H3C support. |
INQA_SMOOTH_END_FAIL
|
Message text |
Setting smoothing ending to kernel failed. |
|
Severity level |
5 |
|
Example |
INQA/5/INQA_SMOOTH_END_FAIL: Setting smoothing ending to kernel failed. |
|
Explanation |
This message is sent when iNQA fails to notify the kernel of the end of the smooth. |
|
Recommended action |
Please contact H3C support. |
INTRACE messages
This section contains Internet Protocol Control Block (INPCB) messages.
WHITELIST
|
Message text |
-[STRING]; Failed to add ACL rule [STRING]:[UINT16] -> [STRING]:[UINT16] to the whitelist, VRF: [UINT16], error code: 0x[UINT32]. |
|
Variable fields |
$1: Card number. $2: Local address. $3: Local port number. $4: Remote address. $5: Remote port number. $6: VRF (VPN instance) index. $7: Error code: ¡ 0x22010002—The ACL rule already exists. ¡ 0x22010008—The number of rules in the whitelist has reached the upper limit. ¡ 0x40010001—Other errors, for example, the MDC control block does not exist. ¡ 0x4001000B—Insufficient resources. |
|
Severity level |
3 |
|
Example |
INTRACE/3/WHITELIST: -Chassis=2-Slot=3; Failed to add ACL rule 1.1.1.1:36523 -> 1.1.1.2:179 to the whitelist, VRF: 0, error code: 0x22010002. |
|
Explanation |
A TCP-based service failed to add an ACL rule to the whitelist. |
|
Recommended action |
Verify that the TCP connection is correct for the TCP-based service. |
|
Message text |
-[STRING]; Failed to delete ACL rule [STRING]:[UINT16] -> [STRING]:[UINT16] from the whitelist, VRF: [UINT16], error code: 0x[UINT32]. |
|
Variable fields |
$1: Card number. $2: Local address. $3: Local port number. $4: Remote address. $5: Remote port number. $6: VRF (VPN instance) index. $7: Error code: ¡ 0x40010001—Other errors, for example, the MDC control block does not exist. ¡ 0x40010008—Incorrect input parameters. ¡ 0x4001000B—Insufficient resources. |
|
Severity level |
3 |
|
Example |
INTRACE/3/WHITELIST:-Chassis=2-Slot=3; Failed to delete ACL rule 1.1.1.1:36523 -> 1.1.1.2:179 from the whitelist, VRF: 0, error code: 0x22010001. |
|
Explanation |
A TCP-based service failed to remove an ACL rule from the whitelist. |
|
Recommended action |
Verify that the TCP-based service and the whitelist run correctly. |
IP ROUTING messages
This section contains IP routing messages.
ROUTE_NORES
|
Message text |
No enough resource. |
|
Variable fields |
N/A |
|
Severity level |
3 (Error) |
|
Example |
L3/3/ROUTE_NORES: -MDC=1-Slot=4; No enough resource |
|
Impact |
The current service will fail or ongoing services will be interrupted. |
|
Cause |
The device cannot run all deployed services because of excessive running services and insufficient hardware resources. For example, packet statistics collection cannot be performed because of insufficient statistics-collection resources. |
|
Recommended action |
1. Stop unnecessary processes to release hardware resources. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
ECMP_NORES
|
Message text |
Not enough ECMP-ID resource. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
L3/4/ECMP_NORES: -MDC=1-Slot=5; Not enough ECMP-ID resource. |
|
Impact |
The device cannot learn new IPv4 ECMP routes. |
|
Cause |
The device cannot assign ECMP IDs to new IPv4 ECMP routes because the number of IPv4 ECMP routes has reached the upper limit. |
|
Recommended action |
1. Delete invalid IPv4 ECMP routes. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
ROUTE6_ECMP_NORES
|
Message text |
Not enough ECMP-ID resource. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
L3/4/ROUTE6_ECMP_NORES: -MDC=1-Slot=5; Not enough ECMP-ID resource. |
|
Impact |
The device cannot learn new IPv6 ECMP routes. |
|
Cause |
The device cannot assign ECMP IDs to new IPv6 ECMP routes because the number of IPv6 ECMP routes has reached the upper limit. |
|
Recommended action |
1. Delete invalid IPv6 ECMP routes. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
VN_NORES
|
Message text |
No enough VN index resource. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
L3/4/VN_NORES: -MDC=1-Slot=3; No enough VN index resource. |
|
Impact |
The device cannot learn new non-host routes. |
|
Cause |
The device cannot to assign virtual nexthop (VN) indexes to new ECMP routes because the number of ECMP routes has reached the upper limit. |
|
Recommended action |
1. Delete invalid non-host routes. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
VN_ECMP_NORES
|
Message text |
Not enough ECMP-ID resource. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
L3/4/VN_ECMP_NORES: -MDC=1-Slot=3; Not enough ECMP-ID resource. |
|
Impact |
The device cannot learn new IPv4 or IPv6 ECMP routes. |
|
Cause |
The device cannot assign virtual nexthop (VN) indexes to new IPv4 or IPv6 ECMP routes because the number of IPv4 and IPv6 ECMP routes has reached the upper limit. |
|
Recommended action |
1. Delete unnecessary IPv4 and IPv6 ECMP routes. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
IP6ADDR
This section contains IPv6 addressing messages.
IP6ADDR_ADDLINKLOCAL_FAIL
|
Message text |
Failed to add a link-local address of interface [STRING] to driver. Reason: [STRING]. |
|
Variable fields |
$1: Interface name. $2: Failure reasons: ¡ Deploying link-local addresses to driver is not supported. ¡ Insufficient resources. ¡ Unknown error. |
|
Severity level |
4 |
|
Example |
IP6ADDR/4/IP6ADDR_ADDLINKLOCAL_FAIL: Failed to add a link-local address of interface GigabitEthernet1/0/1 to driver. Reason: Insufficient resources. |
|
Explanation |
This message is sent when the device fails to send an IPv6 link-local address of an interface to the driver. A link-local address can be generated through stateful or stateless IPv6 address autoconfiguration or manual IPv6 address assignment. |
|
Recommended action |
· If the device does not support deploying link-local addresses to driver, no action is required. · If the failure is caused by insufficient resources, release memory resources and execute the operation again. · If the failure is caused by an unknown error, please contact H3C Support. |
IP6ADDR_CREATEADDRESS_CONFLICT
|
Message text |
Failed to create an address by the prefix. Reason: [STRING] on [STRING] conflicts with SRv6 locator [STRING]. |
|
Variable fields |
$1: IPv6 address. $2: Interface name. $3: IPv6 prefix of the locator. |
|
Severity level |
4 |
|
Example |
IP6ADDR/4/IP6ADDR_CREATEADDRESS_CONFLICT: Failed to create an address by the prefix. Reason: 2000::1234:0:0:1/80 on GigabitEthernet1/0/1 conflicts with SRv6 locator 2000::1/64. |
|
Explanation |
This message is sent when the ipv6 address prefix-number configuration conflicts with the SRv6 locator configuration in SRv6 view. |
|
Recommended action |
Remove the conflicting configuration and reconfigure the ipv6 address prefix-number command. |
IP6ADDR_CREATEADDRESS_ERROR
|
Message text |
Failed to create an address by the prefix. Reason: [STRING] on [STRING] and [STRING] on [STRING] overlap. |
|
Variable fields |
$1: IPv6 prefix. $2: Interface name. $3: IPv6 prefix. $4: Interface name. |
|
Severity level |
4 |
|
Example |
IP6ADDR/4/IP6ADDR_CREATEADDRESS_ERROR: Failed to create an address by the prefix. Reason: 2001::/ 64 on GigabitEthernet1/0/2 and 2001::/64 on GigabitEthernet1/0/1 overlap. |
|
Explanation |
The device failed to use a prefix to generate an IPv6 address for an interface because the prefixes overlapped on this interface and another interface. |
|
Recommended action |
Cancel the IPv6 address configuration on the conflicting interface and configure the interface to generate an IPv6 address by using a different prefix. |
IP6ADDR_CREATEADDRESS_INVALID
|
Message text |
Can't configure the unspecified address or loopback address on [STRING] by using a prefix with all zeros. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
IP6ADDR/4/IP6ADDR_CREATEADDRESS_INVALID: Can't configure the unspecified address or loopback address on GigabitEthernet1/0/1 by using a prefix with all zeros. |
|
Explanation |
This message is sent when you use the ipv6 prefix command to configure an all-zero IPv6 prefix and then specify this prefix in the ipv6 address prefix-number command to configure an unspecified or loopback IPv6 address for an interface. Interfaces do not support the unspecified or loopback IPv6 address. |
|
Recommended action |
Cancel the configuration and reconfigure an IPv6 address for the interface. |
IP6ADDR_FUNCTION_FAIL
|
Message text |
Failed to enable IPv6 on interface [STRING]. Reason: [STRING]. |
|
Variable fields |
$1: Interface name. $2: Failure reasons: ¡ Insufficient resources. ¡ IPv6 is not supported. ¡ Unknown error. |
|
Severity level |
4 |
|
Example |
IP6ADDR/6/IP6ADDR_FUNCTION_FAIL: Failed to enable IPv6 on interface GigabitEthernet1/0/1. Reason: Insufficient resources. |
|
Explanation |
This message is sent when the device fails to enable IPv6 on an interface during the stateful or stateless IPv6 address autoconfiguration or manual IPv6 address assignment. |
|
Recommended action |
· If the failure is caused by insufficient resources, release memory resources and execute the operation again. · If the failure is caused by an unknown error, please contact H3C Support. |
IP6FW messages
This section contains IPv6 Forwarding (IP6FW) messages.
IP6FW_ABNORMAL_HEADERS
|
Message text |
Received an IPv6 packet with repeated extension headers. |
|
Variable fields |
None. |
|
Severity level |
6 |
|
Example |
IP6FW/6/IP6FW_ABNORMAL_HEADERS: Received an IPv6 packet with repeated extension headers. |
|
Explanation |
This message is sent when the device received an IPv6 packet with repeated extension headers. |
|
Recommended action |
Verify the packet source. |
IP6FW_FAILED_TO_SET_MTU
|
Message text |
Failed to set MTU [UINT32] on interface [STRING] for IPv6 packets. |
|
Variable fields |
$1: MTU value. $2: Interface name. |
|
Severity level |
5 |
|
Example |
IP6FW/5/IP6FW_FAILED_TO_SET_MTU: Failed to set MTU 9600 on interface GigabitEthernet6/3/8 for IPv6 packets. |
|
Explanation |
Failed to set an MTU value on an interface. |
|
Recommended action |
Modify the MTU value for the interface. |
IP6FW_PMTU_MAXNUMBER
|
Message text |
The number of toobig PMTU entries has reached the limit. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
IP6FW/6/IP6FW_PMTU_MAXNUMBER: The number of toobig PMTU entries has reached the limit. |
|
Explanation |
The device cannot add any dynamic entries for toobig packets any longer, because the number of toobig PMTU entries has reached the limit. |
|
Recommended action |
No action is required. |
IPADDR messages
This section contains IP addressing messages.
IPADDR_HA_EVENT_ERROR
|
Message text |
A process failed HA upgrade because [STRING]. |
|
Variable fields |
$1: HA upgrade failure reason: ¡ IPADDR failed the smooth upgrade. ¡ IPADDR failed to reupgrade to the master process. ¡ IPADDR stopped to restart the timer. ¡ IPADDR failed to upgrade to the master process. ¡ IPADDR failed to restart the upgrade. ¡ IPADDR failed to add the unicast object to the master task epoll. ¡ IPADDR failed to create an unicast object. ¡ IPADDR role switchover failed when the standby process switched to the master process. ¡ IPADDR switchover failed when the master process switched to the standby process. ¡ IPADDR HA upgrade failed. ¡ IPADDR failed to set the interface filtering criteria. ¡ IPADDR failed to register interface events. ¡ IPADDR failed to subscribe port events. ¡ IPADDR failed to add a VPN port event to the master epoll. ¡ IRDP failed to open DBM. ¡ IRDP failed to initiate a connection to the device management module. ¡ IRDP failed to add the master task epoll with the handle used to connect to the device management module. ¡ IRDP failed to register device management events. ¡ IRDP failed to subscribe port events. ¡ IRDP failed to add the master task epoll with the handle used to subscribe port events. ¡ IRDP failed to set the interface filtering criteria. ¡ IRDP failed to register interface events. ¡ IRDP failed to register network events. ¡ IRDP failed to create the interface control block storage handle. ¡ IRDP failed to create the timer. ¡ IRDP failed to add the master task epoll with the handle used to create the timer. ¡ IRDP failed to set the schedule time for the timer. ¡ IRDP failed to set the timer to unblocked status. ¡ IRDP failed to create a timer instance. |
|
Severity level |
4 |
|
Example |
IPADDR/4/IPADDR_HA_EVENT_ERROR: A process failed HA upgrade because IPADDR failed the smooth upgrade. |
|
Explanation |
A process failed HA upgrade and the message showed the failure reason. |
|
Recommended action |
· Please contact H3C Support. |
IPADDR_HA_STOP_EVENT
|
Message text |
The device received an HA stop event. |
|
Variable fields |
None. |
|
Severity level |
4 |
|
Example |
IPADDR/4/IPADDR_HA_STOP_EVENT: The device received an HA stop event. |
|
Explanation |
This message is sent when the device receives an HA stop event. |
|
Recommended action |
· Please contact H3C Support. |
IPFW messages
This section contains IP Forwarding (IPFW) messages.
IP_ADD_FLOW_ANTITCPSYNFLD
|
Message text |
Add a flow-based entry: Packet type=[STRING]; SrcIP=[IPADDR]; DstPort=[UINT16]; VPN=[STRING]. |
|
Variable fields |
$1: Packet type: MPLS or IP. $2: Source IP address of the attack packet. $3: Destination port number of the attack packet. $4: VPN instance name. The field value is the public network if the attack packet belongs to the public network and is N/A if no name is obtained. |
|
Severity level |
4 |
|
Example |
IPFW/4/IP_ADD_FLOW_ANTITCPSYNFLD: Add a flow-based entry: Packet type=IP; SrcIP=2000::1; DstPort=23; VPN=the public network |
|
Explanation |
The device detected a flow-based TCP SYN flood attack and added a flow-based TCP SYN flood attack prevention entry. |
|
Recommended action |
Check the attack source. |
IP_ADD_FLOW_ANTIUDPFLD
|
Message text |
Add a flow-based entry: Packet type=[STRING]; SrcIP=[IPADDR]; DstPort=[UINT16]; VPN=[STRING]. |
|
Variable fields |
$1: Packet type: MPLS or IP. $2: Source IP address of the attack packet. $3: Destination port number of the attack packet. $4: VPN instance name. The field value is the public network if the attack packet belongs to the public network and is N/A if no name is obtained. |
|
Severity level |
4 |
|
Example |
IPFW/4/IP_ADD_FLOW_ANTIUDPFLD: Add a flow-based entry: Packet type=IP; SrcIP=2000::1; DstPort=69; VPN=the public network. |
|
Explanation |
The device detected a flow-based UDP flood attack and added a flow-based UDP flood attack prevention entry. |
|
Recommended action |
Check the attack source. |
IP_ADD_INTERFACE_ANTITCPSYNFLD
|
Message text |
Add an interface-based entry: Packet type=[STRING]; Interface=[STRING]. |
|
Variable fields |
$1: Packet type: MPLS or IP. $2: Interface name. |
|
Severity level |
4 |
|
Example |
IPFW/4/IP_ADD_INTERFACE_ANTITCPSYNFLD: Add an interface-based entry: Packets type=MPLS; Interface=GigabitEthernet1/0/1. |
|
Explanation |
The device detected an interface-based TCP SYN flood attack and added an interface-based TCP SYN flood attack prevention entry. |
|
Recommended action |
Check the attack source. |
IP_ADD_INTERFACE_ANTIUDPFLD
|
Message text |
Add an interface-based entry: Packet type=[STRING]; Interface=[STRING]. |
|
Variable fields |
$1: Packet type: MPLS or IP. $2: Interface name. |
|
Severity level |
4 |
|
Example |
IPFW/4/IP_ADD_INTERFACE_ANTIUDPFLD: Add an interface-based entry: Packets type=MPLS; Interface=GigabitEthernet1/0/1. |
|
Explanation |
The device detected an interface-based UDP flood attack and added an interface-based UDP flood attack prevention entry. |
|
Recommended action |
Check the attack source. |
IP_DEL_FLOW_ANTITCPSYNFLD
|
Message text |
Delete a flow-based entry: Packet type=[STRING]; SrcIP=[IPADDR]; DstPort=[UINT16]; VPN=[STRING]. |
|
Variable fields |
$1: Packet type: MPLS or IP. $2: Source IP address of the attack packet. $3: Destination port number of the attack packet. $4: VPN instance name. The field value is the public network if the attack packet belongs to the public network and is N/A if no name is obtained. |
|
Severity level |
4 |
|
Example |
IPFW/4/IP_DEL_FLOW_ANTITCPSYNFLD: Delete a flow-based entry: Packet type=MPLS; SrcIP=192.168.1.2; DstPort=80; VPN=vpn1. |
|
Explanation |
A flow-based TCP SYN flood attack prevention entry was deleted. The packet type of the entry is MPLS, the source IP address is 192.168.1.2, the destination port number 80, and the VPN instance is vpn1. |
|
Recommended action |
No action is required. |
IP_DEL_FLOW_ANTIUDPFLD
|
Message text |
Delete a flow-based entry: Packet type=[STRING]; SrcIP=[IPADDR]; DstPort=[UINT16]; VPN=[STRING]. |
|
Variable fields |
$1: Packet type: MPLS or IP. $2: Source IP address of the attack packet. $3: Destination port number of the attack packet. $4: VPN instance name. The field value is the public network if the attack packet belongs to the public network and is N/A if no name is obtained. |
|
Severity level |
4 |
|
Example |
IPFW/4/IP_DEL_FLOW_ANTIUDPFLD: Delete a flow-based entry: Packet type=MPLS; SrcIP=192.168.1.2; DstPort=80; VPN=vpn1. |
|
Explanation |
A flow-based UDP flood attack prevention entry was deleted. The packet type of the entry is MPLS, the source IP address is 192.168.1.2, the destination port number 80, and the VPN instance is vpn1. |
|
Recommended action |
No action is required. |
IP_DEL_INTERFACE_ANTITCPSYNFLD
|
Message text |
Delete an interface-based entry: Packet type=[STRING]; Interface=[STRING]. |
|
Variable fields |
$1: Packet type: MPLS or IP. $2: Interface name. |
|
Severity level |
4 |
|
Example |
IPFW/4/IP_DEL_INTERFACE_ANTITCPSYNFLD: Delete an interface-based entry: Packets type=IP, Interface=GigabitEthernet1/0/1. |
|
Explanation |
An interface-based TCP SYN flood attack prevention entry for GigabitEthernet 1/0/1 with packet type IP was deleted. |
|
Recommended action |
No action is required. |
IP_DEL_INTERFACE_ANTIUDPFLD
|
Message text |
Delete an interface-based entry: Packet type=[STRING]; Interface=[STRING]. |
|
Variable fields |
$1: Packet type: MPLS or IP. $2: Interface name. |
|
Severity level |
4 |
|
Example |
IPFW/4/IP_DEL_INTERFACE_ANTIUDPFLD: Delete an interface-based entry: Packets type=IP, Interface=GigabitEthernet1/0/1. |
|
Explanation |
An interface-based UDP flood attack prevention entry for GigabitEthernet 1/0/1 with packet type IP was deleted. |
|
Recommended action |
No action is required. |
IP_INSERT_FAILED_ANTITCPSYNFLD
|
Message text |
Insert into AVL tree failed for flow-based entry: Family=[UINT32]; DstPort=[UINT16]; VPN=[UINT16]. |
|
Variable fields |
$1: Protocol family number. $2: Destination port number. $3: VPN instance name. |
|
Severity level |
5 |
|
Example |
IPFW/5/IP_INSERT_FAILED_ANTITCPSYNFLD: Insert into AVL tree failed for flow-based entry : Family=2; DstPort=80; VPN=2. |
|
Explanation |
The device failed to insert a flow-based TCP SYN flood attack prevention entry to the AVL tree. The protocol family number is 2, the destination port number is 80, and the VPN instance name is 2. |
|
Recommended action |
No action is required. |
IP_INSERT_FAILED_ANTIUDPFLD
|
Message text |
Insert into AVL tree failed for flow-based entry: Family=[UINT32]; DstPort=[UINT16]; VPN=[UINT16]. |
|
Variable fields |
$1: Protocol family number. $2: Destination port number. $3: VPN instance name. |
|
Severity level |
5 |
|
Example |
IPFW/5/IP_INSERT_FAILED_ANTIUDPFLD: Insert into AVL tree failed for flow-based entry : Family=2; DstPort=80; VPN=2. |
|
Explanation |
The device failed to insert a flow-based UDP flood attack prevention entry to the AVL tree. The protocol family number is 2, the destination port number is 80, and the VPN instance name is 2. |
|
Recommended action |
No action is required. |
IP_NOTSUPPORT_ANTITCPSYNFLD
|
Message text |
TCP SYN flood attack prevention is not supported. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
IPFW/6/IP_NOTSUPPORT_ANTITCPSYNFLD: TCP SYN flood attack prevention is not supported. |
|
Explanation |
The TCP SYN flood attack prevention feature is not supported. |
|
Recommended action |
No action is required. |
IP_NOTSUPPORT_ANTIUDPFLD
|
Message text |
UDP flood attack prevention is not supported. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
IPFW/6/IP_NOTSUPPORT_ANTIUDPFLD: UDP flood attack prevention is not supported. |
|
Explanation |
The UDP flood attack prevention feature is not supported. |
|
Recommended action |
No action is required. |
IP_SETTING_FAILED_ANTITCPSYNFLD
|
Message text |
Setting entry to drive failed. Total failures=[UINT32]. |
|
Variable fields |
$1: Total number of TCP SYN flood attack prevention entries that have been failed to be set to the drive. |
|
Severity level |
5 |
|
Example |
IPFW/5/IP_SETTING_FAILED_ANTITCPSYNFLD: Setting entry to drive failed. Total failures = 12345. |
|
Explanation |
A total of 12345 TCP SYN flood attack prevention entries have been failed to be set to the drive. |
|
Recommended action |
No action is required. |
IP_SETTING_FAILED_ANTIUDPFLD
|
Message text |
Setting entry to drive failed. Total failures=[UINT32]. |
|
Variable fields |
$1: Total number of UDP flood attack prevention entries that have been failed to be set to the drive. |
|
Severity level |
5 |
|
Example |
IPFW/5/IP_SETTING_FAILED_ANTIUDPFLD: Setting entry to drive failed. Total failures = 12345. |
|
Explanation |
A total of 12345 UDP flood attack prevention entries have been failed to be set to the drive. |
|
Recommended action |
No action is required. |
IP_CLEARDRVSTAT_ANTITCPSYNFLD
|
Message text |
Failed to clear drive's statistics. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
IPFW/4/IP_CLEARDRVSTAT_ANTITCPSYNFLD: Failed to clear drive's statistics. |
|
Explanation |
The system failed to clear TCP SYN flood attack prevention statistics from the drive. |
|
Recommended action |
No action is required. |
IP_CLEARDRVSTAT_ANTIUDPFLD
|
Message text |
Failed to clear drive's statistics. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
IPFW/4/IP_CLEARDRVSTAT_ANTIUDPFLD: Failed to clear drive's statistics. |
|
Explanation |
The system failed to clear UDP flood attack prevention statistics from the drive. |
|
Recommended action |
No action is required. |
IPFW_BPA_NORESOURCE
|
Message text |
Not enough resources are available on [STRING] to enable BGP policy accounting for interface [STRING]. |
|
Variable fields |
$1: Chassis number and slot number, or slot number. $2: Interface name. |
|
Severity level |
6 |
|
Example |
IPFW/6/IPFW_BPA_NORESOURCE: -MDC=1-Slot=2; Not enough resources are available on slot2 to enable BGP policy accounting for interface Route-Aggregation1. |
|
Explanation |
The system failed to enable BGP policy accounting on an interface because resources were insufficient for a slot when the bgp-policy accounting command was executed. |
|
Recommended action |
No action is required. |
IPFW_FAILED_TO_SET_MTU
|
Message text |
Failed to set MTU [UINT32] on interface [STRING] for IPv4 packets. |
|
Variable fields |
$1: MTU value. $2: Interface name. |
|
Severity level |
5 |
|
Example |
IPFW/5/IPFW_FAILED_TO_SET_MTU: Failed to set MTU 9600 on interface GigabitEthernet6/3/8 for IPv4 packets. |
|
Explanation |
Failed to set an MTU value on an interface. |
|
Recommended action |
Modify the MTU value for the interface. |
IPFW_FRAGPKTNUM_EXCALARM
|
Message text |
Received packets over limit alarm was detected: IfIndex=[STRING], PeerAddress=[STRING], InterfaceName=[STRING]. |
|
Variable fields |
$1: Index of the interface that received the packet fragment. $2: Destination IP address of the packet fragment. $3: Name of the interface that received the packet fragment. |
|
Severity level |
4 |
|
Example |
IP/4/IPFW_FRAGPKTNUM_EXCALARM: Received packets over limit alarm was detected: IfIndex=258, PeerAddress= 192.168.0.115, InterfaceName=GigabitEthernet2/0/1. |
|
Explanation |
The length of the queue to which the packet fragment belongs has reached 80% of the maximum queue length. |
|
Recommended action |
Check for packet attacks. |
IPFW_FRAGPKTNUM_EXCALARMRESUME
|
Message text |
Received fragment packets over limit alarm was resumed: IfIndex=[STRING], PeerAddress=[STRING], InterfaceName=[STRING]. |
|
Variable fields |
$1: Index of the interface that received the packet fragment. $2: Destination IP address of the packet fragment. $3: Name of the interface that received the packet fragment. |
|
Severity level |
5 |
|
Example |
IP/5/IPFW_FRAGPKTNUM_EXCALARMRESUME: Received fragment packets over limit alarm was resumed: IfIndex=258, PeerAddress= 192.168.0.115, InterfaceName=GigabitEthernet2/0/1. |
|
Explanation |
The length of the queue to which the packet fragment belongs has reduced to 60% of the maximum queue length. |
|
Recommended action |
No action is required. |
IPFW_INFO
|
Message text |
The specified IP load sharing mode is not supported on this slot. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
IPFW/6/IPFW_INFO: -MDC=1-Slot=2; The specified IP load sharing mode is not supported on this slot. |
|
Explanation |
The specified IP load sharing mode is not supported on this slot. |
|
Recommended action |
Configure an IP load sharing mode that is supported on this slot. |
|
Message text |
Failed to configure IP load sharing mode on this slot. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
IPFW/6/IPFW_INFO: -MDC=1-Slot=2; Failed to configure IP load sharing mode on this slot. |
|
Explanation |
Failed to configure IP load sharing mode on this slot. |
|
Recommended action |
Configure an IP load sharing mode that is supported on this slot. |
IPoE messages
This section contains IPoE messages.
IPOE_DEFENSE_ENTRIES_DRV_FAILED
|
Message text |
Failed to add an unclassified-IP defense entry to the driver due to insufficient hardware resources. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
IPOE/4/IPOE_DEFENSE_ENTRIES_DRV_FAILED: Failed to add an unclassified-IP defense entry to the driver due to insufficient hardware resources. |
|
Explanation |
Failed to add a defense entry to the driver because hardware resources were insufficient. |
|
Recommended action |
Execute the reset ip subscriber unclassified-ip-defense command to delete the defense entries that have been deployed to the driver to release resources for new entries. |
IPOE_ENABLE_ERROR
|
Message text |
Failed to [STRING] [STRING] [STRING] for the reason of [STRING] on [STRING]. |
|
Variable fields |
$1: Operation type. Options are: ¡ enable. ¡ disable. $2: Protocol stack type. Options are: ¡ IPv4. ¡ IPv6. $3: Function type. Options are: ¡ IPOE—IPoE or sending unclassified-IP packets to the CPU. ¡ IPOE set web mode—Web or Web MAC authentication. ¡ IPOE http fast reply—HTTP packet fast reply. $4: Failure reason. For more information, see Table 7. $5: Interface name. |
|
Severity level |
3 |
|
Example |
IPOE/3/IPOE_ENABLE_ERROR: Failed to enable IPv4 IPOE for the reason of not enough resources on Route-Aggregation1023. |
|
Explanation |
Failed to enable or disable IPoE on an interface because resources are insufficient, this operation is not supported, or because of other unknown errors. |
|
Recommended action |
See Table 7. |
|
Reason for failure to be issued to the driver |
Description |
Recommended action |
|
this operation is not supported |
This operation is not supported |
Identify whether the interface supports IPoE. |
|
not enough resources |
Resources are insufficient |
Contact Technical Support. |
|
other unknown errors |
Other unknown errors |
Contact Technical Support. |
IPOE_HTTP_DEFENSE
|
Message text |
An HTTP/HTTPS attack was detected, and the attacked destination IP was [ IPADDR] in VPN [STRING]. |
|
Variable fields |
$1: Target IPv4 or IPv6 address of an HTTP/HTTPS attack. $2: Name of the VPN where an HTTP/HTTPS attack occurred. The value N/A indicates that the attacked occurred on the public network. |
|
Severity level |
5 |
|
Example |
IPOE/5/IPOE_HTTP_DEFENSE: An HTTP/HTTPS attack was detected, and the attacked destination IP was 1.1.1.1 in VPN vpn1. |
|
Explanation |
An attack log message was output when the HTTP/HTTPS attack reached the blocking conditions. |
|
Recommended action |
No action is required. |
IPOE_SESSIONS_LOWER_THRESHOLD (non-vBRAS-CPs)
|
Message text |
The IPoE session number is below the lower warning threshold (LowerThreshold=[INT32]). |
|
Variable fields |
$1: Lower online IPoE session count alarm threshold. |
|
Severity level |
4 |
|
Example |
IPOE/4/IPOE_SESSIONS_LOWER_THRESHOLD:The IPoE session number is below the lower warning threshold (LowerThreshold=20). |
|
Explanation |
The online IPoE session count is below the lower threshold. |
|
Recommended action |
Identify whether a large number of IPoE users go offline abnormally. |
IPOE_SESSIONS_LOWER_THRESHOLD (vBRAS-CPs)
|
Message text |
The IPoE session number on slot [INT32] is below the lower warning threshold (LowerThreshold=[INT32]). |
|
Variable fields |
$1: Slot number of the master BRAS-VM. $2: Lower online IPoE session count alarm threshold. |
|
Severity level |
4 |
|
Example |
IPOE/4/IPOE_SESSIONS_LOWER_THRESHOLD:The IPoE session number on slot 97 is below the lower warning threshold (LowerThreshold=20). |
|
Explanation |
The online IPoE session count is below the lower threshold. |
|
Recommended action |
Identify whether a large number of IPoE users go offline abnormally. |
IPOE_SESSIONS_LOWER_RECOVER (non-vBRAS-CPs)
|
Message text |
The IPoE session number has recovered to normal state from below the lower warning threshold (LowerThreshold=[INT32]). |
|
Variable fields |
$1: Lower online IPoE session count alarm threshold. |
|
Severity level |
5 |
|
Example |
IPOE/5/IPOE_SESSIONS_LOWER_RECOVER:The IPoE session number has recovered to normal state from below the lower warning threshold (LowerThreshold=20). |
|
Explanation |
The online IPoE session count recovers from below the lower threshold to the normal range. |
|
Recommended action |
No action is required. |
IPOE_SESSIONS_LOWER_RECOVER (vBRAS-CPs)
|
Message text |
The IPoE session number on slot [INT32] has recovered to normal state from below the lower warning threshold (LowerThreshold=[INT32]). |
|
Variable fields |
$1: Slot number of the master BRAS-VM. $2: Lower online IPoE session count alarm threshold. |
|
Severity level |
5 |
|
Example |
IPOE/5/IPOE_SESSIONS_LOWER_RECOVER:The IPoE session number on slot 97 has recovered to normal state from below the lower warning threshold (LowerThreshold=20). |
|
Explanation |
The online IPoE session count recovers from below the lower threshold to the normal range. |
|
Recommended action |
No action is required. |
IPOE_SESSIONS_UPPER_THRESHOLD (non-vBRAS-CPs)
|
Message text |
The IPoE session number is above the upper warning threshold (UpperThreshold=[INT32]). |
|
Variable fields |
$1: Upper online IPoE session count alarm threshold. |
|
Severity level |
4 |
|
Example |
IPOE/4/IPOE_SESSIONS_UPPER_THRESHOLD:The IPoE session number is above the upper warning threshold (UpperThreshold=20). |
|
Explanation |
The online IPoE session count is above the upper threshold. |
|
Recommended action |
Identify whether a large number of illegal IPoE users come online. |
IPOE_SESSIONS_UPPER_THRESHOLD (vBRAS-CPs)
|
Message text |
The IPoE session number on slot [INT32] is above the upper warning threshold (UpperThreshold=[INT32]). |
|
Variable fields |
$1: Slot number of the master BRAS-VM. $2: Upper online IPoE session count alarm threshold. |
|
Severity level |
4 |
|
Example |
IPOE/4/IPOE_SESSIONS_UPPER_THRESHOLD:The IPoE session number on slot 97 is above the upper warning threshold (UpperThreshold=20). |
|
Explanation |
The online IPoE session count is above the upper threshold. |
|
Recommended action |
Identify whether a large number of illegal IPoE users come online. |
IPOE_SESSIONS_UPPER_RECOVER (non-vBRAS-CPs)
|
Message text |
The IPoE session number has recovered to normal state from above the upper warning threshold (UpperThreshold=[INT32]). |
|
Variable fields |
$1: Upper online IPoE session count alarm threshold. |
|
Severity level |
5 |
|
Example |
IPOE/5/IPOE_SESSIONS_UPPER_RECOVER: The IPoE session number has recovered to normal state from above the upper warning threshold (UpperThreshold=20). |
|
Explanation |
The online IPoE session count recovers from above the upper threshold to the normal range. |
|
Recommended action |
No action is required. |
IPOE_SESSIONS_UPPER_RECOVER (vBRAS-CPs)
|
Message text |
The IPoE session number on slot [INT32] has recovered to normal state from above the upper warning threshold (UpperThreshold=[INT32]). |
|
Variable fields |
$1: Slot number of the master BRAS-VM. $2: Upper online IPoE session count alarm threshold. |
|
Severity level |
5 |
|
Example |
IPOE/5/IPOE_SESSIONS_UPPER_RECOVER: The IPoE session number on slot 97 has recovered to normal state from above the upper warning threshold (UpperThreshold =20). |
|
Explanation |
The online IPoE session count recovers from above the upper threshold to the normal range. |
|
Recommended action |
No action is required. |
IPOE_SESSION_CONFLICT
|
Message text |
Forced the user (IPAddr=[STRING], MACAddr=[STRING]) on [STRING] to go offline because the same user came online on [STRING] |
|
Variable fields |
$1: IP address. $2: MAC address. $3: Interface name. $4: Interface name. |
|
Severity level |
6 |
|
Example |
IPOE/6/ IPOE_SESSION_CONFLICT: Forced the user (IPAddr=1.1.1.2, MACAddr=1-2-3) on Route-Aggregation1023 to go offline because the same user came online on Route-Aggregation1024. |
|
Explanation |
When a user comes online through an interface, the device will force the user with the same IP address and MAC address as the online user to go offline. |
|
Recommended action |
No action is required. |
IPOE_UNCLASSIFIED_IP_DEFENSE
|
Message text |
An unclassified-IP attack was detected, and the attacked IP was [IPADDR] |
|
Variable fields |
$1: Source IP address of an attack packet. |
|
Severity level |
4 |
|
Example |
IPOE/4/IPOE_UNCLASSIFIED_IP_DEFENSE: An unclassified-IP attack was detected, and the attacked IP was 1.1.1.102. |
|
Explanation |
An attack log message is output when the unclassified-IP packet attacks meet blocking conditions. |
|
Recommended action |
1. Execute the display ip subscriber unclassified-ip-defense command to view the defense entries of unclassified-IP packets. 2. According to the situation, determine whether to continue to block the blocked source IP address or to execute the reset ip subscriber unclassified-ip-defense command to unblock the blocked source IP address in advance. |
IPSEC messages
This section contains IPsec messages.
IPSEC_FAILED_ADD_FLOW_TABLE
|
Message text |
Failed to add flow-table due to [STRING]. |
|
Variable fields |
$1: Reason for the failure. |
|
Severity level |
4 |
|
Example |
IPSEC/4/IPSEC_FAILED_ADD_FLOW_TABLE: Failed to add flow-table due to no enough resource. |
|
Explanation |
Failed to add the flow table. Possible reasons include not enough hardware resources. |
|
Recommended action |
If the failure is caused by not enough hardware resources, contact H3C Support. |
IPSEC_PACKET_DISCARDED
|
Message text |
IPsec packet discarded, Src IP:[STRING], Dst IP:[STRING], SPI:[UINT32], SN:[UINT32], Cause:[STRING]. |
|
Variable fields |
$1: Source IP address. $2: Destination IP address. $3: Security parameter index (SPI). $4: Sequence number of the packet. $5: Reason for dropping this packet: · Anti-replay checking failed. · AH authentication failed. · ESP authentication failed. · Invalid SA. · ESP decryption failed. · Source address of packet does not match the SA. · No ACL rule matched. |
|
Severity level |
6 |
|
Example |
IPSEC/6/IPSEC_PACKET_DISCARDED: IPsec packet discarded, Src IP:1.1.1.2, Dest IP:1.1.1.4, SPI:1002, SN:0, Cause:ah authentication failed |
|
Explanation |
An IPsec packet is dropped. Possible reasons include anti-replay checking failed, AH/ESP authentication failed, invalid SA, ESP decryption failed, source address of packet does not match the SA, and no ACL rule matched. |
|
Recommended action |
No action is required. |
IPSEC_SA_ESTABLISH
|
Message text |
Established IPsec SA. The SA's source address is [STRING], destination address is [STRING], protocol is [STRING], and SPI is [UINT32]. |
|
Variable fields |
$1: Source address. $2: Destination address. $3: Security protocol. $4: SPI. |
|
Severity level |
6 |
|
Example |
IPSEC/6/IPSEC_SA_ESTABLISH: Established IPsec SA. The SA's source address is 1.1.1.1, destination address is 2.2.2.2, protocol is AH, and SPI is 2435. |
|
Explanation |
An IPsec SA is established. |
|
Recommended action |
No action is required. |
IPSEC_SA_ESTABLISH_FAIL
|
Message text |
Failed to establish IPsec SA for the reason of [STRING]. The SA's source address is [STRING], and its destination address is [STRING]. |
|
Variable fields |
$1: Reason for the IPsec SA establishment failure: · Tunnel establishment failure. · Incomplete configuration. · Unavailable transform set. · Getting SP: IPsec is smoothing. · Getting SP: IPsec is not running. · Getting SP: Failed to find SP by index and sequence number. · Getting SP: Creating SA timed out. · Getting SP by interface: Target node not online. · Getting SP by mGRE: Failed to get interface. · Getting SP: Failed to get SP by mGRE because interface type was invalid. · Getting SP: Failed to get SP by mGRE because profile %s was not found. · Getting SP: Failed to get SP by mGRE because of wrong profile type. · Getting SP by mGRE: Failed to find profile SP by profile %s. · Getting SP: Failed to get SP by mGRE. · Getting SP: Failed to get SP by SVTI because of invalid interface type. · Getting SP: Failed to get SP by SVTI because of no tunnel protection configuration. · Getting SP: Failed to get SP by SVTI because profile %s was not found. · Getting SP: Failed to get SP by SVTI because of wrong type of profile %s. · Getting SP by SVTI: Failed to find profile SP by profile %s. · Getting SP: Failed to get SP by SVTI because SP type was not ISAKMP. · Getting SP: Failed to match SVTI flow because IKE profile was not match. · Getting SP: Failed to match SVTI flow because flow was not match with ACL. · Getting SP by L3 interface: Failed to get interface data. · Getting SP: Failed to get SP by L3 interface because no SP entry was found by key. · Getting SP: Failed to get SP by L3 interface because no source interface SP entry was found by key. · Getting SP: Rejected peer's request of any flow when SP's mode was isakmp template and no ACL was specified. · Getting SP by L3 interface: Failed to match SP because policy cannot be found by SP. · Getting SP: Failed to match flow because renegotiation SP's index or Seqnum changed. · Getting SP by L3 interface: Failed to match SP because of no transform-set in SP. · Getting SP by L3 interface: Failed to create larval SA. · Getting SP: Failed to get SP matching ACL. $2: Source address. $3: Destination address. |
|
Severity level |
6 |
|
Example |
IPSEC/6/IPSEC_SA_ESTABLISH_FAIL: Failed to establish IPsec SA for the reason of creating tunnel failure. The SA’s source address is 1.1.1.1, and its destination address is 2.2.2.2. |
|
Explanation |
Failed to establish the IPsec SA. Possible reasons include creating tunnel failure, incomplete configuration, and unavailable transform set. |
|
Recommended action |
Verify the IPsec configurations on the local and remote devices. |
IPSEC_SA_INITINATION
|
Message text |
Began to establish IPsec SA. The SA's source address is [STRING], and its destination address is [STRING]. |
|
Variable fields |
$1: Source address. $2: Destination address. |
|
Severity level |
6 |
|
Example |
IPSEC/6/IPSEC_SA_INITINATION: Began to establish IPsec SA. The SA's source address is 1.1.1.1, and its destination address is 2.2.2.2. |
|
Explanation |
An IPsec SA is to be established. |
|
Recommended action |
No action is required. |
IPSEC_SA_TERMINATE
|
Message text |
The IPsec SA was deleted for the reason of [STRING]. The SA's source address is [STRING], destination address is [STRING], protocol is [STRING], and SPI is [UINT32]. |
|
Variable fields |
$1: Reason for the IPsec SA removal: · SA idle timeout. · reset command executed. $2: Source address. $3: Destination address. $4: Security protocol. $5: SPI. |
|
Severity level |
6 |
|
Example |
IPSEC/6/IPSEC_SA_TERMINATE: The IPsec SA was deleted for the reason of SA idle timeout. The SA’s source address is 1.1.1.1, destination address is 2.2.2.2, protocol is ESP, and SPI is 34563. |
|
Explanation |
An IPsec SA is deleted. Possible reasons include SA idle timeout and using the reset command. |
|
Recommended action |
No action is required. |
IPSG messages
This section contains IPSG messages.
IPSG_ADDENTRY_ERROR
|
Message text |
Failed to add an IP source guard binding (IP [STRING], MAC [STRING], and VLAN [STRING]) on interface [STRING]. [STRING]. |
|
Variable fields |
$1: IP address. If you do not specify an IP address, this field displays N/A. $2: MAC address. If you do not specify a MAC address, this field displays N/A. $3: VLAN ID. If you do not specify a VLAN, this field displays N/A. $4: Interface name. If you do not specify an interface, this field displays N/A. $5: Failure reason. Available options include: ¡ Feature not supported ¡ Not enough resources ¡ Unknown error |
|
Severity level |
6 |
|
Example |
IPSG/6/IPSG_ADDENTRY_ERROR: Failed to add an IP source guard binding (IP 1.1.1.1, MAC 0001-0001-0001, and VLAN 1) on interface Vlan-interface1. Not enough resources. |
|
Explanation |
IPSG failed to issue a static or dynamic IPSG binding. The message is sent in any of the following situations: · The IPSG feature is not supported. · The hardware resources are not sufficient for the operation. · An unknown error occurs. |
|
Recommended action |
To resolve the problem, you can perform the following tasks: · Clear the memory to release hardware resources when the failure is caused by insufficient hardware resources. · Add the IPSG binding again if you are adding a static binding. · Contact H3C Support if the failure is caused by an unknown error. |
IPSG_DELENTRY_ERROR
|
Message text |
Failed to delete an IP source guard binding (IP [STRING], MAC [STRING], and VLAN [STRING]) on interface [STRING]. [STRING]. |
|
Variable fields |
$1: IP address. If you do not specify an IP address, this field displays N/A. $2: MAC address. If you do not specify a MAC address, this field displays N/A. $3: VLAN ID. If you do not specify a VLAN, this field displays N/A. $4: Interface name. If you do not specify an interface, this field displays N/A. $5: Failure reason. Available options include: ¡ Feature not supported ¡ Unknown error |
|
Severity level |
6 |
|
Example |
IPSG/6/IPSG_DELENTRY_ERROR: Failed to delete an IP source guard binding (IP 1.1.1.1, MAC 0001-0001-0001, and VLAN 1) on interface Vlan-interface1. Unknown error. |
|
Explanation |
IPSG failed to delete a global static IPSG binding. The message is sent in any of the following situations: · The IPSG feature is not supported. · An unknown error occurs. |
|
Recommended action |
To resolve the problem, you can perform the following tasks: · Delete the global static IPSG binding again. · Contact H3C Support if the failure is caused by an unknown error. |
IRDP messages
This section contains IRDP messages.
IRDP_EXCEED_ADVADDR_LIMIT
|
Message text |
The number of advertisement addresses on interface [STRING] exceeded the limit 255. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
6 |
|
Example |
IRDP/6/IRDP_EXCEED_ADVADDR_LIMIT: The number of advertisement addresses on interface GigabitEthernet1/0/1 exceeded the limit 255. |
|
Explanation |
The number of addresses to be advertised on an interface exceeds the upper limit. |
|
Recommended action |
Remove unused addresses on the interface. |
IRF
This section contains IRF messages.
IRF_DISCOVER_FAIL
|
Message text |
The [STRING] channel with link ID [UINT32] detected having failed in the link discovery phase: interface=[STRING], latest local Tx request seq=[UINT32], latest local Rx reply seq=[UINT32]. |
|
Variable fields |
$1: Channel type: ¡ control&data—Hybrid channel. ¡ control—Control channel. ¡ data—Data channel. $2: Link ID. $3: Interface name. $4: Sequence number of the most recently sent detection request packet. $5: Sequence number of the most recently received detection reply packet. |
|
Severity level |
4 |
|
Example |
IRF/4/IRF_DISCOVER_FAIL: The control channel with link ID 1 detected having failed in the link discovery phase: interface=GigabitEthernet1/2/0, latest local Tx request seq=100, latest local Rx reply seq=94. |
|
Explanation |
In the link discovery phase, the system determined that an IRF link has failed when the detection timer expired because it had not received detection reply packets from the remote end. |
|
Recommended action |
Check the physical IRF link for connectivity issues. |
IRF_DISCOVER_FAIL_PERSIST
|
Message text |
[UINT32] consecutive link detection failures occurred on the [STRING] channel with link ID [UINT32] in the link discovery phase: interface=[STRING], latest local Tx request seq=[UINT32], latest local Rx reply seq=[UINT32]. |
|
Variable fields |
$1: Number of consecutive link detection failures. $2: Channel type: ¡ control&data—Hybrid channel. ¡ control—Control channel. ¡ data—Data channel. $3: Link ID. $4: Interface name. $5: Sequence number of the most recently sent detection request packet. $6: Sequence number of the most recently received detection reply packet. |
|
Severity level |
4 |
|
Example |
IRF/4/IRF_DISCOVER_FAIL_PERSIST: 3 consecutive link detection failures occurred on the data channel with link ID 1 in the link discovery phase: interface=GigabitEthernet1/2/0, latest local Tx request seq=120, latest local Rx reply seq=94. |
|
Explanation |
In the link discovery phase, consecutive link detection failures occurred. The IRF link might have failed. |
|
Recommended action |
Check the physical IRF link for connectivity issues. |
IRF_DISCOVER_SUCCESS
|
Message text |
The [STRING] channel with link ID [UINT32] detected up in the link discovery phase: interface=[STRING], latest local Tx request seq=[UINT32], latest local Rx reply seq=[UINT32]. |
|
Variable fields |
$1: Channel type: ¡ control&data—Hybrid channel. ¡ control—Control channel. ¡ data—Data channel. $2: Link ID. $3: Interface name. $4: Sequence number of the most recent sent detection request packet. $5: Sequence number of the most recent received detection reply packet. |
|
Severity level |
6 |
|
Example |
IRF/6/IRF_DISCOVER_SUCCESS: The control channel with link ID 2 detected up in the link discovery phase: interface=GigabitEthernet1/2/0, latest local Tx request seq=120, latest local Rx reply seq=120. |
|
Explanation |
In the link discovery phase, the system determined that an IRF link has been up when it received detection reply packets from the remote end. |
|
Recommended action |
No action is required. |
IRF_KEEPALIVE_FAIL
|
Message text |
The [STRING] channel with link ID [UINT32] detected having failed in the link keepalive phase: interface=[STRING], latest local Tx request seq=[UINT32], latest local Rx reply seq=[UINT32]. |
|
Variable fields |
$1: Channel type: ¡ control&data—Hybrid channel. ¡ control—Control channel. ¡ data—Data channel. $2: Link ID. $3: Interface name. $4: Sequence number of the most recently sent detection request packet. $5: Sequence number of the most recently received detection reply packet. |
|
Severity level |
4 |
|
Example |
IRF/4/IRF_KEEPALIVE_FAIL: The control channel with link ID 1 detected having failed in the link keepalive phase: interface=GigabitEthernet1/2/0, latest local Tx request seq=100, latest local Rx reply seq=94. |
|
Explanation |
In the link keepalive phase, the system determined that an IRF link has failed when the detection timer expired because it had not received detection reply packets from the remote end. |
|
Recommended action |
Check the physical IRF link for connectivity issues. |
IRF_KEEPALIVE_SUCCESS
|
Message text |
The [STRING] channel with link ID [UINT32] detected up in the link keepalive phase: interface=[STRING], latest local Tx request seq=[UINT32], latest local Rx reply seq=[UINT32]. |
|
Variable fields |
$1: Channel type: ¡ control&data—Hybrid channel. ¡ control—Control channel. ¡ data—Data channel. $2: Link ID. $3: Interface name. $4: Sequence number of the most recently sent detection request packet. $5: Sequence number of the most recently received detection reply packet. |
|
Severity level |
6 |
|
Example |
IRF/6/IRF_KEEPALIVE_SUCCESS: The control channel with link ID 2 detected up in the link keepalive phase: interface=GigabitEthernet1/2/0, latest local Tx request seq=120, latest local Rx reply seq=120. |
|
Explanation |
In the link keepalive phase, the system determined that an IRF link has been up when it received detection reply packets from the remote end. |
|
Recommended action |
No action is required. |
IRF_LINK_BLOCK
|
Message text |
IRF port went blocked. |
|
Variable fields |
N/A |
|
Severity level |
2 |
|
Example |
IRF/2/IRF_LINK_BLOCK: IRF port went blocked. |
|
Explanation |
The IRF port was blocked. A blocked IRF port cannot send or receive service packets, but it can send and receive IRF protocol packets. For example, this message might occur on the lower-priority member device when an IRF member ID conflict occurs between the member devices. |
|
Recommended action |
Check the IRF member ID on each member device for a conflict, and change their IRF member IDs to be unique. |
IRF_LINK_DOWN
|
Message text |
IRF port went down. |
|
Variable fields |
N/A |
|
Severity level |
3 |
|
Example |
IRF/3/IRF_LINK_DOWN: IRF port went down. |
|
Explanation |
The IRF port went down. |
|
Recommended action |
Verify the following items: · Network interfaces have been bound to the IRF port. · The IRF network interfaces and the peer interfaces have Layer 2 connectivity. |
IRF_LINK_SWITCH
|
Message text |
The [STRING] channel switched to link [UINT32]: interface=[STRING], latest local Tx request seq=[UINT32], latest local Rx reply seq=[UINT32]. |
|
Variable fields |
$1: Channel type: ¡ control&data—Hybrid channel. ¡ control—Control channel. ¡ data—Data channel. $2: Link ID. $3: Interface name. $4: Sequence number of the most recently sent detection request packet. $5: Sequence number of the most recently received detection reply packet. |
|
Severity level |
4 |
|
Example |
IRF/4/IRF_LINK_SWITCH: The control channel switched to link 2: interface=GigabitEthernet1/2/0, latest local Tx request seq=120, latest local Rx reply seq=120. |
|
Explanation |
The control or data channel switched from one link to another to forward traffic. Link failover is available only if IRF link backup has been configured. When this event occurs, the state of the failed link changes from Selected to Unselected. To identify the selected state of an IRF link, execute the display driver irf command in any view and examine the FSM state field. |
|
Recommended action |
No action is required. |
IRF_LINK_UP
|
Message text |
IRF port came up. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
IRF/6/IRF_LINK_UP: IRF port came up. |
|
Explanation |
The IRF port came up. |
|
Recommended action |
No action is required. |
IRF_MEMBERID_CONFLICT
|
Message text |
IRF member ID conflict occurred. The ID [UINT32] has been used for another device with CPU-Mac: [STRING]. |
|
Variable fields |
$1: IRF member ID of the device. $2: CPU MAC address of the device. |
|
Severity level |
4 |
|
Example |
IRF/4/IRF_MEMBERID_CONFLICT:-slot = 5; IRF member ID conflict occurred, The ID 5 has been used for another device with CPU-Mac: 000c-29d7-c1ae. |
|
Explanation |
This message occurs when the device detects that it has the same IRF member ID as another device in the same broadcast domain. |
|
Recommended action |
Change the IRF member ID on either device. |
IRF_MERGE
|
Message text |
IRF merge occurred. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
IRF/4/IRF_MERGE: IRF merge occurred. |
|
Explanation |
IRF merge occurred. |
|
Recommended action |
No action is required. |
IRF_MERGE_NEED_REBOOT
|
Message text |
IRF merge occurred. This IRF system needs a reboot. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
IRF/4/IRF_MERGE_NEED_REBOOT: IRF merge occurred. This IRF system needs a reboot. |
|
Explanation |
IRF merge occurred. A reboot is required to complete the IRF merge because the master of this IRF fabric failed the master election for IRF merge. |
|
Recommended action |
Reboot the IRF fabric to complete the IRF merge. |
IRF_MERGE_NOT_NEED_REBOOT
|
Message text |
IRF merge occurred. This IRF system does not need to reboot. |
|
Variable fields |
N/A |
|
Severity level |
5 |
|
Example |
IRF/5/IRF_MERGE_NOT_NEED_REBOOT: IRF merge occurred. This IRF system does not need to reboot. |
|
Explanation |
IRF merge occurred. You do not need to reboot this IRF fabric because the master of this IRF fabric won the master election for IRF merge. |
|
Recommended action |
No action is required. |
IRF_RECEIVE_THIRD_PACKET
|
Message text |
The [STRING] channel with link ID [UINT32] received a [STRING] packet from a third device: interface=[STRING], seq=[UINT32]. |
|
Variable fields |
$1: Channel type: ¡ control&data—Hybrid channel. ¡ control—Control channel. ¡ data—Data channel. $2: Link ID. $3: Detection packet type: ¡ Discover_Request. ¡ Discover_Reply. ¡ LinkSelect_Request. ¡ LinkSelect_Reply. ¡ Keepalive_Request. ¡ Keepalive_Reply. $4: Interface name. $5: Sequence number of the packet. |
|
Severity level |
4 |
|
Example |
IRF/4/IRF_RECEIVE_THIRD_PACKET: The control channel with link ID 2 received a Discover_Request packet from a third device: interface=GigabitEthernet1/2/0, seq=120. |
|
Explanation |
An IRF link received a detection packet from a third device. |
|
Recommended action |
An IRF fabric in star topology can contain a maximum of two member devices. If detection packets from a third device are received, check the network connection. |
IRF_SELECT_FAIL
|
Message text |
The [STRING] channel with link ID [UINT32] detected having failed in the link selection phase: interface=[STRING], latest local Tx request seq=[UINT32], latest local Rx reply seq=[UINT32]. |
|
Variable fields |
$1: Channel type: ¡ control&data—Hybrid channel. ¡ control—Control channel. ¡ data—Data channel. $2: Link ID. $3: Interface name. $4: Sequence number of the most recently sent detection request packet. $5: Sequence number of the most recently received detection reply packet. |
|
Severity level |
4 |
|
Example |
IRF/4/IRF_SELECT_FAIL: The control channel with link ID 1 detected having failed in the link selection phase: interface=GigabitEthernet1/2/0, latest local Tx request seq=100, latest local Rx reply seq=94. |
|
Explanation |
In the link selection phase, the system determined that an IRF link has failed when the detection timer expired because it had not received detection reply packets from the remote end. |
|
Recommended action |
Check the physical IRF link for connectivity issues. |
IRF_SELECT_SUCCESS
|
Message text |
The [STRING] channel with link ID [UINT32] detected up and set to the [STRING] state in the link selection phase: interface=[STRING], latest local Tx request seq=[UINT32], latest local Rx reply seq=[UINT32]. |
|
Variable fields |
$1: Channel type: ¡ control&data—Hybrid channel. ¡ control—Control channel. ¡ data—Data channel. $2: Link ID. $3: Link state: ¡ selected—The link is selected to forward traffic. ¡ unselected—The link is a backup of the selected link. $4: Interface name. $5: Sequence number of the most recently sent detection request packet. $6: Sequence number of the most recently received detection reply packet. |
|
Severity level |
6 |
|
Example |
IRF/6/IRF_SELECT_SUCCESS: The control channel with link ID 2 detected up and set to the selected state in the link selection phase: interface=GigabitEthernet1/2/0, latest local Tx request seq=120, latest local Rx reply seq=120. |
|
Explanation |
On receipt of a detection reply packet from the remote end of an IRF channel, the system determined that the channel has been up and set its link state to Selected or Unselected. |
|
Recommended action |
No action is required. |
ISIS messages
This section contains IS-IS messages.
ISIS_ADJSID_CONFLICT
|
Message text |
IS-IS [UINT16] failed to allocate adjacent SID [UINT32] to interface [STRING] because of SID conflict. |
|
Variable fields |
$1: IS-IS process ID. $2: Adjacency SID. $3: Interface name. |
|
Severity level |
4 |
|
Example |
ISIS/4/ISIS_ADJSID_CONFLICT: IS-IS 1 failed to allocate adjacent SID 15010 on interface Route-Aggregation1 because of SID conflict. |
|
Explanation |
Adjacency SID conflicts occurred. |
|
Recommended action |
Execute the display mpls label command to verify that the adjacency SID is available. |
ISIS_AUTH_FAILURE
|
Message text |
ISIS [UINT16] dropped a [STRING] PDU on interface [STRING] due to authentication setting inconsistency. (isisPDULen=[UINT16], isisPDUFragment=[STRING]) |
|
Variable fields |
$1: IS-IS process ID. $2: IS level. Available values include Level-1, Level-2, and Level-1-2. $3: Interface name. $4: PDU length. $5: First 32 bytes of the PDU header in hexadecimal notation. |
|
Severity level |
4 |
|
Example |
ISIS/4/ISIS_AUTH_FAILURE: ISIS 1 dropped a Level-1 PDU on interface GE1/0/1 due to authentication setting inconsistency. (isisPDULen=179, isisPDUFragment=00 b3 02 e0 00 00 00 00 00 11 00 00 00 00 00 64 f2 2b 03 01 02 01 00 81 02 cc 8e e8 20 00 11 00) |
|
The authentication type of the local interface or process is the same as that of the remote one, but they use different authentication algorithms, passwords, or key IDs. |
|
|
Recommended action |
To resolve this issue, perform the following task: 1. Check the isisPDUFragment (hexadecimal notation) field in the device log to find the system ID that sent the PDU. 2. Use the system ID obtained above to locate the remote device that sent the PDU. 3. Make sure the remote device and the local device use the same authentication algorithm and password. |
ISIS_AUTH_TYPE_FAILURE
|
Message text |
ISIS [UINT16] dropped a [STRING] PDU on interface [STRING] due to authentication type inconsistency. (isisPDULen=[UINT16], isisPDUFragment=[STRING]) |
|
Variable fields |
$1: IS-IS process ID. $2: Interface name. $3: IS level. Available values include Level-1, Level-2, and Level-1-2. $4: PDU length. $5: First 32 bytes of the PDU header in hexadecimal notation. |
|
Severity level |
4 |
|
Example |
ISIS/4/ISIS_AUTH_FAILURE: ISIS 1 dropped a Level-1 PDU on interface GE1/0/1 due to authentication type inconsistency. (isisPDULen=179, isisPDUFragment=00 b3 02 e0 00 00 00 00 00 11 00 00 00 00 00 64 f2 2b 03 01 02 01 00 81 02 cc 8e e8 20 00 11 00) |
|
Explanation |
The local device generates this log message when one of the following conditions exists: · The authentication type of the local interface or process is different from that of the remote one. · The local interface or process has authentication configuration, but the remote one does not. |
|
Recommended action |
To resolve this issue, perform the following task: 1. Check the isisPDUFragment (hexadecimal notation) field in the device log to find the system ID that sent the PDU. 2. Use the system ID obtained above to locate the remote device that sent the PDU. 3. Make sure the authentication type of the local device is the same as that of the remote one. |
ISIS_BFRPREFIX_CONFLICT
|
Message text |
IS-IS [UINT16], [STRING] BFR-prefix [STRING] might be assigned to multiple devices: system IDs=[STRING]. |
|
Variable fields |
$1: IS-IS process ID. $2: IS type, which can be Level-1 or Level-2. $3: BIER forwarding router prefix. $4: System IDs on which the conflict occurs. |
|
Severity level |
4 |
|
Example |
ISIS/4/ISIS_BFRPREFIX_CONFLICT: -MDC=1; IS-IS 1, Level-1 BFR-prefix 3333::3 might be assigned to multiple devices: system IDs=0000.0000.0003, 0000.0000.0004. |
|
Explanation |
A BIER forwarding router prefix was assigned to multiple devices. |
|
Recommended action |
Verify that the devices are not assigned with the same BIER forwarding router prefix. |
ISIS_ID_LEN_MISMATCH
|
Message text |
ISIS [UINT16] dropped a [STRING] PDU on interface [STRING] due to system ID length inconsistency. (isisPDULen=[UINT16], isisPDUIDLen=[UINT16], isisPDUFragment=[STRING]) |
|
Variable fields |
$1: IS-IS process ID. $2: IS level. Available values include Level-1, Level-2, and Level-1-2. $3: Interface name. $4: PDU length. $5: ID length in the PDU. $6: First 32 bytes of the PDU header in hexadecimal notation. |
|
Severity level |
4 |
|
Example |
ISIS/4/ISIS_ID_LEN_MISMATCH: ISIS 1 dropped a Level-1 PDU on interface GE1/0/1 due to system ID length inconsistency. (isisPDULen=179, isisPDUIDLen=10, isisPDUFragment=00 b3 02 e0 00 00 00 00 00 11 00 00 00 00 00 64 f2 2b 03 01 02 01 00 81 02 cc 8e e8 20 00 11 00) |
|
Explanation |
The system ID length in the header of the received PDU (of any type) was different from the system ID length of the local device. |
|
Recommended action |
To resolve this issue, perform the following task: 1. Check the isisPDUFragment (hexadecimal notation) field in the device log to find the system ID that sent the PDU. 2. Use the system ID obtained above to locate the remote device that sent the PDU. 3. Make sure the system ID length of the remote device is six. |
ISIS_LOCAL_SYS_IS_DIS
|
Message text |
ISIS [UINT16] interface [STRING] became the temporary DIS when receiving a hello packet with RR bit set. |
|
Variable fields |
$1: IS-IS process ID. $2: Interface name. |
|
Severity level |
6 |
|
Example |
ISIS/6/ISIS_LOCAL_SYS_IS_DIS: ISIS 1 interface GE1/0/1 became the temporary DIS when receiving a hello packet with RR bit set. |
|
Explanation |
The broadcast interface became the temporary DIS after receiving a hello packet with the RR bit of Restart TLV set. |
|
Recommended action |
No action is required. |
ISIS_LSDB_OVERLOAD
|
Message text |
The overload state of IS-IS [UINT16] [STRING] LSDB changed to [STRING]. |
|
Variable fields |
$1: IS-IS process ID. $2: IS type. Available values include Level-1, Level-2, and Level-1-2. $3: Overload state. Available values include Normal and Overloaded. |
|
Severity level |
4 |
|
Example |
ISIS/4/ISIS_LSDB_OVERLOAD: The overload state of IS-IS 1 Level-1 LSDB changed to Normal. |
|
Explanation |
The overload state of IS-IS LSDB changed to Normal or Overloaded. |
|
Recommended action |
Check whether the set-overload or undo set-overload command is configured on the device. |
ISIS_LSP_CONFLICT
|
Message text |
IS-IS [UINT16], [STRING] LSP, LSPID=[STRING], SeqNum=[HEX], system ID conflict might exist. |
|
Variable fields |
$1: IS-IS process ID. $2: IS type: Level-1 or Level-2. $3: LSP ID. $4: LSP sequence number. |
|
Severity level |
4 |
|
Example |
ISIS/4/ISIS_LSP_CONFLICT: -MDC=1; IS-IS 1, Level-1 LSP, LSPID=1111.1111.1111.00-00, SeqNum=0x000045bf, system ID conflict might exist. |
|
Explanation |
System ID conflict might exist. |
|
Recommended action |
Determine whether the system ID of the device that generates the LSP conflicts with the system ID of another device. |
ISIS_LSP_TOO_LARGE_TO_PROPAGATE
|
Message text |
ISIS [UINT16] attempted to propagate a [STRING] LSP larger than MTU [UINT16] on interface [STRING]. (isisPDULSPSize=[UINT16], isisPDULSPID=[STRING]) |
|
Variable fields |
$1: IS-IS process ID. $2: IS level. Available values include Level-1, Level-2, and Level-1-2. $3: Interface MTU. $4: Interface name. $5: LSP length. $6: LSP ID. |
|
Severity level |
4 |
|
Example |
ISIS/4/ISIS_LSP_TOO_LARGE_TO_PROPAGATE: ISIS 1 attempted to propagate a Level-1 LSP larger than MTU 1500 on interface GE1/0/1. (isisPDULSPSize=1600, isisPDULSPID=0000.0000.0011.00-00) |
|
Explanation |
The length of the LSP that IS-IS attempted to propagate was larger than the interface MTU. |
|
Recommended action |
Check the MTU of each interface and the size of LSPs, and then make sure the MTU of each interface is larger than the size of LSPs. |
ISIS_MANUAL_ADDRESS_DROPS
|
Message text |
ISIS [UINT16] discarded some area addresses because the number of area addresses exceeded three. (isisManAreaAddr=[STRING]) |
|
Variable fields |
$1: IS-IS process ID. $2: Discarded area addresses. |
|
Severity level |
4 |
|
Example |
ISIS/4/ISIS_MANUAL_ADDRESS_DROPS: ISIS 1 discarded some area addresses because the number of area addresses exceeded three. (isisManAreaAddr=51) |
|
Explanation |
When IS-IS leaks Level 1 area addresses into Level 2 area on the Level 1-2 device, the number of Level 2 area addresses might exceed three. In this situation, IS-IS selects the top three lowest addresses as the area addresses of Level 2 area. As a result, some of the Level 2 area addresses might be discarded on the local device. |
|
Recommended action |
Check the area address quantity of each Level 1 area attached to the Level 1-2 device and make sure the area address quantity does not exceed three. |
ISIS_MEM_ALERT
|
Message text |
ISIS Process received system memory alert [STRING] event. |
|
Variable fields |
$1: Type of the memory alarm. |
|
Severity level |
5 |
|
Example |
ISIS/5/ISIS_MEM_ALERT: ISIS Process received system memory alert start event. |
|
Explanation |
IS-IS received a memory alarm. |
|
Recommended action |
Check the system memory and release memory for the modules that occupy too many memory resources. |
ISIS_NBR_CHG
|
Message text |
IS-IS [UINT16], [STRING] adjacency [STRING] ([STRING]), state changed to [STRING], Reason: [STRING]. |
|
Variable fields |
$1: IS-IS process ID. $2: Neighbor level. $3: Neighbor ID. $4: Interface name. $5: Neighbor state. This field might display DOWN, UP, or INIT. $6: Neighbor state change reason. Possible reasons are as follows: · circuit data clean—The neighbor state changed to DOWN because routing information was cleared. · holdtime expired—The neighbor state changed to DOWN because no hello packets were received within the hold time. · BFD session down—The neighbor state changed to DOWN because BFD detected a link failure. · peer reset—The neighbor state changed to DOWN because the reset isis peer command was executed. · circuit ID conflicts—The neighbor state changed to DOWN because a hello packet with incorrect circuit ID was received from the neighbor. · P2P peer GR down—The neighbor state changed to DOWN because a P2P hello packet with no GR option was received during GR. · 2way-pass—The neighbor state changed to UP because the neighbor relationship was established. · 2way-fail—The neighbor state changed to INIT because a one-way hello packet was received from the neighbor. |
|
Severity level |
3 |
|
Example |
ISIS/3/ISIS_NBR_CHG: IS-IS 1, Level-1 adjacency 0000.0000.0001 (GigabitEthernet1/0/1), state changed to DOWN, Reason: circuit data clean. |
|
Explanation |
The neighbor state changed. |
|
Recommended action |
When the neighbor state changes to DOWN or INIT, check the reason and take recommended actions. · circuit data clean—Check the interface state, IS-IS configuration, and network connectivity. · holdtime expired—Verify whether a hello packet has been received from the neighbor within the hold time. · BFD session down—Check the connectivity to the neighbor. · peer reset—Check whether the reset isis peer command has been executed. · circuit ID conflicts—Check whether the IS-IS interface settings have been edited multiples times on the neighbor. · P2P peer GR down—Check whether the neighbor supports GR. · 2way-fail—Check the following: ¡ Check whether the reset isis peer command has been executed. ¡ Verify whether a hello packet has been received from the neighbor within the hold time. ¡ Check whether the authentication settings are the same on the device and the neighbor. |
ISIS_PEER_HOLD_MAX_COST_ENTER
|
Message text |
ISIS [UINT] peers on interface [STRING] entered hold-max-cost state. |
|
$1: IS-IS process ID. $2: Interface name. |
|
|
Severity level |
6 |
|
Example |
ISIS/6/ISIS_PEER_HOLD_MAX_COST_ENTER: ISIS 1 peers on interface GE1/0/1 entered hold-max-cost state. |
|
The IS-IS interface entered the hold-max-cost state. |
|
|
Recommended action |
No action is required. |
ISIS_PEER_HOLD_MAX_COST_EXIT
|
Message text |
ISIS [UINT16] attempted to propagate a [STRING] LSP larger than MTU [UINT16] on interface [STRING]. (isisPDULSPSize=[UINT16], isisPDULSPID=[STRING]) |
|
Variable fields |
$1: IS-IS process ID. $2: Interface name. |
|
Severity level |
6 |
|
Example |
ISIS/6/ISIS_PEER_HOLD_MAX_COST_EXIT: ISIS 1 peers on interface GE1/0/1 exited hold-max-cost state. |
|
Explanation |
The IS-IS interface exited from the hold-max-cost state. |
|
Recommended action |
No action is required. |
ISIS_PREFIX_SID_OVER_RANGE
|
Message text |
ISIS [UINT16] received prefix SID [UINT32]. The prefix SID is not included in the local SRGB range. (Prefix=[STRING], AdvertiseSource=[STRING], localSRGB=[UINT32]-[UINT32]) |
|
Variable fields |
$1: IS-IS process ID. $2: Prefix SID. $3: Prefix address and mask. $4: Source of prefix SID advertisement. $5: Minimum value in the local SRGB. $6: Maximum value in the local SRGB. |
|
Severity level |
4 |
|
Example |
ISIS/4/ISIS_PREFIX_SID_OVER_RANGE: ISIS 1 received prefix SID 16020. The prefix SID is not included in the local SRGB range. (Prefix=10.1.1.0/24, AdvertiseSource=0000.0000.0002.00, localSRGB=16000-16010) |
|
Explanation |
The prefix SID received by IS-IS is not included in the local SRGB. |
|
Recommended action |
Modify the prefix SID settings of remote devices to ensure that the remote prefix SIDs are included in the local SRGB. |
ISIS_PREFIXSID_CONFLICT
|
Message text |
IS-IS failed to allocate prefix SID [UINT32] for IP address [STRING] because of SID conflict. |
|
Variable fields |
$1: Prefix SID. $2: IP address and subnet mask. |
|
Severity level |
4 |
|
Example |
ISIS/4/ISIS_PREFIXSID_CONFLICT: IS-IS failed to allocate prefix SID 18020 for IP address 103.0.0.1/32 because of SID conflict. |
|
Explanation |
A prefix SID conflict occurred. |
|
Recommended action |
Execute the display mpls label command to verify that the prefix SID is available. |
ISIS_REJECTED_ADJACENCY
|
Message text |
IS-IS [UINT16] failed to establish [STRING] adjacency with its peer on interface [STRING]. (isisPDULen=[UINT16], isisPDUFragment=[STRING]) |
|
Variable fields |
$1: IS-IS process ID. $2: IS level. Available values include Level-1, Level-2, and Level-1-2. $3: Interface name. $4: PDU length. $5: First 32 bytes of the PDU header in hexadecimal notation. |
|
Severity level |
4 |
|
Example |
ISIS/4/ISIS_REJECTED_ADJACENCY: IS-IS 1 failed to establish Level-1 adjacency with its peer on interface GE1/0/1. (isisPDULen=179, isisPDUFragment=00 b3 02 e0 00 00 00 00 00 11 00 00 00 00 00 64 f2 2b 03 01 02 01 00 81 02 cc 8e e8 20 00 11 00) |
|
Explanation |
IS-IS cannot establish adjacency with a neighbor after receiving a hello packet from the neighbor. |
|
Recommended action |
Check whether the local device and the neighbor are configured correctly. If yes, contact H3C Support. |
KHTTP messages
This section contains KHTTP messages.
KHTTP_BIND_PORT_ALLOCETED
|
Message text |
Failed to bind TCP connection [STRING]/[UINT32] to VPN instance [UINT32] because the port was already allocated. |
|
Variable fields |
$1: IP address. $2: TCP port number. $3: VPN instance index. |
|
Severity level |
3 |
|
Example |
KHTTP/3/KHTTP_BIND_PORT_ALLOCETED: Failed to bind TCP connection 192.168.30.117/10000 to VPN instance 0 because the port was already allocated. |
|
Explanation |
This message is generated when the binding of an IP address, TCP port, and VPN instance failed because the TCP port was already allocated. |
|
Recommended action |
Use an available TCP port for the binding. To view the available TCP ports, execute the display tcp-proxy port-info or display ipv6 tcp-proxy port-info command. |
KHTTP_BIND_ADDRESS_INUSED
|
Message text |
Failed to bind TCP connection [STRING]/[UINT32] to VPN instance [UINT32] because the address was already used. |
|
Variable fields |
$1: IP address. $2: TCP port number. $3: VPN instance index. |
|
Severity level |
3 |
|
Example |
KHTTP/3/KHTTP_BIND_ADDRESS_INUSED: Failed to bind TCP connection 192.168.30.117/10000 to VPN instance 0 because the address was already used. |
|
Explanation |
This message is generated when the binding of an IP address, TCP port, and VPN instance failed because the IP address was already used and was not allowed to be used by multiple systems. |
|
Recommended action |
Use an available IP address for the binding. To view the available IP addresses, execute the display tcp-proxy command. |
L2MC messages
This section contains Layer 2 multicast messages.
HW_NORES
|
Message text |
No enough resource! |
|
Variable fields |
None. |
|
Severity level |
3 (Error) |
|
Example |
L2MC/3/HW_NORES: -MDC=1-Slot=4; No enough resource! |
|
Impact |
The current operation cannot be performed due to resource insufficiency. |
|
Cause |
Hardware resources are insufficient to complete an operation, for example, adding an output interface for a multicast entry. |
|
Recommended action |
1. Use the display hardware internal l2mc slot global command to view resource usage on the card in probe view. 2. Contact Technical Support. |
L2MC_CFD_NOTSPT
|
Message text |
Interface [STRING] does not support CFD. Please check your configuration. |
|
Variable fields |
$1: Interface number. |
|
Severity level |
6 (Informational) |
|
Example |
L2MC/6/L2MC_CFD_NOTSPT: -MDC=1-Slot=3; Interface GigabitEthernet3/1/1.1 does not support CFD. Please check your configuration. |
|
Impact |
None. |
|
Cause |
The interface does not support CFD. |
|
Recommended action |
Do not configure CFD on the interface. |
L2TPv2 messages
This section contains L2TPv2 messages.
L2TPV2_ADJUST_CFG_DELIVER_FAILED (non-vBRAS-CPs)
|
Message text |
Centralized devices: Failed to deliver the L2TP link adjustment configuration to driver. Distributed devices in standalone mode: Centralized IRF devices: Failed to deliver the L2TP link adjustment configuration to driver on slot [UINT32]. Distributed devices in IRF mode: Failed to deliver the L2TP link adjustment configuration to driver on chassis [UINT32] slot [UINT32]. |
|
Variable fields |
$1: Chassis number. (Distributed devices in IRF mode.) $2: Slot number. (Distributed devices in standalone mode.)(Centralized IRF devices.)(Distributed devices in IRF mode.) |
|
Severity level |
4 |
|
Example |
Centralized devices: L2TPV2/4/L2TPV2_ADJUST_CFG_DELIVER_FAILED: Failed to deliver the L2TP link adjustment configuration to driver. Distributed devices in standalone mode: Centralized IRF devices: L2TPV2/4/L2TPV2_ADJUST_CFG_DELIVER_FAILED: Failed to deliver the L2TP link adjustment configuration to driver on slot 1. Distributed devices in IRF mode: L2TPV2/4/L2TPV2_ADJUST_CFG_DELIVER_FAILED: Failed to deliver the L2TP link adjustment configuration to driver on chassis 1 slot 1. |
|
Explanation |
This message is generated when the l2tp lns-link-adjustment command fails to be issued for reasons such as insufficient driver hardware resources. |
|
Recommended action |
Contact H3C Support. |
L2TPV2_LOSS_RATIO_EXCEED_THRESHOLD (UPs)
|
Message text |
Centralized devices: The keepalive packet loss ratio is [UINT32]%, and exceeds [UINT32]%. Distributed devices in standalone mode: Centralized IRF devices: The keepalive packet loss ratio on slot [UINT32] is [UINT32]%, and exceeds [UINT32]%. Distributed devices in IRF mode: The keepalive packet loss ratio on chassis [UINT32] slot [UINT32] is [UINT32]%, and exceeds [UINT32]%. |
|
Variable fields |
$1: Chassis number. (Distributed devices in IRF mode.) $2: Slot number. (Distributed devices in standalone mode.)(Centralized IRF devices.)(Distributed devices in IRF mode.) $3: Packet loss ratio of detection packets. $4: Packet loss ratio alarm threshold for detection packets. |
|
Severity level |
4 |
|
Example |
Centralized devices: L2TPv2/4/L2TPV2_LOSS_RATIO_EXCEED_THRESHOLD: The keepalive packet loss ratio is 50%, and exceeds 30%. Distributed devices in standalone mode: Centralized IRF devices: L2TPv2/4/L2TPV2_LOSS_RATIO_EXCEED_THRESHOLD: The keepalive packet loss ratio on slot 1 is 50%, and exceeds 30%. Distributed devices in IRF mode: L2TPv2/4/L2TPV2_LOSS_RATIO_EXCEED_THRESHOLD: The keepalive packet loss ratio on chassis 1 slot 1 is 50%, and exceeds 30%. |
|
Explanation |
The packet loss ratio for L2TP user detection packets exceeded the packet loss ratio alarm threshold. |
|
Recommended action |
1. Verify that the device interface cable connections and network configuration are normal. 2. Collect log messages, and contact H3C Support. |
L2TPV2_LOSS_RATIO_RECOVER_NORMAL (UPs)
|
Message text |
Centralized devices: The keepalive packet loss ratio has recovered to normal state. Distributed devices in standalone mode: Centralized IRF devices: The keepalive packet loss ratio on slot [UINT32] has recovered to normal state. Distributed devices in IRF mode: The keepalive packet loss ratio on chassis [UINT32] slot [UINT32] has recovered to normal state. |
|
Variable fields |
$1: Chassis number. (Distributed devices in IRF mode.) $2: Slot number. (Distributed devices in standalone mode.)(Centralized IRF devices.)(Distributed devices in IRF mode.) |
|
Severity level |
4 |
|
Example |
Centralized devices: L2TPv2/4/L2TPV2_LOSS_RATIO_RECOVER_NORMAL: The keepalive packet loss ratio has recovered to normal state. Distributed devices in standalone mode: Centralized IRF devices: L2TPv2/4/L2TPV2_LOSS_RATIO_RECOVER_NORMAL: The keepalive packet loss ratio on slot 1 has recovered to normal state. Distributed devices in IRF mode: L2TPv2/4/L2TPV2_LOSS_RATIO_RECOVER_NORMAL: The keepalive packet loss ratio on chassis 1 slot 1 has recovered to normal state. |
|
Explanation |
The packet loss ratio for L2TP user detection packets restored to the normal range. |
|
Recommended action |
No action is required. |
L2TPV2_LOSS_RATIO_EXCEED_THRESHOLD (non-vBRAS-CPs)
|
Message text |
Centralized devices: The keepalive packet loss ratio on the interface [STRING] is [UINT32]%, and exceeds [UINT32]%. Distributed devices in standalone mode: Centralized IRF devices: The keepalive packet loss ratio on the interface [STRING] on slot [UINT32] is [UINT32]%, and exceeds [UINT32]%. Distributed devices in IRF mode: The keepalive packet loss ratio on the interface [STRING] on chassis [UINT32] slot [UINT32] is [UINT32]%, and exceeds [UINT32]%. |
|
Variable fields |
$1: Interface name. $2: Chassis number. (Distributed devices in IRF mode.) $3: Slot number. (Distributed devices in standalone mode.)(Centralized IRF devices.)(Distributed devices in IRF mode.) $4: Packet loss ratio of detection packets. $5: Packet loss ratio alarm threshold for detection packets. |
|
Severity level |
4 |
|
Example |
Centralized devices: L2TPv2/4/L2TPV2_LOSS_RATIO_EXCEED_THRESHOLD: The keepalive packet loss ratio on the interface BAS-interface1 is 50%, and exceeds 30%. Distributed devices in standalone mode: Centralized IRF devices: L2TPv2/4/L2TPV2_LOSS_RATIO_EXCEED_THRESHOLD: The keepalive packet loss ratio on the interface BAS-interface1 on slot 1 is 50%, and exceeds 30%. Distributed devices in IRF mode: L2TPv2/4/L2TPV2_LOSS_RATIO_EXCEED_THRESHOLD: The keepalive packet loss ratio on the interface BAS-interface1 on chassis 1 slot 1 is 50%, and exceeds 30%. |
|
Explanation |
The packet loss ratio for L2TP user detection packets exceeded the packet loss ratio alarm threshold on an interface. |
|
Recommended action |
1. Verify that the device interface cable connections and network configuration are normal. 2. Collect log messages, and contact H3C Support. |
L2TPV2_LOSS_RATIO_RECOVER_NORMAL (non-vBRAS-CPs)
|
Message text |
Centralized devices: The keepalive packet loss ratio on the interface [STRING] has recovered to normal state. Distributed devices in standalone mode: Centralized IRF devices: The keepalive packet loss ratio on the interface [STRING] on slot [UINT32] has recovered to normal state. Distributed devices in IRF mode: The keepalive packet loss ratio on the interface [STRING] on chassis [UINT32] slot [UINT32] has recovered to normal state. |
|
Variable fields |
$1: Interface name. $2: Chassis number. (Distributed devices in IRF mode.) $3: Slot number. (Distributed devices in standalone mode.)(Centralized IRF devices.)(Distributed devices in IRF mode.) |
|
Severity level |
4 |
|
Example |
Centralized devices: L2TPv2/4/L2TPV2_LOSS_RATIO_RECOVER_NORMAL: The keepalive packet loss ratio on the interface BAS-interface1 has recovered to normal state. Distributed devices in standalone mode: Centralized IRF devices: L2TPv2/4/L2TPV2_LOSS_RATIO_RECOVER_NORMAL: The keepalive packet loss ratio on the interface BAS-interface1 on slot 1 has recovered to normal state. Distributed devices in IRF mode: L2TPv2/4/L2TPV2_LOSS_RATIO_RECOVER_NORMAL: The keepalive packet loss ratio on the interface BAS-interface1 on chassis 1 slot 1 has recovered to normal state. |
|
Explanation |
The packet loss ratio for L2TP user detection packets restored to the normal range on an interface. |
|
Recommended action |
No action is required. |
L2TPV2_SESSION_EXCEED_LIMIT
|
Message text |
|
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
L2TPV2/4/L2TPV2_SESSION_EXCEED_LIMIT: Number of L2TP sessions exceeded the limit. |
|
Explanation |
The number of established L2TP sessions has reached the limit. |
|
Recommended action |
No action is required. |
L2TPV2_SESSIONS_LOWER_THRESHOLD (non-vBRAS-CPs)
|
Message text |
The L2TP session number is below the lower warning threshold (LowerThreshold=[INT32]). |
|
Variable fields |
$1: Lower online L2TP session count alarm threshold. |
|
Severity level |
4 |
|
Example |
L2TPV2/4/L2TPV2_SESSIONS_LOWER_THRESHOLD: The L2TP session number is below the lower warning threshold (LowerThreshold=20). |
|
Explanation |
The online L2TP session count is below the lower threshold. |
|
Recommended action |
1. Execute the display l2tp session statistic command to display the L2TP session statistics. 2. Identify whether a large number of L2TP users go offline abnormally. |
L2TPV2_SESSIONS_LOWER_THRESHOLD (vBRAS-CPs)
|
Message text |
The L2TP session number on slot [INT32] is below the lower warning threshold (LowerThreshold=[INT32]). |
|
Variable fields |
$1: Slot number of the master BRAS-VM. $2: Lower online L2TP session count alarm threshold. |
|
Severity level |
4 |
|
Example |
L2TPV2/4/L2TPV2_SESSIONS_LOWER_THRESHOLD: The L2TP session number on slot 97 is below the lower warning threshold (LowerThreshold=20). |
|
Explanation |
The online L2TP session count is below the lower threshold. |
|
Recommended action |
1. Execute the display l2tp session statistic command to display the L2TP session statistics. 2. Identify whether a large number of L2TP users go offline abnormally. |
L2TPV2_SESSIONS_LOWER_RECOVER (non-vBRAS-CPs)
|
Message text |
The L2TP session number has recovered to normal state from below the lower warning threshold (LowerThreshold=[INT32]). |
|
Variable fields |
$1: Lower online L2TP session count alarm threshold. |
|
Severity level |
5 |
|
Example |
L2TPV2/5/L2TPV2_SESSIONS_LOWER_RECOVER: The L2TP session number has recovered to normal state from below the lower warning threshold (LowerThreshold=20). |
|
Explanation |
The online L2TP session count recovers from below the lower threshold to the normal range. |
|
Recommended action |
No action is required. |
L2TPV2_SESSIONS_LOWER_RECOVER (vBRAS-CPs)
|
Message text |
The L2TP session number on slot [INT32] has recovered to normal state from below the lower warning threshold (LowerThreshold=[INT32]). |
|
Variable fields |
$1: Slot number of the master BRAS-VM. $2: Lower online L2TP session count alarm threshold. |
|
Severity level |
5 |
|
Example |
L2TPV2/5/L2TPV2_SESSIONS_LOWER_RECOVER: The L2TP session number on slot 97 has recovered to normal state from below the lower warning threshold (LowerThreshold=20). |
|
Explanation |
The online L2TP session count recovers from below the lower threshold to the normal range. |
|
Recommended action |
No action is required. |
L2TPV2_SESSIONS_UPPER_THRESHOLD (non-vBRAS-CPs)
|
Message text |
The L2TP session number is above the upper warning threshold (UpperThreshold=[INT32]). |
|
Variable fields |
$1: Upper online L2TP session count alarm threshold. |
|
Severity level |
4 |
|
Example |
L2TPV2/4/L2TPV2_SESSIONS_UPPER_THRESHOLD: The L2TP session number is above the upper warning threshold (UpperThreshold=80). |
|
Explanation |
The online L2TP session count is above the upper threshold. |
|
Recommended action |
1. Execute the display l2tp session statistic command to display the L2TP session statistics. 2. Identify whether a large number of illegal L2TP users come online. |
L2TPV2_SESSIONS_UPPER_THRESHOLD (vBRAS-CPs)
|
Message text |
The L2TP session number on slot [INT32] is above the upper warning threshold (UpperThreshold=[INT32]). |
|
Variable fields |
$1: Slot number of the master BRAS-VM. $2: Upper online L2TP session count alarm threshold. |
|
Severity level |
4 |
|
Example |
L2TPV2/4/L2TPV2_SESSIONS_UPPER_THRESHOLD: The L2TP session number on slot 97 is above the upper warning threshold (UpperThreshold=80). |
|
Explanation |
The online L2TP session count is above the upper threshold. |
|
Recommended action |
1. Execute the display l2tp session statistic command to display the L2TP session statistics. 2. Identify whether a large number of illegal L2TP users come online. |
L2TPV2_SESSIONS_UPPER_RECOVER (non-vBRAS-CPs)
|
Message text |
The L2TP session number has recovered to normal state from above the upper warning threshold (UpperThreshold=[INT32]). |
|
Variable fields |
$1: Upper online L2TP session count alarm threshold. |
|
Severity level |
5 |
|
Example |
L2TPV2/5/L2TP_SESSIONS_UPPER_RECOVER: The L2TP session number has recovered to normal state from above the upper warning threshold (UpperThreshold=20). |
|
Explanation |
The online L2TP session count recovers from above the upper threshold to the normal range. |
|
Recommended action |
No action is required. |
L2TPV2_SESSIONS_UPPER_RECOVER (vBRAS-CPs)
|
Message text |
The L2TP session number on slot [INT32] has recovered to normal state from above the upper warning threshold (UpperThreshold=[INT32]). |
|
Variable fields |
$1: Slot number of the master BRAS-VM. $2: Upper online L2TP session count alarm threshold. |
|
Severity level |
5 |
|
Example |
L2TPV2/5/L2TP_SESSIONS_UPPER_RECOVER: The L2TP session number on slot 97 has recovered to normal state from above the upper warning threshold (UpperThreshold =20). |
|
Explanation |
The online L2TP session count recovers from above the upper threshold to the normal range. |
|
Recommended action |
No action is required. |
L2TPV2_TUNNEL_ADD_DRIVER_FAILED
|
Message text |
Failed to add an L2TP tunnel Ipaddr=[STRING], TunnelID=[UINT16]. Cause: Not enough hardware resources. |
|
Variable fields |
$1: Local IP address. $2: Local tunnel ID. |
|
Severity level |
4 |
|
Example |
L2TPV2/4/L2TPV2_TUNNEL_ADD_DRIVER_FAILED: Failed to add an L2TP tunnel Ipaddr=1.1.1.1, TunnelID =100. Cause: Not enough hardware resources. |
|
Explanation |
Failed to add an L2TP tunnel because of insufficient hardware resources. |
|
Recommended action |
Contact H3C Support. |
L2TPV2_TUNNEL_EXCEED_LIMIT
|
Message text |
Number of L2TP tunnels exceeded the limit. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
L2TPV2/4/L2TPV2_TUNNEL_EXCEED_LIMIT: Number of L2TP tunnels exceeded the limit. |
|
Explanation |
The number of established L2TP tunnels has reached the limit. |
|
Recommended action |
1. Perform one of the following tasks: ¡ Execute the reset l2tp tunnel command to disconnect an idle tunnel. ¡ Wait for the device to automatically disconnect an idle tunnel after the hello interval elapses. 2. If the problem persists, contact H3C Support. |
L2TPV2_TUNNEL_UP_OR_DOWN
|
Message text |
The status of L2TP tunnel changed (LocalTunnelID=[INT32], TunnelRemoteName=[STRING],PeerIPAddress=[IPADDR],TunnelStatus=[STRING],TunnelDownReason=[STRING], RemoteTunnelID=[INT32], SessionCount=[INT32]). |
|
Variable fields |
$1: Local tunnel ID. $2: Remote tunnel name. $3: Remote tunnel IP address. $4: Tunnel state: ¡ Established. ¡ stopping. $5: Tunnel disconnection reason. $6: Remote tunnel ID. $7: L2TP session count. |
|
Severity level |
5 |
|
Example |
L2TPV2/5/L2TPV2_TUNNEL_UP_OR_DOWN: The status of L2TP tunnel changed (LocalTunnelID= 1,TunnelRemoteName= lns, PeerIPAddress= 120.1.1.1, TunnelStatus= stopping, TunnelDownReason= lns clear tunnel, RemoteTunnelID= 1, SessionCount= 10). |
|
Explanation |
An L2TP tunnel was established or disconnected. |
|
Recommended action |
No action is required. |
L2VPN messages
This section contains L2VPN messages.
L2VPN_BGPVC_CONFLICT_LOCAL
|
Message text |
Remote site ID [INT32] (From [STRING], route distinguisher [STRING]) conflicts with local site. |
|
Variable fields |
$1: ID of a remote site. $2: IP address of the remote site. $3: Route distinguisher of the remote site. |
|
Severity level |
4 |
|
Example |
L2VPN/4/L2VPN_BGPVC_CONFLICT_LOCAL: Remote site ID 1 (From 1.1.1.1, route distinguisher 1:1) conflicts with local site. |
|
Explanation |
A remote site ID conflicted with the local site ID. This message is generated when one of the following situations occurs: · The received remote site ID is the same as the local site ID. · The local site ID is configured the same as a received remote site ID. |
|
Recommended action |
Modify the site ID configuration on the local device or remote device. Or, configure the remote site ID in a different VPLS instance than the local site ID. |
L2VPN_BGPVC_CONFLICT_REMOTE
|
Message text |
Remote site ID [INT32] (From [STRING], route distinguisher [STRING]) conflicts with another remote site. |
|
Variable fields |
$1: ID of a remote site. $2: IP address of the remote site. $3: Route distinguisher of the remote site. |
|
Severity level |
4 |
|
Example |
L2VPN/4/L2VPN_BGPVC_CONFLICT_REMOTE: Remote site ID 1 (From 1.1.1.1, route distinguisher 1:1) conflicts with another remote site. |
|
Explanation |
Two remote site IDs conflicted. This message is generated when the received remote site ID is the same as another received remote site ID. |
|
Recommended action |
Modify the site ID configuration on one remote device. Or, configure the two remote site IDs in different VPLS instances. |
L2VPN_HARD_RESOURCE_NOENOUGH
|
Message text |
No enough hardware resource for L2VPN. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
L2VPN/4/L2VPN_HARD_RESOURCE_NOENOUGH: No enough hardware resource for L2VPN. |
|
Explanation |
Hardware resources for L2VPN were insufficient. |
|
Recommended action |
Check whether unnecessary VSIs, PWs, or ACs had been generated. If yes, delete them. |
L2VPN_HARD_RESOURCE_RESTORE
|
Message text |
Hardware resources for L2VPN are restored. |
|
Variable fields |
N/A |
|
Severity level |
2 |
|
Example |
L2VPN/2/L2VPN_HARD_RESOURCE_RESTORE: Hardware resources for L2VPN are restored. |
|
Explanation |
Hardware resources for L2VPN were restored. |
|
Recommended action |
No action is required. |
L2VPN_LABEL_DUPLICATE
|
Message text |
Incoming label [INT32] for a static PW in [STRING] [STRING] is duplicate. |
|
Variable fields |
$1: Incoming label value. $2: Type of L2VPN, Xconnect-group or VSI. $3: Name of the Xconnect-group or VSI. |
|
Severity level |
4 |
|
Example |
L2VPN/4/L2VPN_LABEL_DUPLICATE: Incoming label 1024 for a static PW in Xconnect-group aaa is duplicate. |
|
Explanation |
The incoming label of a static PW in this Xconnect-group or VSI was occupied by another configuration, for example, by a static LSP or by a static CRLSP. This message is generated when one of the following events occurs: · When MPLS is enabled, configure a static PW with an incoming label which is occupied by another configuration. · Enable MPLS when a static PW whose incoming label is occupied by another configuration already exists. |
|
Recommended action |
Remove this static PW, and reconfigure it with another incoming label. |
L2VPN_MACLIMIT_FALL_AC
|
Message text |
The number of MAC address entries on the AC fell below the upper limit. (VSI name=[STRING], link ID=[UINT32], max-mac-entries=[UINT32], current-mac-entries=[UINT32]) |
|
Variable fields |
$1: Name of the VSI associated with the AC. $2: Link ID of the AC. $3: Maximum number of MAC addresses that the AC can learn. If this field displays unlimited, no limit is set. $4: Number of MAC addresses that the AC has learned. |
|
Severity level |
4 |
|
Example |
L2VPN/4/L2VPN_MACLIMIT_FALL_AC: -MDC=1-Slot=5; The number of MAC address entries on the AC fell below the upper limit. (VSI name=aaa, link ID=1, max-mac-entries=100, current-mac-entries=80) |
|
Explanation |
The number of MAC address entries on the AC fell below 90% of the maximum. |
|
Recommended action |
N/A |
L2VPN_MACLIMIT_FALL_PW
|
Message text |
The number of MAC address entries on the PW fell below the upper limit. (VSI name=[STRING], link ID=[UINT32], max-mac-entries=[UINT32], current-mac-entries=[UINT32]) |
|
Variable fields |
$1: Name of the VSI where the PW resides. $2: Link ID of the PW. $3: Maximum number of MAC addresses that the PW can learn. If this field displays unlimited, no limit is set. $4: Number of MAC addresses that the PW has learned. |
|
Severity level |
4 |
|
Example |
L2VPN/4/L2VPN_MACLIMIT_FALL_PW: -MDC=1-Slot=5; The number of MAC address entries on the PW fell below the upper limit. (VSI name=aaa, link ID=100, max-mac-entries=50, current-mac-entries=30) |
|
Explanation |
The number of MAC address entries on the PW fell below 90% of the maximum. |
|
Recommended action |
N/A |
L2VPN_MACLIMIT_FALL_VSI
|
Message text |
The number of MAC address entries on the VSI fell below the upper limit. (VSI name=[STRING], max-mac-entries=[UINT32], current-mac-entries=[UINT32]) |
|
Variable fields |
$1: Name of the VSI. $2: Maximum number of MAC addresses that the VSI can learn. If this field displays unlimited, no limit is set. $3: Number of MAC addresses that the VSI has learned. |
|
Severity level |
4 |
|
Example |
L2VPN/4/L2VPN_MACLIMIT_FALL_VSI: -MDC=1-Slot=5; The number of MAC address entries on the VSI fell below the upper limit. (VSI name=aaa, max-mac-entries=200, current-mac-entries=150) |
|
Explanation |
The number of MAC address entries in the VSI fell below 90% of the maximum. |
|
Recommended action |
N/A |
L2VPN_MACLIMIT_MAX_AC
|
Message text |
The number of MAC address entries on the AC reached the upper limit. (VSI name=[STRING], link ID=[UINT32], max-mac-entries=[UINT32]) |
|
Variable fields |
$1: Name of the VSI associated with the AC. $2: Link ID of the AC. $3: Maximum number of MAC addresses that the AC can learn. |
|
Severity level |
4 |
|
Example |
L2VPN/4/L2VPN_MACLIMIT_MAX_AC: -MDC=1-Slot=5; The number of MAC address entries on the AC reached the upper limit. (VSI name=aaa, link ID=1, max-mac-entries=100) |
|
Explanation |
The number of MAC addresses that the AC has learned reached the maximum. |
|
Recommended action |
N/A |
L2VPN_MACLIMIT_MAX_PW
|
Message text |
The number of MAC address entries on the PW reached the upper limit. (VSI name=[STRING], link ID=[UINT32], max-mac-entries=[UINT32]) |
|
Variable fields |
$1: Name of the VSI where the PW resides. $2: Link ID of the PW. $3: Maximum number of MAC addresses that the PW can learn. |
|
Severity level |
4 |
|
Example |
L2VPN/4/L2VPN_MACLIMIT_MAX_PW: -MDC=1-Slot=5; The number of MAC address entries on the PW reached the upper limit. (VSI name=aaa, link ID=100, max-mac-entries=50) |
|
Explanation |
The number of MAC addresses that the PW has learned reached the maximum. |
|
Recommended action |
N/A |
L2VPN_MACLIMIT_MAX_VSI
|
Message text |
The number of MAC address entries on the VSI reached the upper limit. (VSI name=[STRING], max-mac-entries=[UINT32]) |
|
Variable fields |
$1: Name of the VSI. $2: Maximum number of MAC addresses that the VSI can learn. |
|
Severity level |
4 |
|
Example |
L2VPN/4/L2VPN_MACLIMIT_MAX_VSI: -MDC=1-Slot=5; The number of MAC address entries on the VSI reached the upper limit. (VSI name=aaa, max-mac-entries=200) |
|
Explanation |
The number of MAC addresses that the VSI has learned reached the maximum. |
|
Recommended action |
N/A |
L3 messages
This section contains Layer 3 messages.
BIER_TNLDIP_NORES
|
Message text |
No enough bier tunnel dip index resource |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
L3/4/BIER_TNLDIP_NORES: -MDC=1-Slot=3; No enough bier tunnel dip index resource |
|
Impact |
BIER tunnels cannot be used. |
|
Cause |
BIER tunnel index resources are insufficient. |
|
Recommended action |
1. Check the environment and roll back unused configuration. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
STATIS_NORES
|
Message text |
Failed to enable packet drop statistics collection on interface [UINT32] because of insufficient resources. |
|
Variable fields |
$1: Interface index. |
|
Severity level |
4 (Warning) |
|
Example |
L3/4/STATIS_NORES: -MDC=1-Slot=3; Failed to enable packet drop statistics collection on interface 1153 because of insufficient resources. |
|
Impact |
The packet statistics collection feature is not available. |
|
Cause |
Once the SAVA function is enabled, the QACL module will allocate TB counter resources. If the TB counter resources are insufficient, a log entry is generated. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
IFINDEX_STATIS_NORES
|
Message text |
Operation failed on [string] because of insufficient resources. |
|
Variable fields |
$1: Interface index. |
|
Severity level |
2 (Critical) |
|
Example |
L3/2/IFINDEX_STATIS_NORES: -MDC=1-Slot=2; Operation failed on 9728 because of insufficient resources. |
|
Impact |
The Layer 3 packet statistics collection feature is not available for IPv4 or IPv6 packets on the interface. |
|
Cause |
The device failed to enable statistics collection for IPv4 and IPv6 packets on the interface because this interface does not have enough token bucket resources for incoming and outgoing packets. |
|
Recommended action |
Release token bucket resources on the interface. |
STATIS_CONF_CONFLICT
|
Message text |
The operation is not supported because configuration conflict on [string]. |
|
Variable fields |
$1: Interface name obtained based on the interface index. |
|
Severity level |
2 (Critical) |
|
Example |
L3/2/STATIS_CONF_CONFLICT: -MDC=1-Slot=2; The operation is not supported because configuration conflict on Ten-GigabitEthernet3/0/1.1. |
|
Impact |
The Layer 3 packet statistics collection feature is not available for IPv4 or IPv6 packets on the interface. |
|
Cause |
The device failed to enable statistics collection for IPv4 and IPv6 packets on an interface because a configuration conflict exists on the interface. |
|
Recommended action |
Check for the following configurations on the interface: · An L2VPN-leased user is configured on the interface. · The VLAN to which the interface belongs is enabled with packet statistics for Ethernet service instances of the VLAN. |
INFINDEX_STATIS_CONFLICT
|
Message text |
The operation is not supported because configuration conflict on [string]. |
|
Variable fields |
$1: Interface index. |
|
Severity level |
2 (Critical) |
|
Example |
L3/2/INFINDEX_STATIS_CONFLICT: -MDC=1-Slot=2; The operation is not supported because configuration conflict on 9728. |
|
Impact |
The Layer 3 packet statistics collection feature is not available for IPv4 or IPv6 packets on the interface. |
|
Cause |
The device failed to enable statistics collection for IPv4 and IPv6 packets on an interface because a configuration conflict exists on the interface. |
|
Recommended action |
Check for the following configurations on the interface : · An L2VPN-leased user is configured on the interface. · The VLAN to which the interface belongs is enabled with packet statistics for Ethernet service instances of the VLAN. |
ARPINDEX_NORES
|
Message text |
Not enough ARP index resource. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
L3/4/23.8 ARPINDEX_NORES: -MDC=1; Not enough ARP index resource. |
|
Impact |
ARP or ND entries cannot be learned. |
|
Cause |
ARP index resources are insufficient. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
NEXTHOP_NORES
|
Message text |
Not enough NextHop resource. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
L3/4/NEXTHOP_NORES: -MDC=1-Slot=5; Not enough NextHop resource. |
|
Impact |
ARP/ND entries and non-equal-cost routes cannot be learned, and traffic forwarding might fail. |
|
Cause |
Next hop resources are insufficient. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
V4PREFIX_NORES
|
Message text |
Not enough IPv4 prefix resource. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
L3/4/V4PREFIX_NORES: -MDC=1-Slot=3; Not enough IPv4 prefix resource. |
|
Impact |
IPv4 routes cannot be learned. |
|
Cause |
IPv4 prefix resources are insufficient. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
V6PREFIX_NORES
|
Message text |
Not enough IPv6 prefix resource. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
L3/4/V6PREFIX_NORES: -MDC=1-Slot=3; Not enough IPv6 prefix resource. |
|
Impact |
IPv6 routes cannot be learned. |
|
Cause |
IPv6 prefix resources are insufficient. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
ARP_ATTACK
|
Message text |
Arp Attack!!! |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
L3/4/ARP_ATTACK: -MDC=1-Slot=3; Arp Attack!!! |
|
Impact |
User services are affected. |
|
Cause |
An ARP attack was detected. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
ICMP_ATTACK
|
Message text |
ICMP/ICMPv6 fast-reply rate is greater than the speed limit! |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
L3/4/ICMP_ATTACK : -MDC=1-Slot=3; ICMP/ICMPv6 fast-reply rate is greater than the speed limit! |
|
Impact |
Device disconnection might occur or the device might receive incorrect packets. |
|
Cause |
This message is sent when a device running normally is under ICMP attack. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
IPV4_ACL_EXCEED
|
Message text |
The IPv4 ACL resource usage exceeds 80%. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
IPV4/4/IPV4_ACL_EXCEED: -MDC=1-Slot=3; The IPv4 ACL resource usage exceeds 80%. |
|
Impact |
DHCP flood attack prevention entries cannot be assigned. |
|
Cause |
The usage of IPv4 ACL resources exceeded 80%. In this case, the device cannot assign DHCP flood attack prevention entries. |
|
Recommended action |
1. Execute the display qos-acl resource command in system view to examine the ACL resource usage for the card, and then delete unused IPv4 ACL rules to release some IPv4 ACL resources. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
IPV6_ACL_EXCEED
|
Message text |
The IPv6 ACL resource usage exceeds 80%. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
IPV4/4/IPV6_ACL_EXCEED: -MDC=1-Slot=3; The IPv6 ACL resource usage exceeds 80%. |
|
Impact |
DHCPv6 flood attack prevention entries cannot be assigned. |
|
Cause |
The usage of IPv6 ACL resources exceeded 80%. In this case, the device cannot assign DHCPv6 flood attack prevention entries. |
|
Recommended action |
1. Execute the display qos-acl resource command in system view to examine the ACL resource usage for the card, and then delete unused IPv6 ACL rules to release some IPv6 ACL resources. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
IPV4_ACL_NORES
|
Message text |
Not enough IPv4 ACL resources. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
IPV4/4/IPV4_ACL_NORES: -MDC=1-Slot=3; Not enough IPv4 ACL resources. |
|
Impact |
IPv4 ACL rules cannot be configured. |
|
Cause |
· This message is sent when ACL hardware entries fail to be deployed due to insufficient IPv4 ACL resources. GTSM cannot work in this case. · After TCP SYN flood attack prevention is enabled, the system deploys ACL hardware entries when an attack occurs. This message is sent when ACL hardware entries fail to be deployed due to insufficient IPv4 ACL resources. TCP SYN flood attack prevention cannot work in this case. |
|
Recommended action |
Collect the following information and then contact Technical Support for help: · Output from the display qos-acl resource slot slot-number command. · Alarm information, log messages, and configuration data. |
IPV6_ACL_NORES
|
Message text |
Not enough IPv6 ACL resources. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
IPV4/4/IPV6_ACL_NORES: -MDC=1-Slot=3; Not enough IPv6 ACL resources. |
|
Impact |
IPv6 ACL rules cannot be configured. |
|
Cause |
· This message is sent when ACL hardware entries fail to be deployed due to insufficient IPv6 ACL resources. GTSM cannot work in this case. · After TCP SYN flood attack prevention is enabled, the system deploys ACL hardware entries when an attack occurs. This message is sent when ACL hardware entries fail to be deployed due to insufficient IPv6 ACL resources. TCP SYN flood attack prevention cannot work in this case. |
|
Recommended action |
Collect the following information and then contact Technical Support for help: · Output from the display qos-acl resource slot slot-number command. · Alarm information, log messages, and configuration data. |
MTU_NORES
|
Message text |
Insufficient system resources! |
|
Variable fields |
N/A |
|
Severity level |
3 (Error) |
|
Example |
IPV4/3/MTU_NORES: -MDC=1-Slot=3; Insufficient system resources! |
|
Impact |
The device might fragment packets. If the device does not support packet fragmentation, it will discard packets. |
|
Cause |
The number of link MTU entries for the same destination address has reached the upper limit. New link MTU entries cannot be added into the MTU index table. |
|
Recommended action |
1. Delete invalid IPv6 packet forwarding links. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
L3_P2C
|
Message text |
The operation is not supported. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
L3/4/L3_P2C: -MDC=1-Slot=3; The operation is not supported. |
|
Impact |
The ipv6 option source-route enable command fails to be executed. |
|
Cause |
The device does not support the ipv6 option source-route enable command. |
|
Recommended action |
Do not execute the ipv6 option source-route enable command on the device. |
STATIS_NORES
|
Message text |
Failed to enable packet drop statistics collection on interface [UINT32] because of insufficient resources. |
|
Variable fields |
$1: Interface index. |
|
Severity level |
4 (Warning) |
|
Example |
L3/4/STATIS_NORES: -MDC=1-Slot=3; Failed to enable packet drop statistics collection on interface 1153 because of insufficient resources. |
|
Impact |
The packet drop statistics collection function cannot be used. |
|
Cause |
After you enable SAVA, the system notifies the QACL module of assigning TB counter resources. This message is generated when the TB counter resources are insufficient. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
VRRPINDEX_NORES
|
Message text |
Pattern 1: [UINT32] failed to add a virtual MAC: Insufficient hardware resources. Pattern 2: The Interface(index: [UINT32]) failed to add a virtual MAC: Insufficient hardware resources. |
|
Variable fields |
Pattern 1: $1: Interface type and interface number. Pattern 2: $1: Interface index. |
|
Severity level |
4 (Warning) |
|
Example |
Pattern 1: L3/4/VRRPINDEX_NORES: -MDC=1-Slot=3; interface Route-Aggregation 1 failed to add a virtual MAC: Insufficient hardware resources. Pattern 2: L3/4/VRRPINDEX_NORES: -MDC=1-Slot=3; The Interface(index: 86) failed to add a virtual MAC: Insufficient hardware resources. |
|
Impact |
The VRRP function cannot be used. |
|
Cause |
VRRP MAC entry resources are insufficient. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
TECLASSINDEX_NORES
|
Message text |
Not enough te class mapping table resource. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
IPUC/4/TECLASSINDEX_NORES: -MDC=1-Slot=5; Not enough te class mapping table resource. |
|
Impact |
TE class-based traffic direction does not take effect. |
|
Cause |
The mapping table used for TE class ID-based traffic direction to SRv6 TE policy cannot be issued, because hardware BIER VPN table resources are insufficient. |
|
Recommended action |
Release hardware BIER VPN table resources. |
TECLASS_NORES
|
Message text |
Te-class not enough ecmp id resource. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
IPUC/4/TECLASS_NORES: -MDC=1-Slot=5; Te-class not enough ecmp id resource. |
|
Impact |
When traffic is directed to the default forwarding policy of an SRv6 TE policy, ECMP paths cannot be used for traffic forwarding though equal-cost output interfaces exist. |
|
Cause |
When traffic is directed to the default forwarding policy of an SRv6 TE policy, equal-cost next hop entries table cannot be issued because ECMP ID resources are insufficient. |
|
Recommended action |
Release ECMP ID resources. |
NETWORK_SLICE
|
Message text |
Not enough ACL resource. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
IPUC/4/NETWORK_SLICE: -MDC=1-Slot=5; Not enough ACL resource. |
|
Impact |
The service traffic of source address slicing fails to be transmitted. |
|
Cause |
ACL resources are insufficient. |
|
Recommended action |
Release ACL resources. |
VRRPMAC_NORES
|
Message text |
Pattern 1: [UINT32] failed to add a virtual MAC: Insufficient hardware resources. Pattern 2: The Interface(index: [UINT32]) failed to add a virtual MAC: Insufficient hardware resources. |
|
Variable fields |
Pattern 1: $1: Interface type and interface number. Pattern 2: $1: Interface index. |
|
Severity level |
4 (Warning) |
|
Example |
Pattern 1: L3/4/VRRPINDEX_NORES: -MDC=1-Slot=3; interface Route-Aggregation 1 failed to add a virtual MAC: Insufficient hardware resources. Pattern 2: L3/4/VRRPINDEX_NORES: -MDC=1-Slot=3; The Interface(index: 86) failed to add a virtual MAC: Insufficient hardware resources. |
|
Impact |
The VRRP feature cannot be correctly used. |
|
Cause |
VRRP MAC entry resources are insufficient. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
L3MC messages
This section contains Layer 3 multicast messages.
BRAS_HW_NORES
|
Message text |
No enough resource! |
|
Variable fields |
N/A |
|
Severity level |
3 (Error) |
|
Example |
L3MC/3/BRAS_HW_NORES: -MDC=1; Slot=4; No enough resource! |
|
Impact |
ACLs fail to be configured. |
|
Cause |
IGMP attack defense could not take effect on the IPoE user access interface because not enough ACL resources were available on the card. |
|
Recommended action |
Collect the following information and then contact Technical Support for help: · Output from the display qos-acl resource slot slot-number command. · Alarm information, log messages, and configuration data. |
IPV4_ACL_NORES
|
Message text |
Not enough ACL resource |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
L3MC/4/IPV4_ACL_NORES: -MDC=1-Slot=4; Not enough ACL resource |
|
Impact |
ACLs fail to be deployed, and IGMP attack defense fails to take effect. |
|
Cause |
With the interface-based IGMP suppression enabled, the device deploys ACLs when detecting IGMP attacks. This message is sent when the hardware resources are not enough to deploy ACLs. |
|
Recommended action |
Collect the following information and then contact Technical Support for help: · Output from the display qos-acl resource slot slot-number command. · Alarm information, log messages, and configuration data. |
IPV4_ACL_NORES
|
Message text |
No enough ACL resource, P1=[UINT32]. |
|
Variable fields |
$1: Interface index. |
|
Severity level |
3 (Error) |
|
Example |
L3MC/3/IPV4_ACL_NORES: -MDC=1-Slot=4; No enough ACL resource, p1=1153. |
|
Impact |
ACLs fail to be configured. |
|
Cause |
The number of ACLs configured reached the upper limit. |
|
Recommended action |
Collect the following information and then contact Technical Support for help: · Output from the display qos-acl resource slot slot-number command. · Alarm information, log messages, and configuration data. |
IPV4_HW_NORES
|
Message text |
No enough resource! |
|
Variable fields |
N/A |
|
Severity level |
3 (Error) |
|
Example |
L3MC/3/IPV4_HW_NORES: -MDC=1-Slot=4; No enough resource! |
|
Impact |
The related function fails to take effect. |
|
Cause |
The hardware resources are insufficient. |
|
Recommended action |
Collect the following information and then contact Technical Support for help: · Output from the display hardware internal l3mc slot slot-number global command. · Alarm information, log messages, and configuration data. |
IPV6_ACL_NORES
|
Message text |
This board no enough acl resource. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
IPV4/4/IPV6_ACL_NORES: -MDC=1-Slot=4; This board no enough acl resource. |
|
Impact |
ACLs fail to be configured. |
|
Cause |
The number of ACLs configured reached the upper limit. |
|
Recommended action |
Collect the following information and then contact Technical Support for help: · Output from the display qos-acl resource slot slot-number command. · Alarm information, log messages, and configuration data. |
IPV6_ACL_NORES
|
Message text |
Not enough IPv6 ACL resources |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
L3MC/4/IPV6_ACL_NORES: -MDC=1-Slot=4; Not enough IPv6 ACL resources |
|
Impact |
ACLs fail to be deployed, and MLD attack defense fails to take effect. |
|
Cause |
With the interface-based MLD suppression enabled, the device deploys ACLs when detecting MLD attacks. This message is sent when the hardware resources are not enough to deploy ACLs. |
|
Recommended action |
Collect the following information and then contact Technical Support for help: · Output from the display qos-acl resource slot slot-number command. · Alarm information, log messages, and configuration data. |
IPV6_HW_NORES
|
Message text |
No enough resource! |
|
Variable fields |
N/A |
|
Severity level |
3 (Error) |
|
Example |
L3MC/3/IPV6_HW_NORES: -MDC=1-Slot=4; No enough resource! |
|
Impact |
The related function fails to take effect. |
|
Cause |
The hardware resources are insufficient. |
|
Recommended action |
Collect the following information and then contact Technical Support for help: · Output from the display qos-acl resource slot slot-number command. · Alarm information, log messages, and configuration data. |
L3MC_IPV4_N
|
Message text |
Not enough resource. |
|
Variable fields |
None. |
|
Severity level |
4 (Warning) |
|
Example |
L3MC/4/ L3MC_IPV4_N: -MDC=1; Not enough resource. |
|
Impact |
ACLs fail to be configured. |
|
Cause |
The ACL resources are insufficient. |
|
Recommended action |
1. Release ACL resources. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
MVPN_MTUNNEL_NORES
|
Message text |
MtunnelCreate No enough resource! |
|
Variable fields |
N/A |
|
Severity level |
3 (Error) |
|
Example |
L3MC/3/MVPN_MTUNNEL_NORES: -MDC=1; MtunnelCreate No enough resource! |
|
Impact |
Multicast tunnel interfaces fail to be created. |
|
Cause |
The hardware resources used by the multicast VPN have reached the upper limit. |
|
Recommended action |
Collect the following information and then contact Technical Support for help: · Output from the display qos-acl resource slot slot-number command. · Alarm information, log messages, and configuration data. |
SRPM_NORES
|
Message text |
This module does not support SRPM. Please check your configuration. |
|
Variable fields |
N/A |
|
Severity level |
2 (Critical) |
|
Example |
L3MC/2/SRPM_NORES: -MDC=1; This module does not support SRPM. Please check your configuration. |
|
Impact |
Networking performance measurement errors occur. |
|
Cause |
This message is generated when a new member port is added to the Layer 3 aggregate group after you enable SRPM on a Layer 3 aggregate interface or a Layer 3 aggregate subinterface. |
|
Recommended action |
1. Disable SRPM on the Layer 3 aggregate interface or a Layer 3 aggregate subinterface and then add the new member port is added to the Layer 3 aggregate group, or add the new member port to a Layer 3 aggregate group that is not enabled with SRPM 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
L3VPN
This section contains L3VPN messages.
L3VPN_VRF_IFDOWN
|
Message text |
The interface bound to the VPN instance went down (VPN instance name=[STRING], Interface name=[STRING], Interface status=[STRING], VPN instance status=[STRING]). |
|
Variable fields |
$1: VPN instance name. $2: Interface name. $3: Interface status, active or inactive. $4: VPN instance status, up or down. |
|
Severity level |
6 |
|
Example |
L3VPN/6/L3VPN_VRF_IFDOWN_ACTIVE: The interface bound to the VPN instance went down (VPN instance name=vpn1, Interface name=GE1/0/1, Interface status=active, VPN instance status=down). |
|
Explanation |
The status of the last interface bound to the VPN instance changed from up to down. |
|
Recommended action |
· Check the status of the interfaces bound to the VPN instance. · Verify that the interfaces have an IPv4 address configured. |
L3VPN_VRF_IFDOWN_CLEAR
|
The interface bound to the VPN instance went up (VPN instance name=[STRING], Interface name=[STRING], Interface status=[STRING], VPN instance status=[STRING]). |
|
|
Variable fields |
$1: VPN instance name. $2: Interface name. $3: Interface status, active or inactive. $4: VPN instance status, up or down. |
|
Severity level |
6 |
|
Example |
L3VPN/6/L3VPN_VRF_IFDOWN_CLEAR: The interface bound to the VPN instance went up (VPN instance name=vpn1, Interface name=GE1/0/1, Interface status=active, VPN instance status=up). |
|
Explanation |
The status of the last interface bound to the VPN instance changed from down to up. |
|
Recommended action |
No action is required. |
L3VPN_VRF_IPV6_IFDOWN
|
Message text |
The IPv6 status of interface bound to a VPN instance went down (VPN instance name=[STRING], Interface name=[STRING]). |
|
Variable fields |
$1: VPN instance name. $2: Interface name. |
|
Severity level |
6 |
|
Example |
L3VPN/6/L3VPN_VRF_IPV6_IFDOWN_ACTIVE: The IPv6 status of interface bound to a VPN instance went down (VPN instance name=vpn1, Interface name=GE1/0/1). |
|
Explanation |
The status of the last IPv6 interface bound to the VPN instance changed from up to down. |
|
Recommended action |
· Check the status of the interfaces bound to the VPN instance. · Verify that the interfaces have an IPv6 address configured. |
L3VPN_VRF_IPV6_IFDOWN_CLEAR
|
Message text |
The IPv6 status of interface bound to a VPN instance went up (VPN instance name=[STRING], Interface name=[STRING]). |
|
Variable fields |
$1: VPN instance name. $2: Interface name. |
|
Severity level |
6 |
|
Example |
L3VPN/6/L3VPN_VRF_IPV6_IFDOWN_CLEAR: The IPv6 status of interface bound to a VPN instance went up (VPN instance name=vpn1, Interface name=GE1/0/1). |
|
Explanation |
The status of the last IPv6 interface bound to the VPN instance changed from down to up. |
|
Recommended action |
No action is required. |
LAGG messages
This section contains link aggregation messages.
LAGG_ACTIVE
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the active state. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_ACTIVE: Member port GE1/0/1 of aggregation group BAGG1 changed to the active state. |
|
Explanation |
A member port in an aggregation group changed to the Selected state. |
|
Recommended action |
No action is required. |
LAGG_INACTIVE_AICFG
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the port and the aggregate interface had different attribute configurations. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_AICFG: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the port and the aggregate interface had different attribute configurations. |
|
Explanation |
A member port in an aggregation group changed to the Unselected state because the member port and the aggregate interface had different attribute configurations. |
|
Recommended action |
Modify the attribute configurations of the member port to be consistent with the aggregate interface. |
LAGG_INACTIVE_BFD
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the BFD session state of the port was down. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_BFD: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the BFD session state of the port was down. |
|
Explanation |
A member port in an aggregation group changed to the Unselected state because the BFD session on the port went down. |
|
Recommended action |
To resolve this issue, you can perform the following tasks: · Verify that link failure has occurred and troubleshoot the failure. · Modify the port information and configuration for the port to have the same operational key and attribute configuration as the reference port. |
LAGG_INACTIVE_CONFIGURATION
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the link aggregation configuration of the port was incorrect. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_CONFIGURATION: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the link aggregation configuration of the port was incorrect. |
|
Explanation |
A member port in an aggregation group changed to the Unselected state because the member port and the aggregate interface had different aggregation configurations. |
|
Recommended action |
No action is required. |
LAGG_INACTIVE_DRNI_KEY_WRONG
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the operational key of the peer port was different than the other peer ports for the DR group to which this aggregate interface belongs. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_DRNI_KEY_WRONG: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the operational key of the peer port was different than the other peer ports for the DR group to which this aggregate interface belongs. |
|
Explanation |
A member port in an aggregation group changed to the Unselected state because the operational key of the peer port was different than the other peer ports for the DR group to which this aggregate interface belongs. |
|
Recommended action |
Modify the peer port configuration for all peer ports for a DR group to have the same operational key. |
LAGG_INACTIVE_DRNI_MAC_WRONG
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the system MAC address of the peer port was different than the other peer ports for the DR group to which this aggregate interface belongs. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_DRNI_MAC_WRONG: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the system MAC address of the peer port was different than the other peer ports for the DR group to which this aggregate interface belongs. |
|
Explanation |
A member port in an aggregation group changed to the Unselected state because the MAC address of the peer port was different than the other peer ports for the DR group to which this aggregate interface belongs. |
|
Recommended action |
Verify that the peer ports are in the same aggregation group on the peer device. |
LAGG_INACTIVE_DRNI_PRIORITY_WRONG
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the system priority of the peer port was different than the other peer ports for the DR group to which this aggregate interface belongs. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_DRNI_PRIORITY_WRONG: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the system priority of the peer port was different than the other peer ports for the DR group to which this aggregate interface belongs. |
|
Explanation |
A member port in an aggregation group changed to the Unselected state because the system priority of the peer port was different than the other peer ports for the DR group to which this aggregate interface belongs. |
|
Recommended action |
Verify that the peer ports are in the same aggregation group on the peer device. |
LAGG_INACTIVE_DRNI_SPEED_WRONG
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because its speed was different than the member ports of the peer DR interface. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_DRNI_SPEED_WRONG: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because its speed was different than the member ports of the peer DR interface. |
|
Explanation |
A member port in an aggregation group changed to the Unselected state because the speed of the peer port was different than the other peer ports for the DR group to which this aggregate interface belongs. |
|
Recommended action |
Modify the peer port configuration for all peer ports for a DR group to have the same speed. |
LAGG_INACTIVE_DUPLEX
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the duplex mode of the port was different from that of the reference port. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_DUPLEX: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the duplex mode of the port was different from that of the reference port. |
|
Explanation |
A member port in an aggregation group changed to the Unselected state because the duplex mode was different between the member port and the reference port. |
|
Recommended action |
Change the duplex mode of the member port to be the same as the reference port. |
LAGG_INACTIVE_HARDWAREVALUE
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because of the port's hardware restriction prevented it from being Selected. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_HARDWAREVALUE: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because of the port's hardware restriction prevented it from being Selected. |
|
Explanation |
A member port in an aggregation group changed to the Unselected state because of the port's hardware restriction. |
|
Recommended action |
No action is required. |
LAGG_INACTIVE_IFCFG_DEFAULT
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because no LACPDU was received by the reference port. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_IFCFG_DEFAULT: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because no LACPDU was received by the reference port. |
|
Explanation |
A member port in an aggregation group changed to the Unselected state because no LACPDU was received by the reference port. |
|
Recommended action |
Check whether the peer sends LACPDUs. |
LAGG_INACTIVE_IFCFG_LOOPPORT
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the reference port received its own LACPDUs. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_IFCFG_LOOPPORT: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the reference port received its own LACPDUs. |
|
Explanation |
A member port in an aggregation group changed to the Unselected state because the reference port received its own LACPDUs. |
|
Recommended action |
Check the peer device for loops. |
LAGG_INACTIVE_IFCFG_NONAGG
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the link of the port was not aggregatable. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_IFCFG_NONAGG: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the link of the port was not aggregatable. |
|
Explanation |
A member port in an aggregation group changed to the Unselected state because the link of the port was not aggregatable. |
|
Recommended action |
Modify the port configuration for the link to be aggregatable. |
LAGG_INACTIVE_IRFSELECTMODE
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the port does not meet the Selected port requirements of the IRF member device it belongs to. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_IRFSELECTMODE: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the port does not meet the Selected port requirements of the IRF member device it belongs to. |
|
Explanation |
A member port in an aggregation group changed to the Unselected state because the lacp irf-select command was executed. This command restricts the Selected ports in a dynamic multichassis link aggregation to one IRF member device. |
|
Recommended action |
No action is required. |
LAGG_INACTIVE_KEY_INVALID
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the port's operational key was invalid. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_KEY_INVALID: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the port's operational key was invalid. |
|
Explanation |
A member port in an aggregation group changed to the Unselected state because the port's operational key was invalid. |
|
Recommended action |
Modify the reference port configuration for the reference port to use a valid operational key. |
LAGG_INACTIVE_LACP_ISOLATE
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the link-aggregation lacp isolate setting had been configured. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_LACP_ISOLATE: Member port FGE1/0/50 of aggregation group BAGG1 changed to the inactive state, because the link-aggregation lacp isolate setting had been configured. |
|
Explanation |
A member port in an aggregation group changed to the Unselected state because aggregate interfaces were isolated on the device. |
|
Recommended action |
Remove aggregate interface isolation. |
LAGG_INACTIVE_LINKQUALITY_LOW
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the member port has low link quality. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_LINKQUALITY_LOW: Member port FGE1/0/50 of aggregation group BAGG1 changed to the inactive state, because the member port has low link quality. |
|
Explanation |
A member port in an aggregation group was set to the Unselected state because of low link quality. |
|
Recommended action |
To resolve this issue: · Verify that the cable is securely connected and is in a good condition. Replace the cable if its quality has degraded. · Check the interface module for hardware failure. |
LAGG_INACTIVE_LOWER_LIMIT
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the number of Selected ports was below the lower limit. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_LOWER_LIMIT: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the number of Selected ports was below the lower limit. |
|
Explanation |
A member port in an aggregation group was placed in Unselected state because the required minimum number of Selected ports was not reached. |
|
Recommended action |
Make sure the minimum number of Selected ports is met. |
LAGG_INACTIVE_NODEREMOVE
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the card that hosts the port was absent. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_NODEREMOVE: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the card that hosts the port was absent. |
|
Explanation |
A member port in an aggregation group was set to the Unselected state because the card that hosts the port was removed. |
|
Recommended action |
Verify that the card is present. |
LAGG_INACTIVE_OPERSTATE
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the peer port did not have the Synchronization flag. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_OPERSTATE: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the peer port did not have the Synchronization flag. |
|
Explanation |
A member port in an aggregation group changed to the Unselected state because the peer port did not have the Synchronization flag. |
|
Recommended action |
Check whether the peer device sends LACPDUs. |
LAGG_INACTIVE_PARTNER
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the link aggregation configuration of its peer port was incorrect. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_PARTNER: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the link aggregation configuration of its peer port was incorrect. |
|
Explanation |
A member port in an aggregation group changed to the Unselected state because the port's partner changed to the Unselected state. |
|
Recommended action |
No action is required. |
LAGG_INACTIVE_PARTNER_KEY_WRONG
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the operational key of the peer port was different from that of the reference port. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_PARTNER_KEY_WRONG: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the operational key of the peer port was different from that of the reference port. |
|
Explanation |
A member port in an aggregation group changed to the Unselected state because the operational key of the peer port was different from that of the reference port. |
|
Recommended action |
Verify the operational key of the peer port is the same as that of the reference port. |
LAGG_INACTIVE_PARTNER_MAC_WRONG
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the system MAC address of the peer port was different from that of the peer port for the reference port. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_PARTNER_MAC_WRONG: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the system MAC address of the peer port was different from that of the peer port for the reference port. |
|
Explanation |
A member port in an aggregation group changed to the Unselected state, because the system MAC address of the peer port was different from that of the peer port for the reference port. |
|
Recommended action |
Verify the system MAC address of the peer port is the same as that of the peer port for the reference port. |
LAGG_INACTIVE_PARTNER_NONAGG
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the link of the peer port was not aggregatable. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_PARTNER_NONAGG: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the link of the peer port was not aggregatable. |
|
Explanation |
A member port in aggregation group changed to the Unselected state, because the link of the peer port was not aggregatable. |
|
Recommended action |
Modify the peer port configuration for the link to be aggregatable. |
LAGG_INACTIVE_PHYSTATE
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the physical or line protocol state of the port was down. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_PHYSTATE: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the physical or line protocol state of the port was down. |
|
Explanation |
A member port in an aggregation group changed to the Unselected state because the port went down. |
|
Recommended action |
Bring up the member port. |
LAGG_INACTIVE_PORT_DEFAULT
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the port had not received LACPDUs. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_PORT_DEFAULT: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the port had not received LACPDUs. |
|
Explanation |
A member port in an aggregation group changed to the Unselected state because no LACPDU was received by the member port. |
|
Recommended action |
Check whether the peer sends LACPDUs. |
LAGG_INACTIVE_RDIRHANDLE
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because link-aggregation traffic redirection was triggered on the local port. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_RDIRHANDLE: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because link-aggregation traffic redirection was triggered on the local port. |
|
Explanation |
A member port in an aggregation group changed to the Unselected state, because link-aggregation traffic redirection was triggered on the aggregate interface. |
|
Recommended action |
Modify the local port configuration to make sure the link-aggregation traffic redirection was not triggered on the aggregate interface. |
LAGG_INACTIVE_REDUNDANCY
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the port was in secondary state in a redundancy group. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_ REDUNDANCY: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the port was in secondary state in a redundancy group. |
|
Explanation |
A member port in an aggregation group changed to the Unselected state, because the port was in secondary state in a redundancy group. |
|
Recommended action |
Change the port to primary state in the redundancy group. |
LAGG_INACTIVE_RESOURCE_INSUFICIE
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because hardware resources were not enough. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
3 |
|
Example |
LAGG/3/LAGG_INACTIVE_RESOURCE_INSUFICIE: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because hardware resources were not enough. |
|
Explanation |
A member port in an aggregation group changed to the Unselected state because all aggregation resources were used. |
|
Recommended action |
No action is required. |
LAGG_INACTIVE_SECONDARY
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because it was the secondary member port in the aggregation group in 1+1 backup mode. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_SECONDARY: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because it was the secondary member port in the aggregation group in 1+1 backup mode. |
|
Explanation |
A member port in a 1+1 backup aggregation group changed to the Unselected state because it was assigned the secondary role. |
|
Recommended action |
No action is required. |
LAGG_INACTIVE_SPEED
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the speed configuration of the port was different from that of the reference port. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_SPEED: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the speed configuration of the port was different from that of the reference port. |
|
Explanation |
A member port in an aggregation group changed to the Unselected state because the speed was different between the member port and the reference port. |
|
Recommended action |
Change the speed of the member port to be the same as the reference port. |
LAGG_INACTIVE_STANDBY
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the port was in Standby state. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_STANDBY: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the port was in Standby state. |
|
Explanation |
A member port of an aggregation group changed to the Unselected state because the port was in Standby state. |
|
Recommended action |
Check the state of the member port after a time period. If the port is in Unselected state, locate the cause and see the recommended action by executing the display link-aggregation troubleshooting command. |
LAGG_INACTIVE_STRUNK_DOWN
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the role of the aggregate interface is secondary in a smart trunk. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_INACTIVE_STRUNK_DOWN: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the role of the aggregate interface is secondary in a smart trunk. |
|
Explanation |
A member port of an aggregate interface changed to the Unselected state because the aggregate interface's role changed to secondary in a smart trunk. |
|
Recommended action |
No action is required. |
LAGG_INACTIVE_UPPER_LIMIT
|
Message text |
Member port [STRING] of aggregation group [STRING] changed to the inactive state, because the number of Selected ports had reached the upper limit. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
3 |
|
Example |
LAGG/3/LAGG_INACTIVE_UPPER_LIMIT: Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the number of Selected ports had reached the upper limit. |
|
Explanation |
The number of Selected ports reached the upper limit in a dynamic aggregation group. A member port in the aggregation group changed to the Unselected state because a more eligible port joined the aggregation group. |
|
Recommended action |
No action is required. |
LAGG_LACP_MISCONNECT_ACTIVE
|
The peer port of aggregation group [STRING] might be incorrectly connected. Local information: System priority=[UINT16], system MAC address=[STRING], local operational key=[UINT16], port priority=[UINT16], index=[UINT16] Received LACPDU information: System priority=[UINT16], system MAC address=[STRING], operational key=[UINT16], port priority=[UINT16], index=[UINT16] |
|
|
Variable fields |
$1: Link aggregation group type and ID. $2: System priority. $3: System MAC address. $4: Operational key. $5: Port priority. $6: Port index assigned by the link aggregation module. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_LACP_MISCONNECT_ACTIVE: The peer port of aggregation group BAGG1 might be incorrectly connected. Local information: System priority=32768 system MAC address=40c0-0c41-0100, local operational key=1, port priority=32768, index=1 Received LACPDU information: System priority=32768, system MAC address=0000-0000-0000, operational key=0, port priority=32768, index=0 |
|
Explanation |
A peer port of an aggregation group was incorrectly connected. |
|
Recommended action |
Verify that the link to the peer port is correctly connected and the peer port joins the correct aggregation group. |
LAGG_LACP_MISCONNECT_CLEAR
|
Message text |
The peer port of aggregation group [STRING] was correctly connected. Local information: System priority=[UINT16], system MAC address=[STRING], local operational key=[UINT16], port priority=[UINT16], index=[UINT16] Received LACPDU information: System priority=[UINT16], system MAC address=[STRING], operational key=[UINT16], port priority=[UINT16], index=[UINT16] |
|
Variable fields |
$1: Link aggregation group type and ID. $2: System priority. $3: System MAC address. $4: Operational key. $5: Port priority. $6: Port index assigned by the link aggregation module. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_LACP_MISCONNECT_CLEAR: The peer port of aggregation group BAGG1 was correctly connected. Local information: System priority=32768 system MAC address=40c0-0c41-0100, local operational key=1, port priority=32768, index=1 Received LACPDU information: System priority=32768 system MAC address=40c0-0c41-0100, local operational key=1, port priority=32768, index=1 |
|
Explanation |
The incorrect connection issue was resolved on a peer port of an aggregation group. |
|
Recommended action |
No action is required. |
LAGG_LACP_RECEIVE_TIMEOUT
|
Message text |
LACPDU reception timed out on member port [STRING] in aggregation group [STRING]. |
|
Variable fields |
$1: Port name. $2: Link aggregation group type and ID. |
|
Severity level |
6 |
|
Example |
LAGG/6/LAGG_RECEIVE_TIMEOUT: LACPDU reception timed out on member port GE1/0/1 of aggregation group BAGG1. |
|
Explanation |
LACPDU reception timed out on the reference port in an aggregation group. |
|
Recommended action |
Verify that the member ports in the aggregation group are correctly connected. |
LDP messages
This section contains LDP messages.
LDP_SESSION_ABNORM_MSG
|
Message text |
Received incorrect messages ([STRING]) by the session ([STRING], [STRING]). |
|
Variable fields |
$1: Type of the error packet. Possible values include: · Label Request Message. · Label Mapping Message. · Label Release Message. · Label Withdraw Message. · Label Abort Request Message. · Initialization Message. · Keepalive Message. · Notification Message. · Address Message. · Address Withdraw Message. · - (hyphen) —Unknown message type. $2: LDP ID of the peer. If the peer LDP ID cannot be obtained, this field displays 0.0.0.0:0. $3: VPN instance name. If the session belongs to the public network, this field displays public instance. |
|
Severity level |
5 |
|
Example |
LDP/5/LDP_SESSION_ABNORM_MSG: Received incorrect messages (Initialization Message) by the session (10.200.0.60:0, public instance). |
|
Explanation |
The device received an LDP error message from the LDP peer. |
|
Recommended action |
· Examine the physical link status. · Verify that the LDP settings configured at both sides of the LDP session are correct. |
LDP_SESSION_AUTH_FAIL
|
Message text |
LDP session ([STRING], [STRING]) failed [STRING] authentication. |
|
Variable fields |
$1: IP address and port number used by the peer to establish the TCP connection. $2: VPN instance name. If the session belongs to the public network, this field displays public instance. $3: Security authentication type, which can be MD5 or keychain. |
|
Severity level |
5 |
|
Example |
LDP/5/LDP_SESSION_AUTH_FAIL: LDP session (2.2.2.9:61890, public instance) failed MD5 authentication. |
|
Explanation |
LDP security authentication failed because of inconsistent security authentication settings at the two ends of the LDP session. |
|
Recommended action |
Modify the security authentication settings for the LDP session and make sure the settings are the same at both ends of the session. |
LDP_SESSION_CHG
|
Message text |
Session ([STRING], [STRING]) is [STRING] ([STRING]). ([STRING]) |
|
Variable fields |
$1: Peer's LDP ID. Value 0.0.0.0:0 indicates that the peer's LDP ID cannot be obtained. $2: VPN instance's name. Value public instance indicates that the session belongs to the public network. $3: State of the session, up or down. $4: Reason for the down state error. This field is displayed only when the state is down. $5: Session information. This field is displayed only when the state is down. The following information will be displayed: · LocalTransportAddr—Local transport address. · PeerTransportAddr—Peer transport address. · SessionRole—Role of the local LSR in the session, which can be Active or Passive. · SessionUpTime—Period of time (in DD:HH:MM format) during which the session was in Operational state. · KeepaliveTime—Negotiated keepalive time, in seconds. · KeepaliveSentCount—Number of keepalive messages sent locally. · KeepaliveRcvdCount—Number of keepalive messages received locally. · GracefulRestart—Indicates the LDP GR capability of the peer. ¡ On—LDP GR is enabled on the peer. ¡ Off—LDP GR is disabled on the peer. · SocketID—Socket ID of the session. · WaitSendMsgCount—Number of TCP messages to be sent. · CPUusage—The CPU usage rate when the session was down. · MemoryState—Memory usage threshold level when the session was down. ¡ Normal—Memory usage is normal. ¡ Minor—Memory usage has reached the level 1 threshold. ¡ Severe—Memory usage has reached the level 2 threshold. ¡ Critical—Memory usage has reached the level 3 threshold. |
|
Severity level |
4 |
|
Example |
LDP/4/LDP_SESSION_CHG: Session (22.22.22.2:0, public instance) is up. LDP/4/LDP_SESSION_CHG: Session (22.22.22.2:0, VPN instance: vpn1) is down (hello hold timer expired). (LocalTransportAddr=11.1.1.1, PeerTransportAddr=22.2.2.2, SessionRole=Passive, SessionUpTime=0000:00:35, KeepaliveTime=45s, KeepaliveSentCount=143, KeepaliveRcvdCount=148, GracefulRestart=Off, SocketID=35, WaitSendMsgCount=0, CPUUsage=19%, MemoryState=Normal) |
|
Explanation |
The session state changed. |
|
Recommended action |
When the session state is up, no action is required. When the session state is down, check the interface state, link state, and other configurations depending on the reason displayed. Possible reasons include: · interface not operational. · MPLS disabled on interface. · LDP disabled on interface. · LDP auto-configure disabled on interface. · VPN instance changed on interface. · LDP instance deleted. · targeted peer deleted. · L2VPN disabled targeted peer. · TE tunnel disabled targeted peer. · session protection disabled targeted peer. · OSPF Remote LFA disabled targeted peer. · IS-IS Remote LFA disabled targeted peer. · process deactivated. · failed to receive the initialization message. · graceful restart reconnect timer expired. · failed to recover adjacency by NSR. · failed to upgrade session by NSR. · closed the GR session. · keepalive hold timer expired. · hello hold timer expired. · session reset. · TCP connection down. · received a fatal notification message. · internal error. · memory in critical state. · transport address changed on interface. · MD5 password changed |
LDP_SESSION_GR
|
Message text |
Session ([STRING], [STRING]): ([STRING]). |
|
Variable fields |
$1: Peer's LDP ID. Value 0.0.0.0:0 indicates that the peer's LDP ID cannot be obtained. $2: VPN instance's name. Value public instance indicates that the session belongs to the public network. $3: State of the session graceful restart: · Start reconnection. · Reconnection failed. · Start recovery. · Recovery completed. |
|
Severity level |
5 |
|
Example |
LDP/5/LDP_SESSION_GR: Session (22.22.22.2:0, VPN instance: vpn1): Start reconnection. |
|
Explanation |
State of the session graceful restart. When a GR-capable LDP session is down, the LDP GR started. This message is generated during the GR of the LDP session, indicating the current GR state. |
|
Recommended action |
Check for the reason of session graceful restart, which can be obtained from the LDP_SESSION_CHG log message. When the graceful restart state Reconnection failed is displayed, verify the interface state, link state, and other configurations according to the reason for the session graceful restart. No action is required for other graceful restart states. |
LDP_SESSION_INIT_EXCEED
|
Message text |
Session ([STRING], [STRING], [STRING]) negotiation failed after [UINT32] attempts. |
|
Variable fields |
$1: Peer's LDP ID. Value 0.0.0.0:0 indicates that the peer's LDP ID cannot be obtained. $2: VPN instance's name. Value public instance indicates that the session belongs to the public network. $3: LDP instance index. $4: Number of Initialization messages sent. |
|
Severity level |
5 |
|
Example |
LDP/5/LDP_SESSION_INIT_EXCEED: Session (2.2.2.9, public instance, 2) negotiation failed after 2 attempts. |
|
Explanation |
LDP session negotiation failed because the number of Initialization messages sent to the peer for session parameter negotiation has reached the maximum allowed. |
|
Recommended action |
Verify that the session parameter settings are correct: · Make sure the keepalive hold time is not 0 on the remote device. · Comware devices do not support the Downstream On Demand (DoD) label advertisement mode. Make sure the label advertisement mode on the remote device is Downstream Unsolicited (DU). · Check whether loop detection is enabled on the remote device. If loop detection is not enabled, set the PV limit to 0 or enable loop detection on the remote device If the issue persists, collect the configuration file, logs, and alarm messages for the device and contact Technical Support. |
LDP_SESSION_SP
|
Message text |
Session ([STRING], [STRING]): ([STRING]). |
|
Variable fields |
$1: Peer's LDP ID. Value 0.0.0.0:0 indicates that the peer's LDP ID cannot be obtained. $2: VPN instance's name. Value public instance indicates that the session belongs to the public network. $3: State of the session protection: · Hold up the session. · Session recovered successfully. · Session recovery failed. |
|
Severity level |
5 |
|
Example |
LDP/5/LDP_SESSION_SP: Session (22.22.22.2:0, VPN instance: vpn1): Hold up the session. |
|
Explanation |
When the last link adjacency of the session was lost, session protection started. This message is generated during the session protection process, indicating the current session protection state. |
|
Recommended action |
Verify the interface state and link state. |
LDP_ADJACENCY_DOWN
|
Message text |
ADJ ([STRING], [STRING], [STRING]) is down [STRING]. ([STRING]) |
|
Variable fields |
$1: LDP ID of the peer. Value 0.0.0.0:0 indicates that the peer LDP ID cannot be obtained. $2: Name of the VPN instance. Value public instance indicates that the session belongs to the public network. $3: Interface name. This field is not available for a targeted hello. $4: Reason for the down state of the adjacency. $5: Information about the adjacency: · Type—Adjacency type. ¡ Link—Link Hello adjacency. ¡ Target—Targeted Hello adjacency. · SourceAddr—Source address of the adjacency. · DestinationAddr—Destination address of the adjacency. · TransportAddr—Transport address of the adjacency. · ADJUpTime—Duration of the adjacency in up state. The duration time is in DD:HH:MM format. · HelloHoldTime—Hello holding time, in seconds. · HelloSentCount—Number of Hello message sent locally. · HelloRcvdCount—Number of Hello message received locally. |
|
Severity level |
5 |
|
Example |
LDP/5/LDP_ADJACENCY_DOWN: ADJ (10.200.0.60:0, public instance, GE2/0/1) is down (Hello timer expired). (Type=Link, SourceAddr=100.12.1.2, DestinationAddr=224.0.0.2, TransportAddr=22.2.2.2, ADJUpTime=0000:00:02, HelloHoldTime=15s, HelloSentCount=27, HelloRcvdCount=25) |
|
Explanation |
An LDP adjacency was down, and related information for the adjacency was displayed. |
|
Recommended action |
When an LDP adjacency is down, check the interface state, link state, and other configurations depending on the reason displayed. Possible reasons include: · VPN instance changed on interface. · LDP disabled on interface. · LDP auto-configure disabled on interface. · MPLS disabled on interface. · interface not operational. · targeted peer deleted. · L2VPN disabled targeted peer. · TE tunnel disabled targeted peer. · session protection disabled targeted peer. · OSPF Remote LFA disabled targeted peer. · IS-IS Remote LFA disabled targeted peer. · process deactivated. · LDP instance deleted. · hello hold timer expired. · no IPv6 transport address. |
LIF messages
This section contains LIF messages.
HW_NORES
|
Message text |
Not enough resources for [STRING]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
6 (Informational) |
|
Example |
LIF/6/HW_NORES: -MDC=1-Slot=5; Not enough resources for Route-Aggregation1.1. |
|
Impact |
QinQ termination is unavailable on the interface. |
|
Cause |
Hardware resources were insufficient for enabling QinQ termination on the interface. |
|
Recommended action |
1. View the QinQ termination configurations by using the display current-configuration | include second-dot1q command. 2. Delete the unused configurations by using the undo vlan-type dot1q vid second-dot1q command. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help.. |
IF_RAGG_FAILED
|
Message text |
Failed to assign the interface to the link aggregation group, because the corresponding aggregate interface has subinterfaces with some VLAN termination configuration not supported by the board of this interface. |
|
Variable fields |
N/A |
|
Severity level |
3 (Error) |
|
Example |
LIF/3/IF_RAGG_FAILED: -MDC=1; Failed to assign the interface to the link aggregation group, because the corresponding aggregate interface has subinterfaces with some VLAN termination configuration not supported by the board of this interface. |
|
Impact |
Failed to assign the Ethernet interface to the link aggregation group. |
|
Cause |
Failed to assign the Ethernet interface to the link aggregation group, because the corresponding aggregate interface has subinterfaces with some VLAN termination configuration not supported by the card of this Ethernet interface. |
|
Recommended action |
1. Delete the aggregate subinterface and then assign the Ethernet interface to the link aggregate group. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
MAC_INCORRECT
|
Message text |
Pattern 1: Incorrect MAC address. The MAC address of [STRING] must range from [UCHAR] [UCHAR]-[UCHAR] [UCHAR]-[UCHAR] [UCHAR] to [UCHAR] [UCHAR]-[UCHAR] [UCHAR]-[UCHAR] [UCHAR]. Pattern 2: Incorrect MAC address. The MAC address of the interface must range from [UCHAR] [UCHAR]-[UCHAR] [UCHAR]-[UCHAR] [UCHAR] to [UCHAR] [UCHAR]-[UCHAR] [UCHAR]-[UCHAR] [UCHAR]. |
|
Variable fields |
Pattern 1: $1: Interface name. $2-$7: Configured start MAC addresses. $8-$13: Configured end MAC addresses. Pattern 2: $1-$6: Configured start MAC addresses. $7-$12: Configured end MAC addresses. |
|
Severity level |
3 (Error) |
|
Example |
Pattern 1: LIF/3/MAC_INCORRECT: -MDC=1-Slot=3; Incorrect MAC address. The MAC address of Ten-GigabitEthernet3/0/1 must range from 0000-1111-2222 to 1111-2222-3333 Pattern 2: LIF/3/MAC_INCORRECT: -MDC=1-Slot=3; Incorrect MAC address. The MAC address of the interface must range from 0000-1111-2222 to 1111-2222-3333 |
|
Impact |
The configured MAC address does not take effect because of it is not in the specified range. |
|
Cause |
The configured MAC address is in the specified range. |
|
Recommended action |
1. Configure the MAC address range from 0000-1111-2222 to 1111-2222-3333. Make sure the configured MAC address is in the specified range. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
OUTLIFID_NORES
|
Message text |
Not enough OutlifID resource. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
LIF/4/OUTLIFID_NORES: -MDC=1-Slot=3; Not enough OutlifID resource. |
|
Impact |
The card failed to learn new ARP entries, ND entries, or non-host routes. Traffic forwarding failures might occur. |
|
Cause |
The card failed to learn new ARP entries, ND entries, or non-host routes because of insufficient OutlifID resources. Traffic forwarding failures might occur. |
|
Recommended action |
1. Delete redundant configuration on the device. 2. Remove redundant interfaces on the device. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
PKTCNT_NOTSPT
|
Message text |
This board does not support traffic statistics on the VLAN interface. |
|
Variable fields |
N/A |
|
Severity level |
2 (Critical) |
|
Example |
LIF/2/IF: -MDC=1-Slot=3; This board does not support traffic statistics on the VLAN interface. |
|
Impact |
The board does not support traffic statistics on the VLAN interface. |
|
Cause |
An interface on a board does not support traffic statistics for the VLAN interface of a VLAN to which the interface belongs. |
|
Recommended action |
1. Delete the interface on the card from the VLAN, and then enable the packet statistics function of the VLAN interface. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
QINQ_SUBVLAN_CFGERR
|
Message text |
Subinterface [STRING] only supports VLAN termination by the vlan-type dot1q vid [INT32] command. |
|
Variable fields |
$1: Subinterface name. $2: VLAN ID. |
|
Severity level |
5 (Notification) |
|
Example |
LIF/5/QINQ_SUBVLAN_CFGERR: -MDC=1; Subinterface VE-L3VPN1.1 only supports VLAN termination by the vlan-type dot1q vid 1 command. |
|
Impact |
1. QinQ termination is unavailable on the subinterface. 2. The subinterface cannot terminate packets with the Layer 1 VLAN ID as the subinterface number. |
|
Cause |
The specified L3VE subinterface supports only dot1q termination, and can terminate only packets with the Layer 1 VLAN ID as the subinterface number. |
|
Recommended action |
1. When configuring dot1q termination on a subinterface, make sure the Layer 1 VLAN ID to be terminated is the same as the subinterface number. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
QINQ_SUBVLAN_NOTSPT
|
Message text |
Subinterface [STRING] not supports QINQ VLAN termination. |
|
Variable fields |
$1: Subinterface name. |
|
Severity level |
5 (Notification) |
|
Example |
LIF/5/QINQ_SUBVLAN_NOTSPT: -MDC=1-Slot=3; Subinterface Ten-GigabitEthernet3/0/1.2048 not supports QINQ VLAN termination. |
|
Impact |
The subinterface does not support the user-vlan dot1q vid second-dot1q command. The subinterface does not support the vlan-type dot1q vid second-dot1q command. |
|
Cause |
The subinterface does not support VLAN QinQ termination. |
|
Recommended action |
1. Configure the interface that supports VLAN QinQ termination. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
QINQ_SUBVLAN_STARTERR
|
Message text |
Subinterface [STRING] only supports VLAN termination by commands starting with vlan-type dot1q vid [INT32]. |
|
Variable fields |
$1: Subinterface name. $2: VLAN ID. |
|
Severity level |
5 (Notification) |
|
Example |
LIF/5/QINQ_SUBVLAN_STARTERR: -MDC=1-Slot=3; Subinterface Ten-GigabitEthernet3/0/1.2048 only supports VLAN termination by commands starting with vlan-type dot1q vid 2048. |
|
Impact |
1. If the Layer 1 VLAN ID to be terminated is not the same as the subinterface number, the subinterface does not support dot1q termination. 2. If the Layer 1 VLAN ID to be terminated is not the same as the subinterface number, the subinterface does not support QinQ termination. |
|
Cause |
A subinterface only supports terminating packets with the Layer 1 VLAN ID as the subinterface number. |
|
Recommended action |
1. When configuring dot1q termination or QinQ termination on a subinterface, make sure the Layer 1 VLAN ID to be terminated is the same as the subinterface number. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
QINQ_UNTAG_DEFAULT_NOTSPT
|
Message text |
The board in slot [UINT16] doesn't support untagged or default termination. Or The board doesn't support untagged or default termination. |
|
Variable fields |
$1: Slot number. |
|
Severity level |
3 (Error) |
|
Example |
LIF/3/QINQ_UNTAG_DEFAULT_NOTSPT: -MDC=1-Slot=3; The board in slot 3 doesn't support untagged or default termination. |
|
Impact |
The interfaces on the board do not support untagged or default termination. |
|
Cause |
¡ a member port does not support untagged termination or default termination. The system will prompt that the card does not support untagged termination or default termination. |
|
Recommended action |
1. Configure the interface that supports untagged termination or default termination. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
QINQ_USERVLAN_CHK
|
Message text |
The user-vlan configuration conflicts with [STRING] configuration. To avoid conflicts, do not configure both features on interface [STRING]. |
|
Variable fields |
$1: Feature configuration: · ip subscriber l2vpn-leased—IPoE L2VPN-leased user configuration. · ip subscriber routed enable—IPoE configuration in Layer 3 access mode. · portal—Portal authentication configuration. $2: Subinterface name. |
|
Severity level |
4 (Warning) |
|
Example |
LIF/4/QINQ_USERVLAN_CHK: -MDC=1-Slot=4; The user-vlan configuration conflicts with portal configuration. To avoid conflicts, do not configure both features on interface Route-Aggregation1.2. |
|
Impact |
User VLAN termination is unavailable on the subinterface. |
|
Cause |
User VLAN termination conflicts with one of the following configurations on the subinterface: · Portal authentication configuration (portal [ ipv6 ] enable). · IPoE L2VPN-leased user configuration (ip subscriber l2vpn-leased). · IPoE configuration in Layer 3 access mode (ip subscriber routed enable). |
|
Recommended action |
1. Execute the display this command in subinterface view to check for conflicting configurations. If conflicting configurations are present on the subinterface, remove the conflicting configurations according to the actual service requirements. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
QINQ_USERVLAN_NORES
|
Message text |
Pattern 1: Not enough resources for user-vlan QINQ termination on [STRING]. Pattern 2: Not enough resources for user-vlan QINQ termination on [INT32]. |
|
Variable fields |
$1: Subinterface name. $2: Interface index. |
|
Severity level |
4 (Warning) |
|
Example |
LIF/4/QINQ_USERVLAN_NORES: -MDC=1-Slot=5; Not enough resources for user-vlan QINQ termination on Route-Aggregation1.1. |
|
Impact |
Failed to enable QinQ termination on the subinterface. |
|
Cause |
QinQ termination configured by using the user-vlan dot1q vid second-dot1q command failed to be enabled on a subinterface because of insufficient hardware resources. |
|
Recommended action |
1. When resources are insufficient for configure user VLAN termination on a subinterface, use the display current-configuration | include second-dot1q command to view the current user VLAN QinQ termination configuration. Use the undo user-vlan dot1q vid second-dot1q command to disable user VLAN QinQ termination. 2. Remove configurations that are not used currently to release resources. 3. When resources are insufficient for adding a member interface to an aggregate group, use the display link-aggregation verbose command to view the aggregate group configuration. Use the undo port link-aggregation group command to remove member ports that are not used currently from the aggregation group to release resources. 4. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
QINQ_VLAN_NORES
|
Message text |
Not enough resources for QinQ termination. |
|
Variable fields |
N/A |
|
Severity level |
2 (Critical) |
|
Example |
LIF/2/QINQ_VLAN_NORES: -MDC=1-Slot=3; Not enough resources for QinQ termination. |
|
Impact |
Failed to enable QinQ termination. |
|
Cause |
The card does not have enough hardware resources for user VLAN QinQ termination probably due to one of the following reasons: · A large number of IPoE or PPPoE users have come online. · A majority of interfaces on the card are used for user VLAN QinQ termination. |
|
Recommended action |
1. When resources are insufficient for configure user QinQ termination on a subinterface, use the display current-configuration | include second-dot1q command to view the current user QinQ termination configuration. Use the undo user-vlan dot1q vid second-dot1q command to disable QinQ termination. 2. Remove configurations that are not used currently to release resources. 3. When resources are insufficient for adding a member interface to an aggregate group, use the display link-aggregation verbose command to view the aggregate group configuration. Use the undo port link-aggregation group command to remove member ports that are not used currently from the aggregation group to release resources. 4. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
SUB_SPT_VID
|
Message text |
Subinterface [STRING] only supports VLAN termination by commands starting with vlan-type dot1q vid [INT32]. |
|
Variable fields |
$1: Subinterface name. $2: VLAN ID. |
|
Severity level |
5 (Notification) |
|
Example |
LIF/5/SUB_SPT_VID: -MDC=1-Slot=1; Subinterface Ten-GigabitEthernet3/0/1.2048 only supports VLAN termination by commands starting with vlan-type dot1q vid 2048. |
|
Impact |
1. If the Layer 1 VLAN ID to be terminated is not the same as the subinterface number, the subinterface does not support dot1q termination. 2. If the Layer 1 VLAN ID to be terminated is not the same as the subinterface number, the subinterface does not support QinQ termination. |
|
Cause |
A subinterface only supports terminating packets with the Layer 1 VLAN ID as the subinterface number. |
|
Recommended action |
1. When configuring dot1q termination or QinQ termination on a subinterface, make sure the Layer 1 VLAN ID to be terminated is the same as the subinterface number. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help |
LIPC messages
This section contains Leopard inter-process communication (LIPC) messages.
LIPC_CHECKDOWN
|
Message text |
The quality of the link is poor. Owner=[STRING], VRF=[INTEGER], local address/port=[INTEGER]/[INTEGER], remote address/port=[INTEGER]/[INTEGER]. |
|
Variable fields |
$1: Name of the process that established the LIPC link. $2: Name of the VRF to which the LIPC link belongs. $3: LIP address of the local node. $4: Port number of the local node. $5: LIP address of the remote node. $6: Port number of the remote node. |
|
Severity level |
4 |
|
Example |
LIPC/4/LIPC_CHECKDOWN: The quality of the link is poor. Owner=1, VRF=0, local address/port=0/20415, remote address/port=8/10515. |
|
Explanation |
Processes will establish an LIPC link during internal communication. LIPC STCP automatically checks the link quality at intervals and outputs this log when the link quality is detected poor. |
|
Recommended action |
No action is required. The system will try to restore the LIPC link of poor quality automatically. If the restoration fails, the system will terminate the LIPC link automatically. |
LIPC_MTCP_CHECK
|
Message text |
Data stays in the receive buffer for an over long time. Owner=[STRING], VRF=[INTEGER], MDC=[INTEGER], Group=[INTEGER], MID=[INTEGER]. |
|
Variable fields |
$1: Name of the process. $2: Name of the VRF to which the LIPC link belongs to. $3: ID of the MDC to which the LIPC link belongs to. $4: Multicast group ID of the LIPC link. $5: Multicast group member ID of the LIPC link. |
|
Severity level |
4 |
|
Example |
LIPC/4/LIPC_MTCP_CHECK: Data stays in the receive buffer for an over long time. Owner=fsd, VRF=0, MDC=1, Group=134, MID=10001. |
|
Explanation |
Processes will establish an LIPC link during internal communication. LIPC MTCP assigns a receive buffer to the process and checks at intervals whether data in the buffer is retrieved by the process. If the process has not retrieved data from the receive buffer for a long time and a large amount of data accumulates in the buffer, the process might run abnormally. |
|
Recommended action |
No action is required. |
LIPC_STCP_CHECK
|
Message text |
Data stays in the receive buffer for an over long time. Owner=[STRING], VRF=[INTEGER], MDC=[INTEGER], local address/port=[INTEGER]/[INTEGER], remote address/port=[INTEGER]/[INTEGER]. |
|
Variable fields |
$1: Name of the process that established the LIPC link. $2: Name of the VRF to which the LIPC link belongs. $3: ID of the MDC to which the LIPC link belongs. $4: LIP address of the local node. $5: Port number of the local node. $6: LIP address of the remote node. $7: Port number of the remote node. |
|
Severity level |
4 |
|
Example |
LIPC/4/LIPC_STCP_CHECK: Data stays in the receive buffer for an over long time. Owner=fsd, VRF=0, MDC=1, local address/port=8/10515, remote address/port=0/20415. |
|
Explanation |
Processes will establish an LIPC link during internal communication. LIPC STCP assigns a receive buffer to the process and checks at intervals whether data in the buffer is retrieved by the process. If the process has not retrieved data from the receive buffer for a long time and a large amount of data accumulates in the buffer, the process might run abnormally. |
|
Recommended action |
No action is required. |
LIPC_SUDP_CHECK
|
Message text |
Data stays in the receive buffer for an over long time. Owner=[STRING], VRF=[INTEGER], MDC=[INTEGER], local address/port=[INTEGER]/[INTEGER], remote address/port=[INTEGER]/[INTEGER]. |
|
Variable fields |
$1: Name of the process that established the LIPC link. $2: Name of the VRF to which the LIPC link belongs. $3: ID of the MDC to which the LIPC link belongs. $4: LIP address of the local node. $5: Port number of the local node. $6: LIP address of the remote node. $7: Port number of the remote node. |
|
Severity level |
4 |
|
Example |
LIPC/4/LIPC_SUDP_CHECK: Data stays in the receive buffer for an over long time. Owner=snmpd, VRF=0, MDC=1, local address/port=0/10525, remote address/port=32768/0. |
|
Explanation |
Processes will establish an LIPC link during internal communication. LIPC SUDP assigns a receive buffer to the process and checks at intervals whether data in the buffer is retrieved by the process. If the process has not retrieved data from the receive buffer for a long time and a large amount of data accumulates in the buffer, the process might run abnormally. |
|
Recommended action |
No action is required. |
PORT_CHANGE
|
Message text |
STCP: Node where the listening port number [INT] (MDC: [INT] VRF: [INT]) resides changed from LIP [INT] to LIP [INT]. |
|
Variable fields |
$1: LIPC global port number. $2: Name of the MDC where the LIPC global port resides. $3: Name of the VRF to which the LIPC global port belongs. $4: Name of the old LIPC node where the LIPC global port resides. $5: Name of the new LIPC node where the LIPC global port resides. |
|
Severity level |
5 |
|
Example |
LIPC/5/PORT_CHANGE: Node where the listening port number 620 (MDC: 1 VRF: 1) resides changed from LIP 1 to LIP 3. |
|
Explanation |
STCP assigns an LIPC global port number as a listening port number to each service module as requested. Typically, a service module listens to the port number only on the LIPC node where the port has been requested. This message is generated if the service module listens to the port number on a different LIPC node. STCP will move the port number from the old LIPC node to the new node. |
|
Recommended action |
No action is required. |
LLDP messages
This section contains LLDP messages.
LLDP_CREATE_NEIGHBOR
|
Message text |
[STRING] agent new neighbor created on port [STRING] (IfIndex [UINT32]), neighbor's chassis ID is [STRING], port ID is [STRING]. |
|
Variable fields |
$1: Agent type. $2: Port name. $3: Port ifIndex. $4: Neighbor's chassis ID. $5: Neighbor's port ID. |
|
Severity level |
6 |
|
Example |
LLDP/6/LLDP_CREATE_NEIGHBOR: Nearest bridge agent neighbor created on port GigabitEthernet1/0/1 (IfIndex 599), neighbor's chassis ID is 3822-d666-ba00, port ID is GigabitEthernet1/0/2. |
|
Explanation |
The port received an LLDP message from a new neighbor. |
|
Recommended action |
No action is required. |
LLDP_DELETE_NEIGHBOR
|
Message text |
[STRING] agent neighbor deleted on port [STRING] (IfIndex [UINT32]), neighbor's chassis ID is [STRING], port ID is [STRING]. |
|
Variable fields |
$1: Agent type. $2: Port name. $3: Port ifIndex. $4: Neighbor's chassis ID. $5: Neighbor's port ID. |
|
Severity level |
6 |
|
Example |
LLDP/6/LLDP_DELETE_NEIGHBOR: Nearest bridge agent neighbor deleted on port GigabitEthernet1/0/1 (IfIndex 599), neighbor's chassis ID is 3822-d666-ba00, port ID is GigabitEthernet1/0/2. |
|
Explanation |
The port received a deletion message when a neighbor was deleted. |
|
Recommended action |
No action is required. |
LLDP_LESS_THAN_NEIGHBOR_LIMIT
|
Message text |
The number of [STRING] agent neighbors maintained by port [STRING] (IfIndex [UINT32]) is less than [UINT32], and new neighbors can be added. |
|
Variable fields |
$1: Agent type. $2: Port name. $3: Port ifIndex. $4: Maximum number of neighbors a port can maintain. |
|
Severity level |
6 |
|
Example |
LLDP/6/LLDP_LESS_THAN_NEIGHBOR_LIMIT: The number of nearest bridge agent neighbors maintained by port GigabitEthernet1/0/1 (IfIndex 599) is less than 5, and new neighbors can be added. |
|
Explanation |
New neighbors can be added for the port because the limit has not been reached. |
|
Recommended action |
No action is required. |
LLDP_NEIGHBOR_AGE_OUT
|
Message text |
[STRING] agent neighbor aged out on port [STRING] (IfIndex [UINT32]), neighbor's chassis ID is [STRING], port ID is [STRING]. |
|
Variable fields |
$1: Agent type. $2: Port name. $3: Port ifIndex. $4: Neighbor's chassis ID. $5: Neighbor's port ID. |
|
Severity level |
4 |
|
Example |
LLDP/4/LLDP_NEIGHBOR_AGE_OUT: Nearest bridge agent neighbor aged out on port GigabitEthernet1/0/1 (IfIndex599), neighbor's chassis ID is 3822-d666-ba00, port ID is GigabitEthernet1/0/2. |
|
Explanation |
This message is generated when the port failed to receive LLDPDUs from the neighbor within a certain period of time. |
|
Recommended action |
Verify the link status or the receive/transmit status of LLDP on the peer. |
LLDP_PVID_INCONSISTENT
|
Message text |
PVID mismatch discovered on [STRING] (PVID [UINT32]), with [STRING] [STRING] (PVID [STRING]). |
|
Variable fields |
|
|
Severity level |
|
|
Example |
|
|
Explanation |
|
|
Recommended action |
LLDP_REACH_NEIGHBOR_LIMIT
|
Message text |
The number of [STRING] agent neighbors maintained by the port [STRING] (IfIndex [UINT32]) has reached [UINT32], and no more neighbors can be added. |
|
Variable fields |
$1: Agent type. $2: Port name. $3: Port ifIndex. $4: Maximum number of neighbors a port can maintain. |
|
Severity level |
3 |
|
Example |
LLDP/3/LLDP_REACH_NEIGHBOR_LIMIT: The number of nearest bridge agent neighbors maintained by the port GigabitEthernet1/0/1 (IfIndex 599) has reached 5, and no more neighbors can be added. |
|
Explanation |
This message is generated when the port with its maximum number of neighbors reached received an LLDP packet. |
|
Recommended action |
No action is required. |
LOAD messages
This section contains load management messages.
BOARD_LOADING
|
Message text |
Board in chassis [INT32] slot [INT32] is loading software images. |
|
Variable fields |
$1: Chassis number. $2: Slot number. |
|
Severity level |
4 |
|
Example |
LOAD/4/BOARD_LOADING: Board in chassis 1 slot 5 is loading software images. |
|
Explanation |
The card is loading software images during the boot process. |
|
Recommended action |
No action is required. |
LOAD_FAILED
|
Message text |
Board in chassis [INT32] slot [INT32] failed to load software images. |
|
Variable fields |
$1: Chassis number. $2: Slot number. |
|
Severity level |
3 |
|
Example |
LOAD/3/LOAD_FAILED: Board in chassis 1 slot 5 failed to load software images. |
|
Explanation |
The card failed to load software images during the boot process. |
|
Recommended action |
1. Execute the display boot-loader command to identify the startup software images. 2. Execute the dir command to verify that the startup software images exist. If the startup software images do not exist or are damaged, re-upload the software images to the device or set another one as the startup software images. 3. If the problem persists, contract H3C Support. |
LOAD_FINISHED
|
Message text |
Board in chassis [INT32] slot [INT32] has finished loading software images. |
|
Variable fields |
$1: Chassis number. $2: Slot number. |
|
Severity level |
5 |
|
Example |
LOAD/5/LOAD_FINISHED: Board in chassis 1 slot 5 has finished loading software images. |
|
Explanation |
The card has finished loading software images. |
|
Recommended action |
No action is required. |
Local messages
This section contains local messages.
LOCAL_CMDDENY
|
Message text |
-Line=[STRING]-IPAddr=[STRING]-User=[STRING]; Permission denied for visiting user [STRING]. |
|
Variable fields |
$1: User line name. This field displays two asterisks (**) if a login user is not assigned a user line. $2: IP address of the login user. This field displays two asterisks (**) if the system does not obtain the IP address of the login user. $3: Name of the login user. This field displays two asterisks (**) if the login user does not have a username. $4: Name of a local user. |
|
Severity level |
5 |
|
Example |
LOCAL/5/LOCAL_CMDDENY: -Line=vty0-IPAddr=111.8.10.111-User=opt; Permission denied for visiting user admin. |
|
Explanation |
The system rejected to enter the view of a local user because the login user does not have the access permission. |
|
Recommended action |
No action is required. |
|
Message text |
-Line=[STRING]-IPAddr=[STRING]-User=[STRING]; Permission denied for adding user [STRING]. |
|
Variable fields |
$1: User line name. This field displays two asterisks (**) if a login user is not assigned a user line. $2: IP address of the login user. This field displays two asterisks (**) if the system does not obtain the IP address of the login user. $3: Name of the login user. This field displays two asterisks (**) if the login user does not have a username. $4: Name of a local user. |
|
Severity level |
5 |
|
Example |
LOCAL/5/LOCAL_CMDDENY: -Line=vty0-IPAddr=111.8.10.111-User=opt; Permission denied for adding user admin. |
|
Explanation |
The system rejected to add a local user because the login user does not have the access permission. |
|
Recommended action |
No action is required. |
|
Message text |
-Line=[STRING]-IPAddr=[STRING]-User=[STRING]; Permission denied for deleting user [STRING]. |
|
Variable fields |
$1: User line name. This field displays two asterisks (**) if a login user is not assigned a user line. $2: IP address of the login user. This field displays two asterisks (**) if the system does not obtain the IP address of the login user. $3: Name of the login user. This field displays two asterisks (**) if the login user does not have a username. $4: Name of a local user. |
|
Severity level |
5 |
|
Example |
LOCAL/5/LOCAL_CMDDENY: -Line=vty0-IPAddr=111.8.10.111-User=opt; Permission denied for deleting user admin. |
|
Explanation |
The system rejected to delete a local user because the login user does not have the access permission. |
|
Recommended action |
No action is required. |
|
Message text |
-Line=[STRING]-IPAddr=[STRING]-User=[STRING]; Permission denied for configuring user [STRING]'s [STRING]. |
|
Variable fields |
$1: User line name. This field displays two asterisks (**) if a login user is not assigned a user line. $2: IP address of the login user. This field displays two asterisks (**) if the system does not obtain the IP address of the login user. $3: Name of the login user. This field displays two asterisks (**) if the login user does not have a username. $4: Name of a local user. $5: User attribute. The following options are available: ¡ password—User password. ¡ state—User state. ¡ service-type—Type of service. ¡ authorization-attribute—Authorization attribute. ¡ bind-attribute—Binding attribute. ¡ group—User group. ¡ access-limit—Maximum number of concurrent logins for a local user. |
|
Severity level |
5 |
|
Example |
LOCAL/5/LOCAL_CMDDENY: -Line=vty0-IPAddr=111.8.10.111-User=opt; Permission denied for configuring user admin's access-limit. |
|
Explanation |
The system rejected to configure an attribute for a local user because the login user does not have the access permission. |
|
Recommended action |
No action is required. |
|
Message text |
-Line=[STRING]-IPAddr=[STRING]-User=[STRING]; Permission denied for visiting group [STRING]. |
|
Variable fields |
$1: User line name. This field displays two asterisks (**) if a login user is not assigned a user line. $2: IP address of the login user. This field displays two asterisks (**) if the system does not obtain the IP address of the login user. $3: Name of the login user. This field displays two asterisks (**) if the login user does not have a username. $4: Name of a user group. |
|
Severity level |
5 |
|
Example |
LOCAL/5/LOCAL_CMDDENY: -Line=vty0-IPAddr=111.8.10.111-User=opt; Permission denied for visiting group system. |
|
Explanation |
The system rejected to enter the view of a user group because the login user does not have the access permission. |
|
Recommended action |
No action is required. |
|
Message text |
-Line=[STRING]-IPAddr=[STRING]-User=[STRING]; Permission denied for adding group [STRING]. |
|
Variable fields |
$1: User line name. This field displays two asterisks (**) if a login user is not assigned a user line. $2: IP address of the login user. This field displays two asterisks (**) if the system does not obtain the IP address of the login user. $3: Name of the login user. This field displays two asterisks (**) if the login user does not have a username. $4: Name of a user group. |
|
Severity level |
5 |
|
Example |
LOCAL/5/LOCAL_CMDDENY: -Line=vty0-IPAddr=111.8.10.111-User=opt; Permission denied for adding group system. |
|
Explanation |
The system rejected to add a user group because the login user does not have the access permission. |
|
Recommended action |
No action is required. |
|
Message text |
-Line=[STRING]-IPAddr=[STRING]-User=[STRING]; Permission denied for deleting group [STRING]. |
|
Variable fields |
$1: User line name. This field displays two asterisks (**) if a login user is not assigned a user line. $2: IP address of the login user. This field displays two asterisks (**) if the system does not obtain the IP address of the login user. $3: Name of the login user. This field displays two asterisks (**) if the login user does not have a username. $4: Name of a user group. |
|
Severity level |
5 |
|
Example |
LOCAL/5/LOCAL_CMDDENY: -Line=vty0-IPAddr=111.8.10.111-User=opt; Permission denied for deleting group system. |
|
Explanation |
The system rejected to delete a user group because the login user does not have the access permission. |
|
Recommended action |
No action is required. |
LOGIN messages
This section contains login messages.
LOGIN_AUTHENTICATION_FAILED
|
Message text |
Authentication failed for [STRING] from [STRING] because of [STRING]. |
|
Variable fields |
$1: Username. $2: Line name or IP address. $3: Failure reason. For more information, see AAA configuration in Security Configuration Guide. |
|
Severity level |
5 |
|
Example |
LOGIN/5/LOGIN_AUTHENTICATION_FAILED: Authentication failed for Usera from console0 because of invalid username or password. |
|
Explanation |
A login attempt failed. |
|
Recommended action |
Identify the failure reason and take actions accordingly. |
LOGIN_FAILED
|
Message text |
[STRING] failed to log in from [STRING]. |
|
Variable fields |
$1: Username. $2: Line name or IP address. |
|
Severity level |
5 |
|
Example |
LOGIN/5/LOGIN_FAILED: TTY failed to log in from console0. LOGIN/5/LOGIN_FAILED: usera failed to log in from 192.168.11.22. |
|
Explanation |
A login attempt failed. |
|
Recommended action |
No action is required. |
LOGIN_ INVALID_USERNAME_PWD
|
Message text |
Invalid username or password from [STRING]. |
|
Variable fields |
$1: User line name and user IP address. |
|
Severity level |
5 |
|
Example |
LOGIN/5/LOGIN_INVALID_USERNAME_PWD: Invalid username or password from console0. LOGIN/5/LOGIN_INVALID_USERNAME_PWD: Invalid username or password from 192.168.11.22. |
|
Explanation |
A user entered an invalid username or password. |
|
Recommended action |
No action is required. |
LPDT messages
This section contains loop detection messages.
LPDT_LOOPED
|
Message text |
A loop was detected on [STRING]. |
|
Variable fields |
$1: Port name. |
|
Severity level |
4 |
|
Example |
LPDT/4/LPDT_LOOPED: A loop was detected on Ethernet 6/4/2. |
|
Explanation |
The first intra-VLAN loop was detected on a port. |
|
Recommended action |
Check the links and configuration on the device for the loop, and remove the loop. |
LPDT_QINQ_LOOPED
|
Message text |
A loop was detected on [STRING] in SVLAN [UINT16] and CVLAN [UINT16]. |
|
Variable fields |
$1: Port name. $2: SVLAN ID. $3: CVLAN ID. |
|
Severity level |
4 |
|
Example |
LPDT/4/LPDT_QINQ_LOOPED: A loop was detected on Ethernet6/4/1 in SVLAN 1 and CVLAN 1. |
|
Explanation |
A looped was detected by double-tagged loop detection. |
|
Recommended action |
Check the links and configuration on the device for the loop, and remove the loop. |
LPDT_QINQ_RECOVERED
|
Message text |
A loop was removed on [STRING] in SVLAN [UINT16] and CVLAN [UINT16]. |
|
Variable fields |
$1: Port name. $2: SVLAN ID. $3: CVLAN ID. |
|
Severity level |
5 |
|
Example |
LPDT/5/LPDT_QINQ_RECOVERED: A loop was removed on Ethernet6/4/1 in SVLAN 1 and CVLAN 1. |
|
Explanation |
A loop was removed by double-tagged loop detection. |
|
Recommended action |
No action is required. |
LPDT_RECOVERED
|
Message text |
All loops were removed on [STRING]. |
|
Variable fields |
$1: Port name. |
|
Severity level |
5 |
|
Example |
LPDT/5/LPDT_RECOVERED: All loops were removed on Ethernet6/4/1. |
|
Explanation |
All intra-VLAN loops on a port were removed. |
|
Recommended action |
No action is required. |
LPDT_VLAN_LOOPED
|
Message text |
A loop was detected on [STRING] in VLAN [UINT16]. |
|
Variable fields |
$1: Port name. $2: VLAN ID. |
|
Severity level |
4 |
|
Example |
LPDT/4/LPDT_VLAN_LOOPED: A loop was detected on Ethernet6/4/1 in VLAN 1. |
|
Explanation |
A loop in a VLAN was detected on a port. |
|
Recommended action |
Check the links and configurations in the VLAN for the loop, and remove the loop. |
LPDT_VLAN_RECOVERED
|
Message text |
A loop was removed on [STRING] in VLAN [UINT16]. |
|
Variable fields |
$1: Port name. $2: VLAN ID. |
|
Severity level |
5 |
|
Example |
LPDT/5/LPDT_VLAN_RECOVERED: A loop was removed on Ethernet6/4/1 in VLAN 1. |
|
Explanation |
A loop in a VLAN was removed on a port. |
|
Recommended action |
No action is required. |
LS messages
This section contains Local Server messages.
LOCALSVR_PROMPTED_CHANGE_PWD
|
Message text |
Please change the password of [STRING] [STRING], because [STRING]. |
|
Variable fields |
$1: Password type: ¡ device management user. ¡ user line. ¡ user line class. $2: Username, user line name, or user line class name. $3: Reason for password change: ¡ the current password is a weak-password. ¡ the current password is the default password. ¡ it is the first login of the current user or the password had been reset. ¡ the password had expired. |
|
Severity level |
6 |
|
Example |
LOCALSVR/6/LOCALSVR_PROMPTED_CHANGE_PWD: Please change the password of device management user hhh, because the current password is a weak password. |
|
Explanation |
The device generated a log message to prompt a user to change the password of the user, user line, or user line class. The device will generate such a log message every 24 hours after the user logs in to the device if the password does not meet the password control requirements. |
|
Recommended action |
Change the user password as required: · If scheme authentication is used, change the local password of the user. · If password authentication is used, change the authentication password of the user line or user line class for the user. |
LS_ADD_USER_TO_GROUP
|
Message text |
Admin [STRING] added user [STRING] to group [STRING]. |
|
Variable fields |
$1: Admin name. $2: Username. $3: User group name. |
|
Severity level |
4 |
|
Example |
LS/4/LS_ADD_USER_TO_GROUP: Admin admin added user user1 to group group1. |
|
Explanation |
The administrator added a user into a user group. |
|
Recommended action |
No action is required. |
LS_AUTHEN_FAILURE
|
Message text |
User [STRING] from [STRING] failed authentication. [STRING] |
|
Variable fields |
$1: Username. $2: IP address. $3: Failure reason: ¡ User not found. ¡ Password verified failed. ¡ User not active. ¡ Access type mismatch. ¡ Binding attribute is failed. ¡ User in blacklist. |
|
Severity level |
5 |
|
Example |
LS/5/LS_AUTHEN_FAILURE: User cwf@system from 192.168.0.22 failed authentication. "User not found." |
|
Explanation |
The local server rejected a user's authentication request. |
|
Recommended action |
No action is required. |
LS_AUTHEN_SUCCESS
|
Message text |
User [STRING] from [STRING] was authenticated successfully. |
|
Variable fields |
$1: Username. $2: IP address. |
|
Severity level |
6 |
|
Example |
LS/6/LS_AUTHEN_SUCCESS: User cwf@system from 192.168.0.22 was authenticated successfully. |
|
Explanation |
The local server accepted a user's authentication request. |
|
Recommended action |
No action is required. |
LS_DEL_USER_FROM_GROUP
|
Message text |
Admin [STRING] delete user [STRING] from group [STRING]. |
|
Variable fields |
$1: Admin name. $2: Username. $3: User group name. |
|
Severity level |
4 |
|
Example |
LS/4/LS_DEL_USER_FROM_GROUP: Admin admin delete user user1 from group group1. |
|
Explanation |
The administrator deleted a user from a user group. |
|
Recommended action |
No action is required. |
LS_DELETE_PASSWORD_FAIL
|
Message text |
Failed to delete the password for user [STRING]. |
|
Variable fields |
$1: Username. |
|
Severity level |
4 |
|
Example |
LS/4/LS_DELETE_PASSWORD_FAIL: Failed to delete the password for user abcd. |
|
Explanation |
Failed to delete the password for a user. |
|
Recommended action |
Check the file system for errors. |
LS_PWD_ADDBLACKLIST
|
Message text |
User [STRING] was added to the blacklist due to multiple login failures, [STRING]. |
|
Variable fields |
$1: Username. $2: Options include: ¡ but could make other attempts. ¡ and is permanently blocked. ¡ and was temporarily blocked for [UINT32] minutes. |
|
Severity level |
4 |
|
Example |
LS/4/LS_PWD_ADDBLACKLIST: User user1 was added to the blacklist due to multiple login failures, but could make other attempts. |
|
Explanation |
A user was added to the blacklist because of multiple login failures. |
|
Recommended action |
Check the user's password. |
LS_PWD_CHGPWD_FOR_AGEDOUT
|
Message text |
User [STRING] changed the password because it was expired. |
|
Variable fields |
$1: Username. |
|
Severity level |
4 |
|
Example |
LS/4/LS_PWD_CHGPWD_FOR_AGEDOUT: User aaa changed the password because it was expired. |
|
Explanation |
A user changed the password because the password expired. |
|
Recommended action |
No action is required. |
LS_PWD_CHGPWD_FOR_AGEOUT
|
Message text |
User [STRING] changed the password because it was about to expire. |
|
Variable fields |
$1: Username. $2: Aging time. |
|
Severity level |
4 |
|
Example |
LS/4/LS_PWD_CHGPWD_FOR_AGEOUT: User aaa changed the password because it was about to expire. |
|
Explanation |
A user changed the password because the password was about to expire. |
|
Recommended action |
No action is required. |
LS_PWD_CHGPWD_FOR_COMPOSITION
|
Message text |
User [STRING] changed the password because it had an invalid composition. |
|
Variable fields |
$1: Username. |
|
Severity level |
4 |
|
Example |
LS/4/LS_PWD_CHGPWD_FOR_COMPOSITION: User aaa changed the password because it had an invalid composition. |
|
Explanation |
A user changed the password because it had an invalid composition. |
|
Recommended action |
No action is required. |
LS_PWD_CHGPWD_FOR_FIRSTLOGIN
|
Message text |
User [STRING] changed the password at the first login. |
|
Variable fields |
$1: Username. |
|
Severity level |
4 |
|
Example |
LS/4/LS_PWD_CHGPWD_FOR_FIRSTLOGIN: User aaa changed the password at the first login. |
|
Explanation |
A user changed the password at the first login. |
|
Recommended action |
No action is required. |
LS_PWD_CHGPWD_FOR_LENGTH
|
Message text |
User [STRING] changed the password because it was too short. |
|
Variable fields |
$1: Username. |
|
Severity level |
4 |
|
Example |
LS/4/LS_PWD_CHGPWD_FOR_LENGTH: User aaa changed the password because it was too short. |
|
Explanation |
A user changed the password because it was too short. |
|
Recommended action |
No action is required. |
LS_PWD_FAILED2WRITEPASS2FILE
|
Message text |
Failed to write the password records to file. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
LS/4/LS_PWD_FAILED2WRITEPASS2FILE: Failed to write the password records to file. |
|
Explanation |
Failed to write the password records to file. |
|
Recommended action |
No action is required. |
LS_PWD_MODIFY_FAIL
|
Message text |
Admin [STRING] from [STRING] could not modify the password for user [STRING], because [STRING]. |
|
Variable fields |
$1: Admin name. $2: IP address. $3: Username. $4: Failure reason: ¡ passwords do not match. ¡ the password history cannot be written. ¡ the password cannot be verified. |
|
Severity level |
4 |
|
Example |
LS/4/LS_PWD_MODIFY_FAIL: Admin admin from 1.1.1.1 could not modify the password for user user1, because passwords do not match. |
|
Explanation |
An administrator failed to modify a user's password. |
|
Recommended action |
No action is required. |
LS_PWD_MODIFY_SUCCESS
|
Message text |
Admin [STRING] from [STRING] modify the password for user [STRING] successfully. |
|
Variable fields |
$1: Admin name. $2: IP address. $3: Username. |
|
Severity level |
6 |
|
Example |
LS/6/LS_PWD_MODIFY_SUCCESS: Admin admin from 1.1.1.1 modify the password for user abc successfully. |
|
Explanation |
An administrator successfully modified a user's password. |
|
Recommended action |
No action is required. |
LS_REAUTHEN_FAILURE
|
Message text |
User [STRING] from [STRING] failed reauthentication. |
|
Variable fields |
$1: Username. $2: IP address. |
|
Severity level |
5 |
|
Example |
LS/5/LS_REAUTHEN_FAILURE: User abcd from 1.1.1.1 failed reauthentication. |
|
Explanation |
A user failed reauthentication. |
|
Recommended action |
Check the old password. |
LS_UPDATE_PASSWORD_FAIL
|
Message text |
Failed to update the password for user [STRING]. |
|
Variable fields |
$1: Username. |
|
Severity level |
4 |
|
Example |
LS/4/LS_UPDATE_PASSWORD_FAIL: Failed to update the password for user abc. |
|
Explanation |
Failed to update the password for a user. |
|
Recommended action |
Check the file system for errors. |
LS_USER_CANCEL
|
Message text |
User [STRING] from [STRING] cancelled inputting the password. |
|
Variable fields |
$1: Username. $2: IP address. |
|
Severity level |
5 |
|
Example |
LS/5/LS_USER_CANCEL: User 1 from 1.1.1.1 cancelled inputting the password. |
|
Explanation |
A user cancelled inputting the password or did not input the password in 90 seconds. |
|
Recommended action |
No action is required. |
LS_USER_PASSWORD_EXPIRE
|
Message text |
User [STRING]'s login idle timer timed out. |
|
Variable fields |
$1: Username. |
|
Severity level |
5 |
|
Example |
LS/5/LS_USER_PASSWORD_EXPIRE: User 1's login idle timer timed out. |
|
Explanation |
The login idle time for a user expired. |
|
Recommended action |
No action is required. |
LS_USER_ROLE_CHANGE
|
Message text |
Admin [STRING] [STRING] the user role [STRING] for [STRING]. |
|
Variable fields |
$1: Admin name. $2: Added/Deleted. $3: User role. $4: Username. |
|
Severity level |
4 |
|
Example |
LS/4/LS_USER_ROLE_CHANGE: Admin admin add the user role network-admin for abcd. |
|
Explanation |
An administrator added a user role for a user. |
|
Recommended action |
No action is required. |
LSM messages
This section contains LSM messages.
LSM_SR_LABEL_CONFLICT
|
Message text |
Protocol [STRING] assigned label ([STRING]) for prefix ([STRING]), which already has label ([STRING]) assigned by protocol [STRING]. |
|
Variable fields |
$1: Routing protocol 1. $2: Label 1. $3: Prefix and the mask. $4: Label 2. $5: Routing protocol 2. |
|
Severity level |
4 |
|
Example |
LSM/4/LSM_SR_LABEL_CONFLICT: Protocol ISIS assigned label (16000) to prefix (5.5.5.5/32), which already has label (17000) assigned by protocol OSPF. |
|
Explanation |
Two routing protocols running on the same SR node assigned different labels to the same prefix. |
|
Recommended action |
Perform one the following tasks: · Configure the routing protocols to assign the same label to the same prefix. · Remove one of the routing protocol process so only one routing protocol assigns labels to prefixes. |
LSM_SR_PREFIX_CONFLICT
|
Message text |
Label ([STRING]) for prefix ([STRING]) has been used by prefix ([STRING]). |
|
Variable fields |
$1: Label value. $2: Prefix 1 and the mask. $2: Prefix 2 and the mask. |
|
Severity level |
4 |
|
Example |
LSM/4/LSM_SR_PREFIX_CONFLICT: The label(16700) for prefix(8.8.8.8/32) has been used by prefix(5.5.5.5/32). |
|
Explanation |
A label was assigned to two prefixes. |
|
Recommended action |
Assign a different label to one of the prefixes. |
LSPV messages
This section contains LSP verification messages.
LSPV_PING_STATIS_INFO
|
Message text |
Ping statistics for [STRING]: [UINT32] packets transmitted, [UINT32] packets received, [DOUBLE]% packets loss, round-trip min/avg/max = [UINT32]/[UINT32]/[UINT32] ms. |
|
Variable fields |
$1: FEC. $2: Number of echo requests sent. $3: Number of echo replies received. $4: Percentage of the non-replied packets to the total requests. $5: Minimum round-trip delay. $6: Average round-trip delay. $7: Maximum round-trip delay. |
|
Severity level |
6 |
|
Example |
LSPV/6/LSPV_PING_STATIS_INFO: Ping statistics for FEC 192.168.1.1/32: 5 packets transmitted, 5 packets received, 0.0% packets loss, round-trip min/avg/max = 1/2/5 ms. |
|
Explanation |
Ping statistics for an LSP tunnel or a PW. This message is generated when the ping mpls command is executed. |
|
Recommended action |
If no reply is received, verify the connectivity of the LSP tunnel or the PW. |
MAC messages
This section contains MAC messages.
MAC_CAPACITY_LIMIT
|
Message text |
The number of MAC address entries exceeded the maximum number [UNIT32]. |
|
Variable fields |
$1: Maximum number of MAC address entries on the LPU. |
|
Severity level |
5 (Notification) |
|
Example |
MAC/5/MAC_CAPACITY_LIMIT: -MDC=1-Slot=3; The number of MAC address entries exceeded the maximum number 1048576. |
|
Impact |
· If the mac-address max-mac-count enable-forwarding command has been executed, the device forwards unknown frames received on the interface after the MAC learning limit on the interface is reached. · If the undo mac-address max-mac-count enable-forwarding command has been executed, the device does not forward unknown frames received on the interface after the MAC learning limit on the interface is reached. |
|
The number of MAC address entries on the LPU exceeded the supported maximum number. |
|
|
Recommended action |
· Use the mac-address max-mac-count command to set the MAC learning limit on a per-interface basis. · Use the mac-address max-mac-count enable-forwarding command to enable the device to forward unknown frames received on an interface after the MAC learning limit on the interface is reached. · If the issue persists, collect the configuration file, log messages, and alarm information, and then contact Technical Support. |
MAC messages
This section contains MAC messages.
MAC_NOTIFICATION
|
Message text |
Message format 1: MAC address [STRING] in VLAN [UNIT32] has moved from port [STRING] to port [STRING] for [UNIT32] times. Message format 2: MAC address [STRING] in VSI [STRING] has moved from [STRING] service-instance [UNIT32] to [STRING] service-instance [UNIT32] for [UNIT32] times. |
|
Variable fields |
Message format 1: $1: MAC address. $2: VLAN ID. $3: Interface name. $4: Interface name. $5: Number of MAC address moves. Message format 2: $1: MAC address. $2: VSI name. $3: Interface name. $4: Ethernet service instance ID. $5: Interface name. $6: Ethernet service instance ID. $7: Number of MAC address moves. |
|
Severity level |
4 |
|
Example |
Message format 1: MAC/4/MAC_NOTIFICATION: MAC address 0000-0012-0034 in VLAN 500 has moved from port GE1/0/1 to port GE1/0/2 for 1 times Message format 2: MAC/4/MAC_NOTIFICATION: MAC address 0010-9400-0002 in VSI vpna has moved from Twenty-FiveGigE1/0/1 service-instance 40 to Twenty-FiveGigE1/0/3 service-instance 30 for 152499 times. |
|
Explanation |
A MAC address moved between two interfaces or Ethernet service instances. |
|
Recommended action |
No action is required. |
MAC_TABLE_FULL_GLOBAL
|
Message text |
The number of MAC address entries exceeded the maximum number [UINT32]. |
|
Variable fields |
$1: Maximum number of MAC addresses. |
|
Severity level |
4 |
|
Example |
MAC/4/MAC_TABLE_FULL_GLOBAL: The number of MAC address entries exceeded the maximum number 1024. |
|
Explanation |
The number of entries in the global MAC address table exceeded the maximum number supported by the table. |
|
Recommended action |
No action is required. |
MAC_TABLE_FULL_PORT
|
Message text |
The number of MAC address entries exceeded the maximum number [UINT32] for interface [STRING]. |
|
Variable fields |
$1: Maximum number of MAC addresses. $2: Interface name. |
|
Severity level |
4 |
|
Example |
MAC/4/MAC_TABLE_FULL_PORT: The number of MAC address entries exceeded the maximum number 1024 for interface GigabitEthernet2/0/32. |
|
Explanation |
The number of entries in the MAC address table for an interface exceeded the maximum number supported by the table. |
|
Recommended action |
No action is required. |
MAC_TABLE_FULL_VLAN
|
Message text |
The number of MAC address entries exceeded the maximum number [UINT32] in VLAN [UINT32]. |
|
Variable fields |
$1: Maximum number of MAC addresses. $2: VLAN ID. |
|
Severity level |
4 |
|
Example |
MAC/4/MAC_TABLE_FULL_VLAN: The number of MAC address entries exceeded the maximum number 1024 in VLAN 2. |
|
Explanation |
The number of entries in the MAC address table for a VLAN exceeded the maximum number supported by the table. |
|
Recommended action |
No action is required. |
MBFD messages
This section contains MPLS BFD messages.
MBFD_TRACEROUTE_FAILURE
|
Message text |
[STRING] is failed. ([STRING].) |
|
Variable fields |
$1: LSP information. $2: Reason for the LSP failure. |
|
Severity level |
4 |
|
Example |
MBFD/4/MBFD_TRACEROUTE_FAILURE: LSP (LDP IPv4: 22.22.2.2/32, nexthop: 20.20.20.2) is failed. (Replying router has no mapping for the FEC.) MBFD/4/MBFD_TRACEROUTE_FAILURE: TE tunnel (RSVP IPv4: Tunnel1) is failed. (No label entry.) |
|
Explanation |
LSP/MPLS TE tunnel failure was detected by periodic MPLS tracert. This message is generated when the system receives an MPLS echo reply with an error return code. |
|
Recommended action |
Verify the configuration for the LSP or MPLS TE tunnel. |
MBUF messages
This section contains MBUF messages.
MBUF_DATA_BLOCK_CREATE_FAIL
|
Message text |
Failed to create an MBUF data block because of insufficient memory. Failure count: [UINT32]. |
|
Variable fields |
$1: Failure count. |
|
Severity level |
2 |
|
Example |
MBUF/2/MBUF_DATA_BLOCK_CREATE_FAIL: Failed to create an MBUF data block because of insufficient memory. Failure count: 128. |
|
Explanation |
The message is output when the system fails to create an MBUF data block 1 minute or more after the most recent creation failure. |
|
Recommended action |
1. Execute the display system internal kernel memory pool | include mbuf command in probe view to view the number of the allocated MBUF data blocks. 2. Execute the display memory command in system view to display the total size of the system memory. 3. Determine whether an excessive number of MBFU data blocks are allocated by comparing the size of the allocated MBUF data blocks with that of the system memory. ¡ If it is not an excessive number, use the memory management commands to check for the memory-intensive modules. ¡ If it is an excessive number, go to step 274. 4. Execute the display system internal mbuf socket statistics command in probe view to view the number of the MBUF data blocks buffered in the socket. Determine whether a process has too many MBUF data blocks buffered in the socket buffer. ¡ If it is too many, locate the reason why the MBUF data blocks cannot be released from the socket buffer. ¡ If it is not too many, use other means to locate the reasons for excessive allocation of MBUF data blocks. 5. If the problem persists, contact H3C Support. |
·
MFIB messages
This section contains MFIB messages.
MFIB_CFG_NOT_SUPPORT
|
Message text |
Failed to apply [STRING] configuration because the operation is not supported. |
|
Variable fields |
$1: IP multicast command. |
|
Severity level |
4 |
|
Example |
MFIB/4/MFIB_OIF_NOT_SUPPORT: Failed to apply multicast rpf-fail-pkt flooding configuration because the operation is not supported. |
|
Explanation |
The system failed to apply a configuration because the configuration is not supported by the hardware. |
|
Recommended action |
1. No action is required. |
MFIB_MTI_NO_ENOUGH_RESOURCE
|
Message text |
Failed to create [STRING] because of insufficient resources. |
|
Variable fields |
$1: Name of a multicast tunnel. |
|
Severity level |
4 |
|
Example |
MFIB/4/MFIB_MTI_NO_ENOUGH_RESOURCE: Failed to create MTunnel1 because of insufficient resources. |
|
Explanation |
The system failed to create a multicast tunnel because of insufficient hardware resources. |
|
Recommended action |
Use the undo group group-address source source-address command to delete unused multicast tunnels to release multicast tunnel resources. |
MFIB_OIF_NOT_SUPPORT
|
Message text |
Failed to add oif to entry ([[STRING], [STRING]) because some oifs are not supported. |
|
Variable fields |
$1: Multicast source address. $2: Multicast group address. |
|
Severity level |
4 |
|
Example |
MFIB/4/MFIB_OIF_NOT_SUPPORT: Failed to add oif to entry (1.1.1.1, 225.0.0.1) because some oifs are not supported. |
|
Explanation |
The system failed to add a type of outgoing interfaces to a multicast entry because the hardware does not support adding the type of outgoing interfaces. |
|
Recommended action |
Verify that outgoing interfaces of the entry on the slot where this message occurs are not configured with the following commands: · igmp static-group group-address [ source source-address ] { dot1q vid vlan-list | dot1q vid vlan-id second-dot1q vlan-list } · igmp user-vlan-aggregation dot1q vid vlan-id [ second-dot1q vlan-id ] · mld static-group ipv6-group-address [ source ipv6-source-address ] { dot1q vid vlan-list | dot1q vid vlan-id second-dot1q vlan-list } · mld user-vlan-aggregation dot1q vid vlan-id [ second-dot1q vlan-id ] Remove the configuration if any of these commands is configured. |
MGROUP messages
This section contains mirroring group messages.
MGROUP_APPLY_SAMPLER_FAIL
|
Message text |
Failed to apply the sampler for mirroring group [UINT16], because the sampler resources are insufficient. |
|
Variable fields |
$1: Mirroring group ID. |
|
Severity level |
3 |
|
Example |
MGROUP/3/MGROUP_APPLY_SAMPLER_FAIL: Failed to apply the sampler for mirroring group 1, because the sampler resources are insufficient. |
|
Explanation |
A sampler was not applied to the mirroring group because the sampler resources were insufficient. |
|
Recommended action |
No action is required. |
MGROUP_RESTORE_CPUCFG_FAIL
|
Message text |
Failed to restore configuration for mirroring CPU of [STRING] in mirroring group [UINT16], because [STRING] |
|
Variable fields |
$1: Slot number. $2: Mirroring group ID. $3: Failure reason. |
|
Severity level |
3 |
|
Example |
MGROUP/3/MGROUP_RESTORE_CPUCFG_FAIL: Failed to restore configuration for mirroring CPU of chassis 1 slot 2 in mirroring group 1, because the type of the monitor port in the mirroring group is not supported. |
|
Explanation |
When the CPU of the card in the slot is the source CPU in the mirroring group, configuration changes after the card is removed. When the card is reinstalled into the slot, restoring the source CPU configuration might fail. |
|
Recommended action |
Check for the failure reason. If the reason is that the system does not support the changed configuration, delete the unsupported configuration, and reconfigure the source CPU in the mirroring group. |
MGROUP_RESTORE_IFCFG_FAIL
|
Failed to restore configuration for interface [STRING] in mirroring group [UINT16], because [STRING] |
|
|
Variable fields |
$1: Interface name. $2: Mirroring group ID. $3: Failure reason. |
|
Severity level |
3 |
|
Example |
MGROUP/3/MGROUP_RESTORE_IFCFG_FAIL: Failed to restore configuration for interface Ethernet3/1/2 in mirroring group 1, because the type of the monitor port in the mirroring group is not supported. |
|
Explanation |
When the interface of the card in the slot is the monitor port in the mirroring group, configuration changes after the card is removed. When the card is reinstalled into the slot, restoring the monitor port configuration might fail. |
|
Recommended action |
Check for the failure reason. If the reason is that the system does not support the changed configuration, delete the unsupported configuration, and reconfigure the monitor port in the mirroring group. |
MGROUP_SYNC_CFG_FAIL
|
Message text |
Failed to restore configuration for mirroring group [UINT16] in [STRING], because [STRING] |
|
Variable fields |
$1: Mirroring group ID. $2: Slot number. $3: Failure reason. |
|
Severity level |
3 |
|
Example |
MGROUP/3/MGROUP_SYNC_CFG_FAIL: Failed to restore configuration for mirroring group 1 in chassis 1 slot 2, because monitor resources are insufficient. |
|
Explanation |
When the complete mirroring group configuration was synchronized on the card in the slot, restoring configuration failed because resources on the card were insufficient. |
|
Recommended action |
Delete the mirroring group. |
MPLS messages
This section contains MPLS messages.
LABEL_NORES
|
Message text |
No enough resource |
|
Variable fields |
N/A |
|
Severity level |
3 (Error) |
|
Example |
MPLS/3/LABEL_NORES: -MDC=1-Slot=4; No enough resource |
|
Impact |
The VPN service or tunnel cannot be set up. |
|
Cause |
Hardware resources were insufficient for completing an operation. For example, when the tunnel label resources are insufficient, the system cannot create an MPLS tunnel. |
|
Recommended action |
1. Execute the display resource-monitor command to view the mpls_label resource occupation information. 2. Delete unused MPLS tunnels. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
TNL_TBORPROFILE_NORES
|
Message text |
Hardware resources not enough. The rate limits set by QoS rate limit or MPLS TE traffic policing for [STRING] do not take effect. |
|
Variable fields |
$1: Name of MPLS TE tunnel. |
|
Severity level |
4 (Warning) |
|
Example |
MPLS/4/TNL_TBORPROFILE_NORES: -MDC=1-Slot=5; Hardware resources not enough. The rate limits set by QoS rate limit or MPLS TE traffic policing for Tunnel256 do not take effect. |
|
Impact |
The rate limit function cannot take effect on the TE tunnels on the card. |
|
Cause |
Hardware resources were insufficient for completing an operation. For example, when the Tbindex or Profile resources are insufficient on a card, rate limit settings cannot take effect on the TE tunnels on the card. |
|
Recommended action |
1. Execute the display resource-monitor command to view the mpls_tecar_profile_x (x represents the chip number) resource occupation information. 2. Delete the rate limit commands for unused MPLS tunnels. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
P2MPTE_TUNNEL_NORES
|
Message text |
Not enough hardware resources for P2MP-TE tunnel. |
|
Variable fields |
N/A |
|
Severity level |
2 (Critical) |
|
Example |
MPLS/2/P2MPTE_TUNNEL_NORES: -MDC=1-Slot=5; Not enough hardware resources for P2MP-TE tunnel. |
|
Impact |
The P2MP TE tunnel cannot be established. |
|
Cause |
Hardware resources were insufficient for completing an operation. For example, when the tunnel resources are insufficient, the system cannot create an MPLS tunnel. |
|
Recommended action |
1. Execute the display resource-monitor command to view the ipmc resource occupation information. 2. Delete the unused P2MP TE tunnels. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
OUTLIF_NORES
|
Message text |
Not enough outlif resource. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
MPLS/4/OUTLIF_NORES: -MDC=1-Slot=5; Not enough outlif resource. |
|
Impact |
The public tunnel cannot forward traffic. |
|
Cause |
Hardware resources were insufficient for completing an operation. For example, when the outlif resources are insufficient on a card, MPLS tunnels on the card cannot forward traffic. |
|
Recommended action |
1. Execute the display resource-monitor command to view the mpls_outlif resource occupation information. 2. Delete the unused MPLS tunnels or L2VPN services. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
REMOTEMAC_NORES
|
Message text |
Not enough remoteMac resource. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
MPLS/4/REMOTEMAC_NORES: -MDC=1-Slot=5; Not enough remoteMac resource. |
|
Impact |
The related FRR function is unavailable. |
|
Cause |
Hardware resources were insufficient for completing an operation. For example, when the remoteMac resources are insufficient, FRR does not take effect. |
|
Recommended action |
1. Execute the display hardware internal indexq all slot command to view the RemoteMac resource occupation information. 2. Delete the unused public tunnels or L2VPN services. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
CFDORACSTAT_NORES
|
Message text |
No enough resource. |
|
Variable fields |
N/A |
|
Severity level |
3 (Error) |
|
Example |
VPLS/3/CFDORACSTAT_NORES: -MDC=1-Slot=2; No enough resource. |
|
Impact |
The VPLS-based CFD function or AC statistics function cannot take effect. |
|
Cause |
Hardware resources were insufficient for enabling CFD or packet statistics on the AC. In this case, packet forwarding is normal but packet statistics is disabled. |
|
Recommended action |
1. Delete the statistics commands for unused ACs. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
CFDORACSTAT_CONFLICTS_INTF
|
Message text |
Operation conflicts with the configuration on this interface. |
|
Variable fields |
N/A |
|
Severity level |
3 (Error) |
|
Example |
VPLS/3/CFDORACSTAT_CONFLICTS_INTF: -MDC=1-Slot=5; Operation conflicts with the configuration on this interface. |
|
Impact |
The configuration cannot be deployed to the interface. |
|
Cause |
This message is sent if you enable CFD or packet statistics for an AC (interface) where subinterface statistics is configured. |
|
Recommended action |
1. Delete the statistics command for the subinterface that acts as the AC. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
CFDORAC_STAT_NORES
|
Message text |
No enough resource. |
|
Variable fields |
N/A |
|
Severity level |
3 (Error) |
|
Example |
VLL/3/CFDORAC_STAT_NORES: -MDC=1-Slot=2; No enough resource. |
|
Impact |
The VPWS-based CFD function or AC statistics function cannot take effect. |
|
Cause |
Hardware resources were insufficient for enabling packet statistics on the AC. In this case, packet forwarding is normal but packet statistics is disabled. |
|
Recommended action |
1. Delete the statistics commands for unused ACs. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
CFDORAC_CONFLICTS_INTFSTAT
|
Message text |
Operation conflicts with the configuration on this interface. |
|
Variable fields |
N/A |
|
Severity level |
3 (Error) |
|
Example |
VLL/3/CFDORAC_CONFLICTS_INTFSTAT: -MDC=1-Slot=5; Operation conflicts with the configuration on this interface. |
|
Impact |
The configuration cannot be deployed to the interface. |
|
Cause |
This message is sent if you enable CFD or packet statistics for an AC (interface) where subinterface statistics is configured. |
|
Recommended action |
1. Delete the statistics command for the subinterface that acts as the AC. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
NDSUPR_DUALFORWARD_NOTSPT
|
Message text |
In standard mode, the card does not support vpws nd suppression or dual-forward. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
VLL/4/NDSUPR_DUALFORWARD_NOTSPT: -MDC=1-Slot=5; In standard mode, the card does not support vpws nd suppression or dual-forward. |
|
Impact |
ND suppression or dual-forward for VPWS cannot take effect. |
|
Cause |
In standard mode, the card does not support ND suppression or dual-forward for VPWS. |
|
Recommended action |
1. Change the system operating mode to SDN-WAN. The mode change requires a system reboot. Supported features in different system operating modes are different. Use caution when you change the system operating mode. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
ARPSUPR_DUALFORWARD_NOTSPT
|
Message text |
In standard mode, the card does not support vpws arp suppression or dual-forward. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
VLL/4/ARPSUPR_DUALFORWARD_NOTSPT: -MDC=1-Slot=5; In standard mode, the card does not support vpws arp suppression or dual-forward. |
|
Impact |
ARP suppression or dual-forward for VPWS cannot take effect. |
|
Cause |
In standard mode, the card does not support ARP suppression or dual-forward for VPWS. |
|
Recommended action |
1. Change the system operating mode to SDN-WAN. The mode change requires a system reboot. Supported features in different system operating modes are different. Use caution when you change the system operating mode. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
DOUBLEBYPASS_NOTSPT
|
Message text |
In standard mode, the card does not support vpws double bypass. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
VLL/4/DOUBLEBYPASS_NOTSPT: -MDC=1-Slot=5; In standard mode, the card does not support vpws double bypass. |
|
Impact |
Dual bypass PWs for VPWS cannot take effect. |
|
Cause |
In standard mode, the card does not support dual bypass PWs for VPWS. |
|
Recommended action |
1. Change the system operating mode to SDN-WAN. The mode change requires a system reboot. Supported features in different system operating modes are different. Use caution when you change the system operating mode. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
EVPN_MULTIHOME_NOTSPT
|
Message text |
In standard mode, the card does not support evpn vpws multihoming. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
VLL/4/EVPN_MULTIHOME_NOTSPT: -MDC=1-Slot=5; In standard mode, the card does not support evpn vpws multihoming. |
|
Impact |
EVPN VPWS dual homing cannot take effect |
|
Cause |
In standard mode, the card does not support EVPN VPWS dual homing. |
|
Recommended action |
1. Change the system operating mode to SDN-WAN. The mode change requires a system reboot. Supported features in different system operating modes are different. Use caution when you change the system operating mode. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
AC_REACH_MAXNUM
|
Message text |
The number of ACs or PWs or VXLAN TUNNELs in the VSI has reached the limit. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
VPLS/4/AC_REACH_MAXNUM: -MDC=1; The number of ACs or PWs or VXLAN TUNNELs in the VSI has reached the limit. |
|
Impact |
No new AC, PW, or VXLAN tunnel can be created. |
|
Cause |
This message is sent when the number of ACs, PWs, or VXLAN tunnels configured in a VSI exceeds the maximum allowed. |
|
Recommended action |
1. Execute the display l2vpn vsi name verbose command to view the number and state of the ACs, PWs, or VXLAN tunnels in the VSI. 2. Remove the associations between unused ACs and the VSI. 3. Delete unused PWs or VXLAN tunnels. 4. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
PW_REACH_MAXNUM
|
Message text |
Pattern 1: The number of ACs or PWs in the VSI has reached the limit. Pattern 2: The number of PWs or VXLAN TUNNELs in the VSI has reached the limit. Pattern 3: The number of ACs or PWs or VXLAN TUNNELs in the VSI has reached the limit. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
VPLS/4/PW_REACH_MAXNUM: -MDC=1; The number of ACs or PWs in the VSI has reached the limit. |
|
Impact |
No new AC, PW, or VXLAN tunnel can be created. |
|
Cause |
This message is sent when the number of ACs, PWs, or VXLAN tunnels configured in a VSI exceeds the maximum allowed. |
|
Recommended action |
1. Execute the display l2vpn vsi name verbose command to view the number and state of the ACs, PWs, or VXLAN tunnels in the VSI. 2. Remove the associations between unused ACs and the VSI. 3. Delete unused PWs or VXLAN tunnels. 4. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
EVPNORSRV6_NOTSPT
|
Message text |
In standard mode, the card does not support evpn vpls or srv6. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
VPLS/4/EVPNORSRV6_NOTSPT: -MDC=1-Slot=5; In standard mode, the card does not support evpn vpls or srv6. |
|
Impact |
EVPN VPLS and EVPN VPLS over SRv6 functions cannot take effect. |
|
Cause |
In standard mode, the card does not support EVPN VPLS or EVPN VPLS over SRv6. |
|
Recommended action |
1. Change the system operating mode to SDN-WAN. The mode change requires a system reboot. Supported features in different system operating modes are different. Use caution when you change the system operating mode. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
ARPSUP_NOTSPT
|
Message text |
In standard mode, the card does not support vpls arp suppression. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
VPLS/4/ARPSUP_NOTSPT: -MDC=1-Slot=5; In standard mode, the card does not support vpls arp suppression. |
|
Impact |
VPLS ARP suppression cannot take effect. |
|
Cause |
In standard mode, the card does not support VPLS ARP suppression. |
|
Recommended action |
1. Change the system operating mode to SDN-WAN. The mode change requires a system reboot. Supported features in different system operating modes are different. Use caution when you change the system operating mode. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
ONEHUB_SUPPORT
|
Message text |
The device supports only one HUB. |
|
Variable fields |
N/A |
|
Severity level |
3 (Error) |
|
Example |
VPLS/3/ONEHUB_SUPPORT: -MDC=1-Slot=5; The device supports only one HUB. |
|
Impact |
Excessive hubs cannot be deployed. |
|
Cause |
In a hub-spoke network, each VPLS instance supports only one hub. |
|
Recommended action |
1. Make sure a VPLS instance has only one hub configured. To bind a new hub, delete the existing hub if it is unused. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
LEAFSTAT_NORES
|
Message text |
No enough leaf stat index resource. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
VPLS/4/LEAFSTAT_NORES: -MDC=1-Slot=4; No enough leaf stat index resource. |
|
Impact |
The E-tree function cannot take effect. |
|
Cause |
Hardware resources on the card were insufficient for completing an operation. For example, when the leaf statistics counter resources for PWs are insufficient, the leaf statistics feature does not take effect for PWs on the card. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
PRIVATESID_NORES
|
Message text |
Not enough Private-SID resources. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
MPLS/4/PRIVATESID_NORES: -MDC=1-Slot=4; Not enough Private-SID resources. |
|
Impact |
SRv6 service features cannot take effect. |
|
Cause |
Hardware resources were insufficient for completing an operation. For example, when the private-SID resources on a card are insufficient, the card cannot use the EVPN VPWS/VPLS over SRv6 service or the MPLS/EVPN L3VPN over SRv6 service. |
|
Recommended action |
1. Execute the display hardware internal indexq all slot command to view the Srv6PrvtSid resource occupation information. 2. Delete the unused VPWS over SRv6, VPLS over SRv6, and L3VPN over SRv6 configuration. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
DT2_NORES
|
Message text |
Not enough DT2 resources. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
MPLS/4/DT2_NORES: -MDC=1-Slot=4; Not enough DT2 resources. |
|
Impact |
SRv6 service features cannot take effect. |
|
Cause |
Hardware resources were insufficient for completing an operation. For example, when the DT2 resources on a card are insufficient, the card cannot use the EVPN VPWS/VPLS over SRv6 service. |
|
Recommended action |
1. Execute the display hardware internal indexq all slot command to view the Srv6PrvtSid resource occupation information. 2. Delete the unused VPWS over SRv6 or VPLS over SRv6 configuration. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
SRV6_POLICYSTAT_NORES
|
Message text |
Not enough resources for SRv6-TE policy statistics. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
MPLS/4/SRV6_POLICYSTAT_NORES: -MDC=1-Slot=2; Not enough resources for SRv6-TE policy statistics. |
|
Impact |
The SRv6-TE policy statistics feature cannot take effect. |
|
Cause |
Statistical resources were insufficient for completing an operation. For example, when the SRv6-TE policy statistical resources on a card are insufficient, the card cannot collect SRv6-TE policy statistics but it can use the SRv6 tunnel. |
|
Recommended action |
1. Execute the display hardware internal indexq all slot command to view the Srv6 OutStatIdx resource occupation information. 2. Delete unused SRv6 TE policies. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
SRV6_TNLINLIF_NORES
|
Message text |
Not enough tunnel INLIF resources. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
MPLS/4/SRV6_TNLINLIF_NORES: -MDC=1-Slot=2; Not enough tunnel INLIF resources. |
|
Impact |
The SRv6 tunnel feature no longer takes effect. |
|
Cause |
Hardware resources were insufficient for completing an operation. For example, when the tunnel INLIF resources on a card are insufficient, the card cannot create an SRv6 tunnel. |
|
Recommended action |
1. Execute the display hardware internal indexq all slot command to view the Mpls Srv6TnlInlif resource occupation information. 2. Delete unused SRv6 TE policies. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
SRV6_SEGMENTLIST_EXCEEDED
|
Message text |
A segment list in the SRv6 TE policy for forwarding entry ID [INT32]] exceeded the upper limit of the card. |
|
Variable fields |
$1: SRv6 forwarding entry ID. |
|
Severity level |
4 (Warning) |
|
Example |
MPLS/4/SRV6_SEGMENTLIST_EXCEEDED: A segment list in the SRv6 TE policy for forwarding entry ID 2149580802 exceeded the upper limit of the card. |
|
Impact |
Traffic cannot be forwarded through the tunnel that corresponds to the SID list in the SRv6 TE policy. |
|
Cause |
The number of nodes added to the SID list by using the index command has reached the maximum capacity of the card. |
|
Recommended action |
1. Examine the SID configuration for unused SID nodes and settings that can be optimized: ¡ Execute the display segment-routing ipv6 forwarding command to view SRv6 forwarding information, and locate the SID list based on the SRv6 forwarding entry ID in the log entry. ¡ Evaluate each SID node in the SID list to identify the nodes that can be removed or optimized. 2. Remove unused SID nodes and optimize the SID configuration for higher resource use efficiency: ¡ Execute the undo index command in SID list view to remove unused nodes. ¡ Optimize the SID configuration. 3. Replan and verify the path configuration: ¡ Optimize the SID path configuration based on the network topology. Make sure the optimization can meet the business requirements. ¡ Verify that the modified configuration can deliver the expected performance. |
SRV6_SRLIST_NORES
|
Message text |
Not enough IPv6_SR_List resources. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
MPLS/4/SRV6_SRLIST_NORES: -MDC=1-Slot=2; Not enough IPv6_SR_List resources. |
|
Impact |
The SRv6 tunnel feature no longer takes effect. |
|
Cause |
Hardware resources were insufficient for completing an operation. For example, when the IPV6_SR_LIST resources on a card are insufficient, the card cannot create an SRv6 tunnel. |
|
Recommended action |
1. Execute the display hardware internal indexq all slot command to view the Mpls SrListIndex resource occupation information. 2. Delete unused SRv6 TE policies. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
SRV6_CBTSSTAT_NORES
|
Message text |
Not enough resources for SRv6-TE Policy service class-based statistics. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
MPLS/4/SRV6_CBTSSTAT_NORES: -MDC=1-Slot=2; Not enough resources for SRv6-TE Policy service class-based statistics. |
|
Impact |
CBTS-based traffic statistics for SRv6 tunnels cannot take effect. |
|
Cause |
Hardware resources were insufficient for completing an operation. For example, when the CBTS statistical resources for SRv6-TE policies on a card are insufficient, the card cannot perform CBTS-based traffic statistics for the SRv6 tunnels on the card. |
|
Recommended action |
1. Execute the display hardware internal indexq all slot command to view the Srv6 CbtsStatIdx resource occupation information. 2. Delete unused SRv6 TE policies. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
SRV6_TBORPROFILE_NORES
|
Message text |
Hardware resources are not enough. The rate limit set for the SRv6-TE policy does not take effect. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
MPLS/4/SRV6_TBORPROFILE_NORES:-MDC=1;Hardware resources are not enough. The rate limit set for the SRv6-TE policy does not take effect. |
|
Impact |
Rate limit settings cannot take effect on SRv6-TE policies. |
|
Cause |
Hardware resources were insufficient for completing an operation. For example, when the Tbindex or Profile resources on a card are insufficient, rate limit settings cannot take effect on the SRv6 policy tunnels. |
|
Recommended action |
1. Delete the rate limit commands configured for unused SRv6-TE policies. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
SRV6_NOTSPT
|
Message text |
In standard mode, the card does not support vpws srv6. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
VLL/4/SRV6_NOTSPT: -MDC=1-Slot=5; In standard mode, the card does not support vpws srv6. |
|
Impact |
The VPWS over SRv6 feature cannot take effect. |
|
Cause |
In standard mode, the card does not support VPWS over SRv6. |
|
Recommended action |
1. Change the system operating mode to SDN-WAN. The mode change requires a system reboot. Supported features in different system operating modes are different. Use caution when you change the system operating mode. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
SRV6_FAST_RES
|
Message text |
Not enough Fast_Switch resources. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
MPLS/4/FAST_SWITCH_NORES: -MDC=1-Slot=8; Not enough Fast_Switch resources. |
|
Impact |
The SRv6 TE/SRv6 BE fast switchover cannot be performed, causing packet loss in service traffic forwarding. |
|
Cause |
Hardware resources were insufficient for performing an SRv6 TE/SRv6 BE fast switchover. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
CBTSACL_NORES
|
Message text |
Not enough acl resource to add vxlan cbts acl. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
VXLAN/4/CBTSACL_NORES: -MDC=1-Slot=5; Not enough acl resource to add vxlan cbts acl. |
|
Impact |
CBTS for VXLAN packets cannot take effect. |
|
Cause |
Hardware resources were insufficient for completing an operation. For example, when the CBTS ACL resources for VXLANs on a card are insufficient, the card cannot perform CBTS for VXLAN packets. |
|
Recommended action |
1. Delete CBTS commands configured for unused VXLAN tunnels. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
SERVICECLASS_NOTSPT
|
Message text |
In standard mode, the card does not support vxlan config service class. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
VXLAN/4/SERVICECLASS_NOTSPT: -MDC=1-Slot=5; In standard mode, the card does not support vxlan config service class. |
|
Impact |
The system cannot configure service class values for VXLAN packets. |
|
Cause |
In standard mode, the card does not support configuring service class values for VXLAN packets. |
|
Recommended action |
1. Change the system operating mode to SDN-WAN. The mode change requires a system reboot. Supported features in different system operating modes are different. Use caution when you change the system operating mode. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
DSCP_NOTSPT
|
Message text |
In standard mode, the card does not support vxlan config dscp. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
VXLAN/4/DSCP_NOTSPT: -MDC=1-Slot=5; In standard mode, the card does not support vxlan config dscp. |
|
Impact |
The DSCP feature for VXLAN tunnels cannot take effect. |
|
Cause |
In standard mode, the card does not support VXLAN tunnel DSCP operations. |
|
Recommended action |
1. Change the system operating mode to SDN-WAN. The mode change requires a system reboot. Supported features in different system operating modes are different. Use caution when you change the system operating mode. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
VP_NORES
|
Message text |
Not enough VP resources. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
MPLS/4/VP_NORES: -MDC=1-Slot=4; Not enough VP resources. |
|
Impact |
VPWS over MPLS, VPLS over MPLS, and EVPN VPWS/VPLS over SRv6 services cannot take effect. |
|
Cause |
Hardware resources on the card were insufficient for completing an operation. For example, when the VP resources on a card are insufficient, the card cannot use the VPWS over MPLS/VPLS over MPLS/EVPN VPWS/VPLS over SRv6 service. |
|
Recommended action |
1. Execute the display hardware internal mpls global-var rsc vp command to view VP resource occupation information. 2. Delete the unused VPWS over MPLS, VPLS over MPLS, and EVPN VPWS/VPLS over SRv6 services configuration. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
FAST_SWITCH_NORES
|
Message text |
Not enough Fast_Switch resources |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
MPLS/4/ FAST_SWITCH_NORES: -MDC=1-Slot=2; Not enough Fast_Switch resources. |
|
Impact |
Service packet loss might occur. |
|
Cause |
Fast switchover resources on the card were insufficient for completing an operation. For example, when the fast switchover resources on a card are insufficient, the fast switchover feature loses effect but the SRv6 tunnel can be used normally. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
L3VPN_STAT_NOTSPT
|
Message text |
Interface [STRING] bound to the VPN instance not support traffic-statistics enable command |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 (Warning) |
|
Example |
L3VPN/4/L3VPN_STAT_NOTSPT: Interface VE-L3VPN1 bound to the VPN instance not support traffic-statistics enable command. |
|
Impact |
VPN traffic statistics does not take effect on this interface. |
|
Cause |
This interface does not support traffic statistics for VPN instances. |
|
Recommended action |
Bind the VPN instance to an interface that supports VPN traffic statistics. |
PWRESTRAIN_NORES
|
Message text |
Not enough pw restrain resource. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
VPLS/4/PWRESTRAIN_NORES: Not enough pw restrain resource. |
|
Impact |
The rate limiting feature does not take effect on the VPLS PW. |
|
Cause |
Resources for PW rate limiting were insufficient. |
|
Recommended action |
Cancel PW rate limiting for some VPLS services or reduce the VPLS services configured with PW rate limiting to release rate limiting resources. |
MPLS messages
This section contains MPLS messages.
MPLS_HARD_RESOURCE_NOENOUGH
|
Message text |
No enough hardware resource for MPLS. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
MPLS/4/MPLS_HARD_RESOURCE_NOENOUGH: No enough hardware resource for MPLS. |
|
Explanation |
Hardware resources for MPLS were insufficient. |
|
Recommended action |
Check whether unnecessary LSPs had been generated. If yes, configure or modify the LSP generation policy, label advertisement policy, and label acceptance policy to filter out unnecessary LSPs. |
MPLS_HARD_RESOURCE_RESTORE
|
Message text |
Hardware resources for MPLS are restored. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
MPLS/6/MPLS_HARD_RESOURCE_RESTORE: Hardware resources for MPLS are restored. |
|
Explanation |
Hardware resources for MPLS were restored. |
|
Recommended action |
No action is required. |
MSDP messages
This section contains MSDP messages.
MSDP_PEER_START
|
Message text |
Started a session with peer [STRING]. |
|
Variable fields |
$1: IP address of an MSDP peer. |
|
Severity level |
5 |
|
Example |
MSDP/5/MSDP_PEER_START: Started a session with peer 192.168.0.1. |
|
Explanation |
The device established an MSDP session with a peer. |
|
Recommended action |
No action is required. |
MSDP_PEER_START
|
Message text |
NSR start a session with peer [STRING]. |
|
Variable fields |
$1: IP address of an MSDP peer. |
|
Severity level |
5 |
|
Example |
MSDP/5/MSDP_PEER_START: NSR started a session with peer 192.168.0.1. |
|
Explanation |
NSR recovered the MSDP session between the device and a peer. |
|
Recommended action |
No action is required. |
MSDP_PEER_CLOSE
|
Message text |
Stopped a session with peer [STRING]. |
|
Variable fields |
$1: IP address of an MSDP peer. |
|
Severity level |
5 |
|
Example |
MSDP/5/MSDP_PEER_CLOSE: Stopped a session with peer 192.168.0.1. |
|
Explanation |
The device terminated the MSDP session with a peer. |
|
Recommended action |
Verify that MSDP is configured correctly and the network connection is normal. |
MSDP_SA_LIMIT
|
Message text |
SA from peer [STRING] for ([STRING], [STRING]) exceeded sa-limit of [ULONG]. |
|
Variable fields |
$1: IP address of an MSDP peer. $2: Multicast source address in an SA message. $3: Multicast group address in an SA message. $4: Maximum number of (S, A) entries allowed to be cached for the MSDP peer. |
|
Severity level |
5 |
|
Example |
MSDP/5/MSDP_SA_LIMIT: SA from peer 192.168.0.1 for (1.1.1.1, 225.0.0.1) exceeded sa-limit of 1000. |
|
Explanation |
The maximum number of (S, A) entries allowed to be cached for the MSDP peer already reached. |
|
Recommended action |
Set the maximum number of (S, A) entries allowed to be cached for the MSDP peer to an appropriate value. |
MTLK messages
This section contains Monitor Link messages.
MTLK_UPLINK_STATUS_CHANGE
|
Message text |
The uplink of monitor link group [UINT32] is [STRING]. |
|
Variable fields |
$1: Monitor link group ID. $2: Monitor Link group status, up or down. |
|
Severity level |
6 |
|
Example |
MTLK/6/MTLK_UPLINK_STATUS_CHANGE: The uplink of monitor link group 1 is up. |
|
Explanation |
The uplink of a monitor link group went up or down. |
|
Recommended action |
Troubleshoot the uplink when it fails. |
MTP messages
This section contains MTP messages.
MTP_PING_INFO
|
Message text |
Ping information, (Base: [STRING]), (Result: [STRING]). |
|
Variable fields |
$1: Basic information about the ping operation, including time, destination IP address, VRF index, protocol module information (module name and instance name), and the number of sent ping packets. The instance name in the protocol module information can be empty. $2: Result of the ping operation, including the number of successfully sent ping packets and ping packet result information. The ping packet result information includes the ping packet length, sequence, and result. |
|
Severity level |
6 |
|
Example |
MTP/6/MTP_PING_INFO: Ping information, (Base: Time = 09:39:18, Destination IP = 10.11.1.1, VrfIndex = 0, Protocol Module = BGP (default), Packet Number = 9), (Result: Success = 9, Length 100 ping 1 success, Length 100 ping 2 success, Length 100 ping 3 success, Length 1000 ping 4 success, Length 1000 ping 5 success, Length 1000 ping 6 success, Length 4000 ping 7 success, Length 4000 ping 8 success, Length 4000 ping 9 success). |
|
Explanation |
With MTP enabled, the device automatically pinged a neighbor and recorded the ping result when the neighbor's hold timer expired. |
|
Recommended action |
Troubleshoot the link according to the ping result information. |
MTP_TRACERT_INFO
|
Message text |
Tracert information, (Base: [STRING]), (Result: [STRING]). |
|
Variable fields |
$1: Basic information about the tracert operation, including time, destination IP address, VRF index, maximum number of hops allowed for a probe packet, number of probe packets to send per hop, and protocol module information (module name and instance name). The instance name in the protocol module information can be empty. $2: Result of the tracert operation, including the IP address of each hop, number of the AS that each hop belongs to (optional), and the number of probe successes. If a hop does not respond, no result will be displayed for the hop. |
|
Severity level |
6 |
|
Example |
MTP/6/MTP_TRACERT_INFO: Tracert information, (Base: Time = 10:39:18, Destination IP = 10.11.1.1, VrfIndex = 0, MaxHop = 30, Packet Number = 3, Protocol Module = BGP (default)), (Result: TTL 1 Response IP = 10.2.1.1 Success = 3, TTL 2 Response IP = 10.11.1.1 [ AS 100 ] Success = 3). |
|
Explanation |
With MTP enabled, the device automatically traced the route to the neighbor and recorded the tracert result when the neighbor's hold timer expired. |
|
Recommended action |
Troubleshoot the link according to the tracert result information. |
NAT messages
This section contains NAT messages.
NAT_AGENCY_ALG_FAILED
|
Message text |
Failed to enable ALG for the user over Ethernet agency module, because not enough ACL resources are available. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
NAT/4/NAT_AGENCY_ALG_FAILED: Failed to enable ALG for the user over Ethernet agency module, because not enough hardware ACL resources are available. |
|
Explanation |
This message is sent when you fail to enable ALG for the user over Ethernet agency module because not enough ACL resources are available. |
|
Recommended action |
Check the hardware ACL resources by using the display qos-acl resource command. · If the resources are not enough, delete unnecessary ACL configuration. · If the resources are enough, contact H3C Support. |
NAT_ADDR_BIND_CONFLICT
|
Message text |
Failed to activate NAT configuration on interface [STRING], because global IP addresses already bound to another service card. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
NAT/4/NAT_ADDR_BIND_CONFLICT: Failed to activate NAT configuration on interface GigabitEthernet1/0/1, because global IP addresses already bound to another service card. |
|
Explanation |
The NAT configuration did not take effect, because the global IP addresses that the interface references have been bound to another service card. |
|
Recommended action |
If multiple interfaces reference the same global IP addresses, you must specify the same service card to process NAT traffic passing through these interfaces. To resolve the problem: 1. Use the display nat all command to check the current configuration. 2. Remove the service card configuration on the interface. 3. Specify the same service card for interfaces referencing the same global IP addresses. |
NAT_BANDWIDTH_EXCEED
|
Message text |
Bandwidth usage of the CGN card reached [UINT32]%. |
|
Variable fields |
$1: Bandwidth usage threshold. |
|
Severity level |
4 |
|
Example |
NAT/4/NAT_BANDWIDTH_EXCEED: Bandwidth usage of the CGN card reached 90%. |
|
Explanation |
This message is sent when the bandwidth usage of the CGN card reaches the threshold. |
|
Recommended action |
No action is required. |
NAT_BANDWIDTH_RECOVERY
|
Message text |
Bandwidth usage of the CGN card dropped below alarm threshold([UINT32]%). |
|
Variable fields |
$1: Bandwidth usage threshold. |
|
Severity level |
5 |
|
Example |
NAT/5/NAT_BANDWIDTH_RECOVERY: Bandwidth usage of the CGN card dropped below alarm threshold(90%). |
|
Explanation |
This message is sent when the bandwidth usage of the CGN card drops below the threshold. |
|
Recommended action |
No action is required. |
NAT_EIM
|
Message text |
Protocol(1001)=[STRING];LocalIPAddr(1003)=[IPADDR];LocalPort(1004)=[UINT16];GlobalIPAddr(1005)=[IPADDR];GlobalPort(1006)=[UINT16];RcvVPNInstance(1042)=[STRING];SndVPNInstance(1043)=[STRING];RcvDSLiteTunnelPeer(1040)=[STRING];BeginTime_e(1013)=[STRING];EndTime_e(1014)=[STRING];Event(1048)=([UNIT16])[STRING]; |
|
Variable fields |
$1: Protocol type. $2: Source IP address. $3: Source port number. $4: Source IP address after translation. $5: Source port number after translation. $6: Source VPN instance name. $7: Destination VPN instance name. $8: Source DS-Lite tunnel. $9: Time when the EIM entry was created. $10: Time when the EIM entry was removed. $11: Event type. Available values are 2, 3, and 8. $11: Event description: ¡ NAT EIM entry created: The value for the event type field is 8. ¡ Aged for timeout: The value for the event type field is 2. ¡ Aged for reset or config-change: The value for the event type field is 3. |
|
Severity level |
6 |
|
Example |
NAT/6/NAT_EIM: -Protocol(1001)=UDP;LocalIPAddr(1003)=1.1.1.2;LocalPort(1004)=1024;GlobalIPAddr(1005)=30.3.1.231;GlobalPort(1006)=1026;RcvVPNInstance(1042)=;SndVPNInstance(1043)=;RcvDSLiteTunnelPeer(1040)=;BeginTime_e(1013)=10261971001739;EndTime_e(1014)=;Event(1048)=(8)NAT EIM entry created; |
|
Explanation |
This message is sent when a NAT EIM entry is created or removed. |
|
Recommended action |
No action is required. |
NAT_EIM_MODE_PORT_USAGE_ALARM
|
Message text |
Ratio of assigned port count to the specified [STRING] is [STRING]%, reaching the port usage threshold. Protocol=[STRING]; OrigSrcIP=[IPADDR]; VPNInstance=[STRING]; NATIP=[IPADDR]; ConnectCount=[UINT16]. |
|
Variable fields |
$1: Usage type for the alarm. ¡ port-limit: Maximum number of ports that can be assigned to a protocol. This value is set by the port-limit command. ¡ block-size: Port block size. $2: Percentage. $3: Protocol type. ¡ UDP: UDP protocol. ¡ TCP: TCP protocol. ¡ ICMP: ICMP protocol. ¡ TOTAL: All protocols. $4: Source IP address. $5: Source VPN instance name. $6: Source IP address after translation, which is the public IP address corresponding to the non-extended port block. $7: Numbers of connections. |
|
Severity level |
4 |
|
Example |
NAT/4/NAT_EIM_MODE_PORT_USAGE_ALARM: Ratio of assigned port count to the specified port-limit is 40%, reaching the port usage threshold. Protocol=UDP; OrigSrcIP=1.1.1.211; VPNInstance=-; NATIP=198.1.1.16; ConnectCount=40. |
|
Explanation |
This message is sent in the following conditions: · The port usage assigned to a protocol in a port block or the resource usage in the port block equals or exceeds the threshold set by the nat log port-block port-usage threshold command. · The Endpoint-Independent Mapping mode is applied. |
|
Recommended action |
Increase the resources in the port block or limit the number of connections. |
NAT_EIM_MODE_PORT_USAGE_RECOVER
|
Message text |
The ratio of assigned ports to the specified [STRING] is [UINT32]%, recovering from a usage threshold alarm. Protocol=[STRING]; OrigSrcIP=[IPADDR]; VPNInstance=[STRING]; NATIP=[IPADDR]; ConnectCount=[UINT16]. |
|
Variable fields |
$1: Usage type for the alarm. ¡ port-limit: Maximum number of ports that can be assigned to a protocol. This value is set by the port-limit command. ¡ block-size: Port block size. $2: Percentage. $3: Protocol type. ¡ UDP: UDP protocol. ¡ TCP: TCP protocol. ¡ ICMP: ICMP protocol. ¡ TOTAL: All protocols. $4: Source IP address. $5: Source VPN instance name. $6: Source IP address after translation, which is the public IP address corresponding to the non-extended port block. $7: Numbers of connections. |
|
Severity level |
5 |
|
Example |
NAT/5/NAT_EIM_MODE_PORT_USAGE_RECOVER: The ratio of assigned ports to the specified port-limit is 40%, recovering from a usage threshold alarm. Protocol=UDP; OrigSrcIP=1.1.1.211; VPNInstance=-; NATIP=16.1.1.198; ConnectCount=40. |
|
Explanation |
This message is sent in the following conditions: · The port usage assigned to a protocol in a port block or the resource usage in the port block drops below 87.5% of the threshold set by the nat log port-block port-usage threshold command. · The Endpoint-Independent Mapping mode is applied. |
|
Recommended action |
No action is required. |
NAT_EIM_PORT_EXHAUST_ALARM
|
Message text |
Port allocation failed due to [STRING], Protocol=[STRING]; OrigSrcIP=[IPADDR]; VPNInstance=[STRING]; NATIP=[IPADDR]. |
|
Variable fields |
$1: Usage type for the alarm. ¡ port limit setting: Maximum number of ports that can be assigned to a protocol. This value is set by the port-limit command. ¡ port usage threshold violation: Port block size. $2: Protocol type. ¡ UDP: UDP protocol. ¡ TCP: TCP protocol. ¡ ICMP: ICMP protocol. ¡ TOTAL: All protocols. $3: Source IP address. $4: Source VPN instance name. $5: Source IP address after translation, which is the public IP address corresponding to the non-extended port block. |
|
Severity level |
4 |
|
Example |
NAT/4/NAT_EIM_PORT_EXHAUST_ALARM: Port allocation failed due to port limit setting, Protocol=UDP; OrigSrcIP=1.1.1.211; VPNInstance=-; NATIP=16.1.1.198. |
|
Explanation |
This message is sent in the following conditions: · The public port resources are used up. · The Endpoint-Independent Mapping mode is applied. |
|
Recommended action |
No action is required. |
NAT_EIM_PORT_EXHAUST_RECOVER
|
Message text |
Recovered from port allocation failure due to [STRING], Protocol=[STRING]; OrigSrcIP=[IPADDR]; VPNInstance=[STRING]; NATIP=[IPADDR]. |
|
Variable fields |
$1: Usage type for the alarm. ¡ port limit setting: Maximum number of ports that can be assigned to a protocol. This value is set by the port-limit command. ¡ port usage threshold violation: Port block size. $2: Protocol type. ¡ UDP: UDP protocol. ¡ TCP: TCP protocol. ¡ ICMP: ICMP protocol. ¡ TOTAL: All protocols. $3: Source IP address. $4: Source VPN instance name. $5: Source IP address after translation, which is the public IP address corresponding to the non-extended port block. |
|
Severity level |
5 |
|
Example |
NAT/5/NAT_EIM_PORT_EXHAUST_RECOVER: Recovered from port allocation failure due to port limit setting, Protocol=UDP; OrigSrcIP=1.1.1.211; VPNInstance=-; NATIP=16.1.1.198. |
|
Explanation |
This message is sent in the following conditions: · The public port usage drops below 87.5%. · The Endpoint-Independent Mapping mode is applied. |
|
Recommended action |
No action is required. |
NAT_FAILED_ADD_FLOW_RULE
|
Message text |
Failed to add flow-table due to: [STRING]. |
|
Variable fields |
$1: Reason for the failure. |
|
Severity level |
4 |
|
Example |
NAT/4/NAT_FAILED_ADD_FLOW_RULE: Failed to add flow-table due to: Not enough resources are available to complete the operation. |
|
Explanation |
The system failed to deploy flow entries. Possible reasons include insufficient hardware resources or memory. |
|
Recommended action |
Contact H3C Support. |
NAT_FAILED_ADD_FLOW_TABLE
|
Message text |
Failed to add flow-table due to [STRING]. |
|
Variable fields |
$1: Failure reason: · no enough resource. · The item already exists. |
|
Severity level |
4 |
|
Example |
NAT/4/NAT_FAILED_ADD_FLOW_TABLE: Failed to add flow-table due to no enough resource. |
|
Explanation |
The system failed to add a flow table due to insufficient hardware resources or NAT address overlapping. |
|
Recommended action |
If the failure is caused by insufficient hardware resources, contact H3C Support. If the failure is caused by address overlapping, reconfigure the NAT addresses. Make sure the NAT address ranges do not overlap. |
NAT_FLOW
|
Message text |
Protocol(1001)=[STRING];Application(1002)=[STRING];SrcIPAddr(1003)=[IPADDR];SrcPort(1004)=[UINT16];NATSrcIPAddr(1005)=[IPADDR];NATSrcPort(1006)=[UINT16];DstIPAddr(1007)=[IPADDR];DstPort(1008)=[UINT16];NATDstIPAddr(1009)=[IPADDR];NATDstPort(1010)=[UINT16];InitPktCount(1044)=[UINT32];InitByteCount(1046)=[UINT32];RplyPktCount(1045)=[UINT32];RplyByteCount(1047)=[UINT32];RcvVPNInstance(1042)=[STRING];SndVPNInstance(1043)=[STRING];RcvDSLiteTunnelPeer(1040)=[STRING];SndDSLiteTunnelPeer(1041)=[STRING];BeginTime_e(1013)=[STRING];EndTime_e(1014)=[STRING];Event(1048)=([UNIT16])[STRING]; |
|
Variable fields |
$1: Protocol type. $2: Application layer protocol. $3: Source IP address. $4: Source port number. $5: Source IP address after translation. $6: Source port number after translation. $7: Destination IP address. $8: Destination port number. $9: Destination IP address after translation. $10: Destination port number after translation. $11: Total number of incoming packets. $12: Total number of incoming bytes. $13: Total number of outgoing packets. $14: Total number of outgoing bytes. $15: Source VPN instance name. $16: Destination VPN instance name. $17: Source DS-Lite tunnel. $18: Destination DS-Lite tunnel. $19: Time when the session is created. $20: Time when the session is removed. $21: Event type. Available values are 1, 2, 3, 6, 8, and 254. $22: Event description: ¡ Session created: A NAT session was created. The value for the event type field is 8. ¡ Active data flow timeout: The duration of a NAT session exceeded the active data flow time. The value for the event type field is 6. ¡ Normal over: A NAT session ended and was deleted. The value for the event type field is 1. ¡ Aged for timeout: A NAT session was deleted because it aged out. The value for the event type field is 2. ¡ Aged for reset or config-change: A NAT session was deleted by configuration. The value for the event type field is 3. ¡ Other: A NAT session was deleted because of other reasons. For example, it was deleted by another module. The value for the event type field is 254. |
|
Severity level |
6 |
|
Example |
NAT/6/NAT_FLOW: Protocol(1001)=UDP;Application(1002)=other;SrcIPAddr(1003)=1.1.1.2;SrcPort(1004)=1024;NatSrcIPAddr(1005)=30.3.1.231;NatSrcPort(1006)=1026;DstIPAddr(1007)=2.1.1.2;DstPort(1008)=1024;NatDstIPAddr(1009)=2.1.1.2;NatDstPort(1010)=1024;InitPktCount(1044)=1;InitByteCount(1046)=110;RplyPktCount(1045)=0;RplyByteCount(1047)=0;RcvVPNInstance(1042)=;SndVPNInstance(1043)=;RcvDSLiteTunnelPeer(1040)=;SndDSLiteTunnelPeer(1041)=;BeginTime_e(1013)=03232017091640;EndTime_e(1014)=;Event(1048)=(8)Session created; |
|
Explanation |
This message is sent in one of the following conditions: · A NAT session is created or removed. · Regularly during a NAT session. · The traffic threshold or aging time of a NAT session is reached. |
|
Recommended action |
No action is required. |
NAT_INSTANCE_SERVER_INVALID
|
Message text |
The NAT server with Easy IP is invalid because its global settings conflict with that of another NAT server in the same instance. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
NAT/4/NAT_INSTANCE_SERVER_INVALID: The NAT server with Easy IP is invalid because its global settings conflict with that of another NAT server in the same instance. |
|
Explanation |
This message is sent when the same public network information has been configured for both the NAT server mapping with Easy IP and another NAT server mapping in the same NAT instance. |
|
Recommended action |
Modify the conflicting NAT server mapping. The mapping of the protocol type, public address, and public port number must be unique for an internal server in a NAT instance. |
NAT_IP_ADD_FAILURE_ALARM
|
Message text |
Failed to add a subnet to global address pool [PoolName] (start address [address], mask [mask]). Failure cause: [Reasonstring]. |
|
Variable fields |
$1: Address pool name. $2: Start address. $3: Mask. $4: Failure reason: ¡ The subnet overlaps with other address ranges in the global address pool. ¡ The subnet overlaps with addresses in a NAT address group. ¡ The subnet overlaps with addresses in a NAT port block group. ¡ The subnet overlaps with addresses in a NAT server. ¡ The number of addresses in the global address pool has reached the upper limit. |
|
Severity level |
4 |
|
Example |
NAT/4/NAT_IP_ADD_FAILURE_ALARM: Failed to add a subnet to global address pool pool1 (start address 192.168.1.1, mask 255.255.0.0). Failure cause: The subnet overlaps with other address ranges in the global address pool. |
|
Explanation |
This message is sent when you fail to add an address range to the global address pool. |
|
Recommended action |
No action is required. |
NAT_IP_EXHAUST_ALARM
|
Message text |
The IP addresses in NAT IP pool [STRING] ran out. |
|
Variable fields |
$1: Name of the address pool. |
|
Severity level |
4 |
|
Example |
NAT/4/NAT_IP_EXHAUST_ALARM: The IP addresses in NAT IP pool1 ran out. |
|
Explanation |
This message is sent when IP address resources in the address pool are used up. |
|
Recommended action |
No action is required. |
NAT_IP_EXHAUST_ALARM_RECOVER
|
Message text |
IP addresses in NAT IP pool [STRING] became available. |
|
Variable fields |
$1: Name of the address pool. |
|
Severity level |
5 |
|
Example |
NAT/5/NAT_IP_EXHAUST_ALARM_RECOVER: IP addresses in NAT IP pool pool1 became available. |
|
Explanation |
This message is sent when the IP usage in the address pool drops to or below 87.5%. |
|
Recommended action |
No action is required. |
NAT_IP_USAGE_ALARM
|
Message text |
NAT IP pool [STRING], total IP count [UINT16], active IP count [UINT16], exceeding the upper limit. |
|
Variable fields |
$1: Name of the address pool. $2: Total number of addresses in the pool. $3: Number of used addresses in the pool. |
|
Severity level |
4 |
|
Example |
NAT/4/NAT_IP_USAGE_ALARM: NAT IP pool 1, total IP count 100, active IP count 100, exceeding the upper limit. |
|
Explanation |
This message is sent when the IP usage in the address pool reaches or exceeds the threshold. |
|
Recommended action |
No action is required. |
NAT_IP_USAGE_ALARM_RECOVER
|
Message text |
NAT IP pool [STRING], total IP count [UINT16], active IP count [UINT16], recovering from a usage alarm. |
|
Variable fields |
$1: Name of the address pool. $2: Total number of addresses in the pool. $3: Number of used addresses in the pool. |
|
Severity level |
5 |
|
Example |
NAT/5/NAT_IP_USAGE_ALARM_RECOVER: NAT IP pool 1, total IP count 100, active IP count 87, recovering from a usage alarm. |
|
Explanation |
This message is sent when the IP usage in the address pool drops to or below 87.5% of the threshold. |
|
Recommended action |
No action is required. |
NAT_NAT444_SYSLOG
|
Message text |
All port block resources ran out in address group [STRING] id [UINT 16]. |
|
Variable fields |
$1: Address group name. $2: Address group ID. |
|
Severity level |
3 |
|
Example |
NAT/3/NAT_NAT444_SYSLOG: All port block resources ran out in address group 1 id 1. |
|
Explanation |
This message is sent when NAT444 port block resources in the address group are used up. |
|
Recommended action |
No action is required. |
NAT_NAT444_SYSLOG_RECOVER
|
Message text |
The port block resources had been restored in address group [STRING] id [UINT 16]. |
|
Variable fields |
$1: Address group name. $2: Address group ID. |
|
Severity level |
5 |
|
Example |
NAT/5/NAT_NAT444_SYSLOG_RECOVER: The port block resources had been restored in address group 1 id 1. |
|
Explanation |
This message is sent when the number of NAT444 port blocks in the address group drops below 87.5% of the total number of NAT444 port blocks. |
|
Recommended action |
No action is required. |
NAT_PAT_ALARM
|
Message text |
Address group [STRING] id [UINT16], usage reaches [UINT16]%. |
|
Variable fields |
$1: Address group name. $2: Address group ID. $3: Port block usage. |
|
Severity level |
4 |
|
Example |
NAT/4/NAT_PAT_ALARM: Address group 3 id 3, usage reaches 40%. |
|
Explanation |
This message is sent when the port block usage in PAT mode reaches or exceeds the threshold set by the nat log port-block usage threshold command. |
|
Recommended action |
No action is required. |
NAT_PAT_RECOVERY
|
Message text |
Address group [STRING] id [UINT16], usage below [UINT16]%. |
|
Variable fields |
$1: Address group name. $2: Address group ID. $3: Port block usage. |
|
Severity level |
5 |
|
Example |
NAT/5/NAT_PAT_RECOVERY: Address group 3 id 3, usage below 35%. |
|
Explanation |
This message is sent when the port block usage in PAT mode drops below 87.5% of the threshold set by the nat log port-block usage threshold command. |
|
Recommended action |
No action is required. |
NAT_PORT_EXHAUST_ALARM
|
Message text |
Port allocation failed due to [STRING], Protocol=[STRING]; OrigSrcIP=[IPADDR]; VPNInstance=[STRING]; NATIP=[IPADDR]. |
|
Variable fields |
$1: Usage type for the alarm. ¡ port limit setting: Maximum number of ports that can be assigned to a protocol. This value is set by the port-limit command. ¡ port usage threshold violation: Port usage in the port block. $2: Protocol type. ¡ UDP: UDP protocol. ¡ TCP: TCP protocol. ¡ ICMP: ICMP protocol. ¡ TOTAL: All protocols. $3: Source IP address. $4: Source VPN instance name. $5: Source IP address after translation, which is the public IP address corresponding to the non-extended port block. |
|
Severity level |
4 |
|
Example |
NAT/4/NAT_PORT_EXHAUST_ALARM: Port allocation failed due to port limit setting, Protocol=UDP; OrigSrcIP=1.1.1.211; VPNInstance=-; NATIP=16.1.1.198. |
|
Explanation |
This message is sent in the following conditions: · The public port resources are used up. · The Connection-Dependent Mapping mode is applied. |
|
Recommended action |
No action is required. |
NAT_PORT_EXHAUST_RECOVER
|
Message text |
Recovered from port allocation failure due to [STRING], Protocol=[STRING]; OrigSrcIP=[IPADDR]; VPNInstance=[STRING]; NATIP=[IPADDR]. |
|
Variable fields |
$1: Usage type for the alarm. ¡ port limit setting: Maximum number of ports that can be assigned to a protocol. This value is set by the port-limit command. ¡ port usage threshold violation: Port usage in the port block. $2: Protocol type. ¡ UDP: UDP protocol. ¡ TCP: TCP protocol. ¡ ICMP: ICMP protocol. ¡ TOTAL: All protocols. $3: Source IP address. $4: Source VPN instance name. $5: Source IP address after translation, which is the public IP address corresponding to the non-extended port block. |
|
Severity level |
5 |
|
Example |
NAT/5/NAT_PORT_EXHAUST_RECOVER: Recovered from port allocation failure due to port limit setting, Protocol=UDP; OrigSrcIP=1.1.1.211; VPNInstance=-; NATIP=16.1.1.198. |
|
Explanation |
This message is sent in the following conditions: · The public port resource usage drops below 87.5%. · The Connection-Dependent Mapping mode is applied. |
|
Recommended action |
No action is required. |
NAT_PORT_USAGE_ALARM
|
Message text |
Ratio of assigned port count to the specified [STRING] is [STRING]%, reaching the port usage threshold. Protocol=[STRING]; OrigSrcIP=[IPADDR]; VPNInstance=[STRING]; NATIP=[IPADDR]; ConnectCount=[UINT16]. |
|
Variable fields |
$1: Usage type for the alarm. ¡ port-limit: Maximum number of ports that can be assigned to a protocol. This value is set by the port-limit command. ¡ block-size: Port block size. $2: Percentage. $3: Protocol type. ¡ UDP: UDP protocol. ¡ TCP: TCP protocol. ¡ ICMP: ICMP protocol. ¡ TOTAL: All protocols. $4: Source IP address. $5: Source VPN instance name. $6: Source IP address after translation, which is the public IP address corresponding to the non-extended port block. $7: Numbers of connections. |
|
Severity level |
4 |
|
Example |
NAT/4/NAT_PORT_USAGE_ALARM: Ratio of assigned port count to the specified port-limit is 40%, reaching the port usage threshold. Protocol=UDP; OrigSrcIP=1.1.1.211; VPNInstance=-; NATIP=16.1.1.198; ConnectCount=40. |
|
Explanation |
This message is sent in the following conditions: · The port usage assigned to a protocol in a port block or the resource usage in the port block equals or exceeds the threshold set by the nat log port-block port-usage threshold command. · The Connection-Dependent Mapping mode is applied. |
|
Recommended action |
Increase the resources in the port block or limit the number of connections. |
NAT_PORT_USAGE_RECOVER
|
Message text |
The ratio of assigned ports to the specified [STRING] is [UINT32]%,recovering from a usage threshold alarm. Protocol=[STRING]; OrigSrcIP=[IPADDR]; VPNInstance=[STRING]; NATIP=[IPADDR]; ConnectCount=[UINT16]. |
|
Variable fields |
$1: Usage type for the alarm. ¡ port-limit: Maximum number of ports that can be assigned to a protocol. This value is set by the port-limit command. ¡ block-size: Port block size. $2: Percentage. $3: Protocol type. ¡ UDP: UDP protocol. ¡ TCP: TCP protocol. ¡ ICMP: ICMP protocol. ¡ TOTAL: All protocols. $4: Source IP address. $5: Source VPN instance name. $6: Source IP address after translation, which is the public IP address corresponding to the non-extended port block. $7: Numbers of connections. |
|
Severity level |
5 |
|
Example |
NAT/5/NAT_PORT_USAGE_RECOVER: The ratio of assigned ports to the specified port-limit is 40%, recovering from a usage threshold alarm. Protocol=UDP; OrigSrcIP=1.1.1.211; VPNInstance=-; NATIP=16.1.1.198; ConnectCount=40. |
|
Explanation |
This message is sent in the following conditions: · The port usage assigned to a protocol in a port block or the resource usage in the port block drops below 87.5% of the threshold set by the nat log port-block port-usage threshold command. · The Connection-Dependent Mapping mode is applied. |
|
Recommended action |
No action is required. |
NAT_PORTBLOCK_ALARM
|
Message text |
Address group [STRING] id [UINT16]; total port blocks [UINT16]; active port blocks [UINT16]; usage reaches [UINT16]%. |
|
Variable fields |
$1: Address group name. $2: Address group ID. $3: Total number of port blocks. $4: Numbers of port blocks that are allocated. $5: Port block usage. |
|
Severity level |
4 |
|
Example |
NAT/4/NAT_PORTBLOCK_ALARM: Address group 3 id 3; total port blocks 16575; active port blocks 6630; usage reaches 40%. |
|
Explanation |
This message is sent when the port block usage equals or exceeds the threshold set by the nat log port-block usage threshold command. |
|
Recommended action |
No action is required. |
NAT_PORTBLOCK_RECOVERY
|
Message text |
Address group [STRING] id [UINT16]; total port blocks [UINT16]; active port blocks [UINT16]; usage below [UINT16]%. |
|
Variable fields |
$1: Address group name. $2: Address group ID. $3: Total number of port blocks. $4: Number of port blocks that have been allocated. $5: Port block usage. |
|
Severity level |
5 |
|
Example |
NAT/5/NAT_PORTBLOCK_RECOVERY: Address group 3 id 3; total port blocks 16575; active port blocks 5800; usage below 35%. |
|
Explanation |
This message is sent when the port block usage drops below 87.5% of the threshold set by using the nat log port-block usage threshold command. |
|
Recommended action |
No action is required. |
NAT_PORTBLOCKGRP_MEMORY_WARNING
|
Message text |
Insufficient memory caused by excessive public addresses in port block group [UINT16]. Please reconfigure the public address space. |
|
Variable fields |
$1: NAT port block group ID. |
|
Severity level |
4 |
|
Example |
NAT/4/NAT_PORTBLOCKGRP_MEMORY_WARNING: Insufficient memory caused by excessive public addresses in port block group 1. Please reconfigure the public address space. |
|
Explanation |
This message is sent when a public address range in a NAT port block group is too large and causes insufficient memory. |
|
Recommended action |
Reconfigure the public address range. |
NAT_RESOURCE_MEMORY_WARNING
|
Message text |
Insufficient memory to alloc nat resource pool. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
NAT/4/NAT_RESOURCE_MEMORY_WARNING:Insufficient memory to alloc nat resource pool. |
|
Explanation |
The device did not have enough memory when the EIM mode was switched to the CDM mode. |
|
Recommended action |
No action is required. |
NAT_SERVER_INVALID
|
Message text |
The NAT server with Easy IP is invalid because its global settings conflict with that of another NAT server on this interface. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
NAT/4/NAT_SERVER_INVALID: The NAT server with Easy IP is invalid because its global settings conflict with that of another NAT server on this interface. |
|
Explanation |
The NAT Server with Easy IP did not take effect because its global settings conflict with that the global settings of another NAT Server on the same interface. |
|
Recommended action |
Modify the NAT Server configuration on the interface. The combination of protocol type, global IP addresses and global ports must be unique for each NAT Server on the same interface. |
NAT_SERVICE_CARD_RECOVER_FAILURE
|
Message text |
Pattern 1: Failed to recover the configuration of binding the service card on slot [UINT16] to interface [STRING], because [STRING]. Pattern 2: Failed to recover the configuration of binding the service card on chassis [UINT16] slot [UINT16] to interface [STRING], because [STRING]. |
|
Variable fields |
Pattern 1: $1: Slot number. $2: Interface name. $3: Reasons why restoring the binding between the service card and the interface fails. Pattern 2: $1: Chassis number. $2: Slot number. $3: Interface name. $4: Reasons why restoring the binding between the service card and the interface fails. |
|
Severity level |
4 |
|
Example |
NAT/4/NAT_SERVICE_CARD_RECOVER_FAILURE: Failed to recover the configuration of binding the service card on slot 3 to interface GigabitEthernet0/0/2, because NAT service is not supported on this service card. |
|
Explanation |
Restoring the binding between the service card and the interface failed. |
|
Recommended action |
· If the operation fails because the NAT addresses have already been bound to another service card: ¡ Use the display nat all command to check the current configuration. ¡ Specify the same service card for interfaces referencing the same NAT addresses. · Check the service card for hardware problems if the failure is caused by one of the following reasons: ¡ NAT service is not supported on this service card. ¡ The hardware resources are not enough. ¡ Unknown error. |
ND messages
This section contains ND messages.
ND_ALARM_CLEAR
|
Message text |
The number of ND entries dropped below the threshold. Threshold=[UINT32]; Number of dynamic ND entries=[UINT32]; Number of static ND entries=[UINT32]; Other ND entries = [UINT32]. |
|
Variable fields |
$1: Security threshold for global ND entries. $2: Number of dynamic ND entries. $3: Number of static ND entries. $4: Number of other ND entries. |
|
Severity level |
5 |
|
Example |
ND/5/ND_ALARM_CLEAR: The number of ND entries dropped below the threshold. Threshold=100, Number of dynamic ND entries=59, Number of static ND entries=0 , Other ND entries = 0. |
|
Explanation |
The number of global ND entries (static and dynamic ND entries) dropped below the global security threshold. The global security threshold for ND entries is 60 percent of the customized system entry specification for the product. |
|
Recommended action |
No action is required. |
ND_CONFLICT
|
Message text |
[STRING] is inconsistent. |
|
Variable fields |
$1: Configuration type: ¡ M_FLAG. ¡ O_FLAG. ¡ CUR_HOP_LIMIT. ¡ REACHABLE TIME. ¡ NS INTERVAL. ¡ MTU. ¡ PREFIX VALID TIME. ¡ PREFIX PREFERRED TIME. |
|
Severity level |
6 |
|
Example |
ND/6/ND_CONFLICT: PREFIX VALID TIME is inconsistent |
|
Explanation |
The configuration information in the received router advertisement was not consistent with the configuration on the device. A message is sent if an inconsistency is detected. |
|
Recommended action |
Verify that the configurations on the device and the neighboring router are consistent. |
ND_DUPADDR
|
Message text |
Duplicate address: [STRING] on the interface [STRING]. |
|
Variable fields |
$1: IPv6 address that is to be assigned to the interface. $2: Name of the interface. |
|
Severity level |
6 |
|
Example |
ND/6/ND_DUPADDR: Duplicate address: 33::8 on interface Vlan-interface9. |
|
Explanation |
The IPv6 address that was to be assigned to the interface is being used by another device. |
|
Recommended action |
Assign another IPv6 address to the interface. |
ND_HOST_IP_CONFLICT
|
Message text |
The host [STRING] connected to interface [STRING] cannot communicate correctly, because it uses the same IPv6 address as the host connected to interface [STRING]. |
|
Variable fields |
$1: IPv6 global unicast address of the host. $2: Name of the interface. $3: Name of the interface. |
|
Severity level |
4 |
|
Example |
ND/4/ND_HOST_IP_CONFLICT: The host 2::2 connected to interface GigabitEthernet1/0/1 cannot communicate correctly, because it uses the same IPv6 address as the host connected to interface GigabitEthernet1/0/1. |
|
Explanation |
The IPv6 global unicast address of the host is being used by another host that connects to the same interface. |
|
Recommended action |
Disconnect the host and assign another IPv6 global unicast address to the host. |
ND_HOST_ROUTE_CONFLICT
|
Message text |
Interface [STRING] failed to add the host route for [STRING], because a host route to that IPv6 address already exists on another interface. |
|
Variable fields |
$1: Name of the interface. $2: IPv6 address. |
|
Severity level |
4 |
|
Example |
ND/4/ ND_HOST_ROUTE_CONFLICT: Interface GigabitEthernet1/0/1 failed to add the host route for 2::2, because a host route to that IPv6 address already exists on another interface. |
|
Explanation |
Failed to add the host route to the ND entry. The host route to that IPv6 address already exists on another interface. |
|
Recommended action |
Check the reason for the ND entry conflict and take proper measures accordingly. |
ND_INTERFACE_ALARM_CLEAR
|
Message text |
The number of ND entries dropped below the threshold of Interface [STRING]. Threshold=[UINT32]; Number of dynamic ND entries=[UINT32]. |
|
Variable fields |
$1: Interface name. $2: Dynamic security threshold for the interface. $3: Number of dynamic ND entries on the interface. |
|
Severity level |
5 |
|
Example |
ND/5/ND_INTERFACE_ALARM_CLEAR: The number of ND entries dropped below the threshold of Interface GigabitEthernet1/0/1. Threshold=100; Number of dynamic ND entries=59. |
|
Explanation |
The number of dynamic ND entries on the interface dropped below the dynamic security threshold. The dynamic security threshold for an interface is 60 percent of the dynamic ND learning limit set by the ipv6 neighbors max-learning-num command. |
|
Recommended action |
No action is required. |
ND_INTERFACE_THRESHOLD_EXCEED
|
Message text |
The number of ND entries exceeded the threshold of Interface [STRING]. Threshold=[UINT32]; Number of dynamic ND entries=[UINT32]; |
|
Variable fields |
$1: Interface name. $2: Dynamic alarm threshold for the interface. $3: Number of dynamic ND entries on the interface. |
|
Severity level |
4 |
|
Example |
ND/4/ND_INTERFACE_THRESHOLD_EXCEED: The number of ND entries exceeded the threshold of Interface GigabitEthernet1/0/1. Threshold=100;, Number of dynamic ND entries=81. |
|
Explanation |
The number of dynamic ND entries exceeded the dynamic alarm threshold. The dynamic alarm threshold for an interface is 80 percent of the dynamic ND learning limit set by the ipv6 neighbors max-learning-num command. |
|
Recommended action |
Delete the useless dynamic ND entries on the interface or raise the alarm threshold. |
ND_IP_CONFLICT
|
Message text |
Host IPv6 address conflicted. Local IPv6 address=[STRING]; LocalMac=[STRING]; LocalInterface=[ STRING]]; LocalSVlan=[UINT32]; LocalCVlan=[UINT32]; Remote IPv6 address=[STRING];RemoteMac=[STRING]; RemoteSVlan=[UINT32]; RemoteCVlan=[UINT32]. |
|
Variable fields |
$1: IPv6 address of the local device. $2: MAC address of the local device. $3: Interface name of the local device. $4: Outer VLAN ID for the interface on the local device. $5: Inner VLAN ID for the interface on the local device. $6: IPv6 address of the endpoint. $7: MAC address of the endpoint. $8: Outer VLAN ID for the interface on the endpoint. $9: Inner VLAN ID for the interface on the endpoint. |
|
Severity level |
4 |
|
Example |
ND/4/ND_IP_CONFLICT: Host IPv6 address conflicted. Local IPv6 address=0:0::0:1; LocalMac=0300-1602-00e0; LocalInterface= vlan-interface 10; LocalSVlan=0; LocalCVlan=0; Remote IPv6 address=0:0::0:1; RemoteMac=0300-1602-00e1; RemoteSVlan=1; RemoteCVlan=1. |
|
Explanation |
The interface on the local device received a packet with the same IP address as the interface IP address after you enable recording conflicts between the endpoints and local device by using the ipv6 nd local-conflict record enable command. |
|
Recommended action |
Check whether an ND attack or a loop exists on the network. |
ND_IP_CONFLICT_RESUME
|
Message text |
Host IPv6 address conflict was resolved. Local IPv6 address=[STRING],LocalMac=[STRING], LocalInterface =[ STRING], LocalSVlan=[UINT32], LocalCVlan=[UINT32], Remote IPv6 address=[STRING], RemoteMac=[ STRING], RemoteSVlan=[UINT32], RemoteCVlan=[UINT32] |
|
Variable fields |
$1: IPv6 address of the local device. $2: MAC address of the local device. $3: Interface name of the local device. $4: Outer VLAN ID for the interface on the local device. $5: Inner VLAN ID for the interface on the local device. $6: IPv6 address of the endpoint. $7: MAC address of the endpoint. $8: Outer VLAN ID for the interface on the endpoint. $5: Inner VLAN ID for the interface on the endpoint. |
|
Severity level |
5 |
|
Example |
ND/5/ND_IP_CONFLICT_RESUME: Host IPv6 address conflict was resolved. Local IPv6 address=0:0::0:1, LocalMac=0300-1602-00e0, LocalInterface = vlan-interface 10, LocalSVlan=0, LocalCVlan=0, Remote IPv6 address=0:0::0:1 RemoteMac=0300-1602-00e1, RemoteSVlan=1, RemoteCVlan=1 |
|
Explanation |
No conflict occurs within three minutes after an IP address conflict occurred when you enable recording conflicts between the endpoints and local device by using the ipv6 nd local-conflict record enable command. |
|
Recommended action |
No action is required. |
ND_MAC_CHECK
|
Message text |
Packet received on interface [STRING] was dropped because source MAC [STRING] was inconsistent with link-layer address [STRING]. |
|
Variable fields |
$1: Receiving interface of the ND packet. $2: Source MAC address in the Ethernet frame header of the ND packet. $3: Source link-layer address in the ND packet. |
|
Severity level |
6 |
|
Example |
ND/6/ND_MAC_CHECK: Packet received on interface Ethernet2/0/2 was dropped because source MAC 0002-0002-0001 was inconsistent with link-layer address 0002-0002-0002. |
|
Explanation |
The device dropped an ND packet because source MAC consistency check detected that source MAC address and the source link-layer address are not the same in the packet. |
|
Recommended action |
Verify the validity of the ND packet originator. |
ND_MAXNUMBER
|
Message text |
The number of dynamic neighbor entries for the device has reached the maximum. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
ND/6/ND_MAXNUMBER: The number of dynamic neighbor entries for the device has reached the maximum. |
|
Explanation |
The number of dynamic neighbor entries on the device reached the upper limit. |
|
Recommended action |
No action is required. |
ND_MAXNUMBER_IF
|
Message text |
The number of dynamic neighbor entries on interface [STRING] has reached the maximum. |
|
Variable fields |
$1: Name of the interface. |
|
Severity level |
6 |
|
Example |
ND/6/ND_MAXNUMBER_IF: The number of dynamic neighbor entries on interface GigabitEthernet3/0/1 has reached the maximum. |
|
Explanation |
The number of dynamic neighbor entries on an interface reached the upper limit. |
|
Recommended action |
No action is required. |
ND_MAXNUMBER_SLOT
|
Message text |
Pattern 1: The maximum number of dynamic neighbor entries for slot [INT32] reached. Pattern 2: The maximum number of dynamic neighbor entries for chassis [INT32] slot [INT32] reached. |
|
Variable fields |
Pattern 1: $1: Slot number. Pattern 2: $1: Chassis number. $2: Slot number. |
|
Severity level |
3 |
|
Example |
ND/3/ND_MAXNUMBER_SLOT: The maximum number of dynamic neighbor entries for slot 2 reached. ND/3/ND_MAXNUMBER_SLOT: The maximum number of dynamic neighbor entries for chassis 1 slot 2 reached. |
|
Explanation |
Pattern 1: The maximum number of dynamic neighbor entries for the specified slot was reached. Pattern 2: The maximum number of dynamic neighbor entries for the specified chassis in the specified slot was reached. |
|
Recommended action |
Delete the useless dynamic neighbor entries. |
ND_RAGUARD_DROP
|
Message text |
Dropped RA messages with the source IPv6 address [STRING] on interface [STRING]. [STRING] messages dropped in total on the interface. |
|
Variable fields |
$1: Source IPv6 address of the dropped RA messages. $2: Name of the interface that dropped the RA messages. $3: Total number of dropped RA messages on the interface. |
|
Severity level |
4 |
|
Example |
ND/6/ND_RAGUARD_DROP: Dropped RA messages with the source IPv6 address FE80::20 on interface GigabitEthernet1/0/1. 20 RA messages dropped in total on the interface. |
|
Explanation |
RA guard dropped RA messages and displayed the information when RA guard detected an attack. |
|
Recommended action |
Verify the validity of the RA message originator. |
ND_SET_PORT_TRUST_NORESOURCE
|
Message text |
Not enough resources to complete the operation. |
|
Variable fields |
N/A |
|
Severity level |
2 |
|
Example |
ND/2/ND_SET_PORT_TRUST_NORESOURCE: Not enough resources to complete the operation. |
|
Explanation |
Failed to execute the command because driver resources were not enough. |
|
Recommended action |
Release the driver resources and execute the command again. |
ND_SET_VLAN_REDIRECT_NORESOURCE
|
Message text |
Not enough resources to complete the operation. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
ND/6/ND_SET_VLAN_REDIRECT_NORESOURCE: Not enough resources to complete the operation. |
|
Explanation |
Failed to execute the command because driver resources were not enough. |
|
Recommended action |
Release the driver resources and execute the command again. |
ND_SLOT_ALARM_CLEAR
|
Message text |
Pattern 1: The number of ND entries dropped below the threshold of slot. Slot name=[UINT32]; Threshold=[ UINT32]; Number of dynamic ND entries=[UINT32]. Pattern 2: The number of ND entries dropped below the threshold of chassis [UINT16] slot [UINT16]. Threshold=[ UINT32]; Number of dynamic ND entries=[UINT32]. |
|
Variable fields |
Pattern 1: $1: Slot number. $2: Dynamic security threshold for the card. $3: Number of dynamic ND entries on the card. Pattern 2: $1: Chassis number. $2: Slot number. $3: Security threshold for the card. $4: Number of dynamic ND entries on the card. |
|
Severity level |
5 |
|
Example |
Pattern 1: ND/5/ND_SLOT_ALARM_CLEAR: The number of ND entries dropped below the threshold of slot. Slot name=1; Threshold=100; Number of dynamic ND entries=59. Pattern 2: ND/5/ND_SLOT_ALARM_CLEAR: The number of ND entries dropped below the threshold of chassis 1 slot 1. Threshold=100; Number of dynamic ND entries=59. |
|
Explanation |
The number of dynamic ND entries dropped below the dynamic security threshold for the card. The dynamic security threshold for a card is 60 percent of the dynamic ND learning limit for a card set by the ipv6 neighbors max-learning-number command. |
|
Recommended action |
No action is required. |
ND_SLOT_THRESHOLD_EXCEED
|
Message text |
Pattern 1: The number of ND entries exceeded the threshold of slot. Slot name=[UINT32];, Threshold=[UINT32]; Number of dynamic ND entries=[UINT32]. Pattern 2: The number of ND entries exceeded the threshold of chassis [UINT16] slot [UINT16]. Threshold=[UINT32]; Number of dynamic ND entries=[UINT32]. |
|
Variable fields |
Pattern 1: $1: Slot number. $2: Dynamic alarm threshold for the card. $3: Number of dynamic ND entries on the card. Pattern 2: $1: Chassis number. $2: Slot number. $3: Alarm threshold for the card. $4: Number of dynamic ND entries on the card. |
|
Severity level |
4 |
|
Example |
Pattern 1: ND/4/ND_SLOT_THRESHOLD_EXCEED: The number of ND entries exceeded the threshold of slot. Slot name=1; Threshold=100; Number of dynamic ND entries=80. Pattern 2: ND/4/ND_SLOT_THRESHOLD_EXCEED: The number of ND entries exceeded the threshold of chassis 1 slot 1. Threshold=100; Number of dynamic ND entries=80. |
|
Explanation |
The number of dynamic ND entries exceeded the dynamic alarm threshold for the card. The alarm threshold for a card is 80 percent of the maximum number of dynamic ND learning limit for a card set by the ipv6 neighbors max-learning-number command. |
|
Recommended action |
Delete the useless dynamic ND entries or raise the alarm threshold. |
ND_SPEEDLIMIT_ALARM
|
Message text |
Packet rate exceeded the rate limit. ThresholdRate =[UINT32]; CurrentRate=[UINT32]; SuppressType=[STRING]. |
|
Variable fields |
$1: Alarm threshold for ND packets or ND Miss messages sent per second. $2: The current peak number of ND packets or ND Miss messages sent per second. $3: Limit object, including ND packets or ND Miss messages. |
|
Severity level |
4 |
|
Example |
ND/4/ND_SPEEDLIMIT_ALARM: Packet speed exceeded the speed limit; SuppressValue=50; CurrentValue=60; SuppressType=ND |
|
Explanation |
The sending rate of ND packets or ND Miss messages exceeded the alarm threshold. |
|
Recommended action |
Check whether the network has packet attacks. |
ND_SPEEDLIMIT_ALARM_CLEAR
|
Message text |
Packet rate dropped below the rate limit. ThresholdRate =[UINT32]; CurrentRate=[UINT32]; SuppressType=[STRING]. |
|
Variable fields |
$1: Alarm threshold for ND packets or ND Miss messages sent per second. $2: The current peak number of ND packets or ND Miss messages sent per second. $3: Limit object, including ND packets and ND Miss messages. |
|
Severity level |
5 |
|
Example |
ND/5/ND_SPEEDLIMIT_ALARM: Packet rate dropped below the rate limit. SuppressValue=50; CurrentValue=60; SuppressType=ND. |
|
Explanation |
The sending rate of ND packets or ND Miss messages dropped below the alarm threshold. To avoid frequent alarm notifications or alarm recovery notifications, the device does not output notifications within one minute after the alarm recovers. |
|
Recommended action |
Check whether the network has packet attacks. |
ND_SUPPR_ALARM_CLEAR
|
Message text |
The number of ND suppression entries dropped below the threshold. Threshold=[UINT32], Number of ND suppression entries=[UINT32]) |
|
Variable fields |
$1: Threshold for ND suppression entries. $2: Number of ND suppression entries. |
|
Severity level |
5 |
|
Example |
ND/5/ND_SUPPR_ALARM_CLEAR: The number of ND suppression entries dropped below the threshold. Threshold=100; Number of ND Suppression entries=59. |
|
Explanation |
The number of ND suppression entries on the device dropped below 60 percent of the threshold. |
|
Recommended action |
No action is required. |
ND_SUPPR_THRESHOLD_EXCEED
|
Message text |
The number of ND suppression entries exceeded the threshold. Threshold=[UINT32]; Number of ND suppression entries=[UINT32]. |
|
Variable fields |
$1: Threshold for ND suppression entries. $2: Number of ND suppression entries. |
|
Severity level |
4 |
|
Example |
ND/4/ND_SUPPR_THRESHOLD_EXCEED: The number of ND suppression entries exceeded the threshold. Threshold=100; Number of ND suppression entries=80. |
|
Explanation |
The number of ND suppression entries on the device exceeded 80 percent of the threshold. |
|
Recommended action |
Delete the useless ND suppression entries or raise the threshold. |
ND_THRESHOLD_EXCEED
|
Message text |
The number of ND entries exceeded the threshold. Threshold=[UINT32]; Number of dynamic ND entries=[UINT32]; Number of static ND entries=[UINT32]; Other ND entries = [UINT32]. |
|
Variable fields |
$1: Alarm threshold for global ND entries. $2: Number of dynamic ND entries. $3: Number of static ND entries. $4: Number of other ND entries. |
|
Severity level |
4 |
|
Example |
ND/4/ND_THRESHOLD_EXCEED: The number of ND entries exceeded the threshold. Threshold=100; Number of dynamic ND entries=81; Number of static ND entries=0; Other ND entries = 0. |
|
Explanation |
The number of global ND entries (static and dynamic ND entries) exceeded the global alarm threshold. The global alarm threshold is 80 percent of the customized system entry specification for the product. |
|
Recommended action |
Delete the useless ND entries or raise the alarm threshold. |
ND_USER_DUPLICATE_IPV6ADDR
|
Message text |
Detected a user IPv6 address conflict. New user (MAC [STRING], SVLAN [STRING], CVLAN [STRING]) on interface [STRING] and old user (MAC [STRING], SVLAN [STRING], CVLAN [STRING]) on interface [STRING] were using the same IPv6 address [IPV6ADDR]. |
|
Variable fields |
$1: MAC address of the new user. $2: SVLAN ID of the new user. $3: CVLAN ID of the new user. $4: Name of the interface connected to the new user. $5: MAC address of the old user. $6: SVLAN ID of the old user. $7: CVLAN ID of the old user. $8: Name of the interface connected to the old user. $9: IPv6 address of the user. |
|
Severity level |
6 |
|
Example |
ND/6/ND_USER_DUPLICATE_IPV6ADDR: Detected a user IPv6 address conflict. New user (MAC 0010-2100-01e1, SVLAN 100, CVLAN 10) on interface GigabitEthernet1/0/1 and old user (MAC 0120-1e00-0102, SVLAN 100, CVLAN 10) on interface GigabitEthernet1/0/1 were using the same IPv6 address 10::1. |
|
Explanation |
This message is sent when ND detects an IPv6 address conflict. |
|
Recommended action |
Examine IPv6 addresses of all endpoint users, locate the address conflict reason, and take actions to remove the conflict. |
NETCONF messages
This section contains NETCONF messages.
CLI
|
Message text |
User ([STRING], [STRING][STRING]) performed an CLI operation: [STRING] operation result=[STRING][STRING] |
|
Variable fields |
$1: Username or user line type. · If scheme login authentication was performed for the user, this field displays the username. · If no login authentication was performed or password authentication was performed, this field displays the user line type, such as VTY. $2: User IP address or user line type and the relative number of a user line. · For a Telnet or SSH user, this field displays the IP address of the user. · For a user who logged in through the console or AUX port, this field displays the user line type and the relative line number, such as console0. $3: ID of a NETCONF session. This field is not displayed for Web and RESTful sessions. $4: Message ID of the NETCONF request. This field is not displayed for Web and RESTful sessions. $5: Operation result, Succeeded or Failed. $6: Cause for an operation failure. This field is displayed only when the failure is caused by known reasons. |
|
Severity level |
6 |
|
Example |
XMLSOAP/6/CLI: -MDC=1; User (test, 169.254.5.222, session ID=1) performed an CLI operation: message ID=101, operation result=Succeeded. |
|
Explanation |
After a NETCONF operation is performed at the CLI, this message is generated to show the operation result. |
|
Recommended action |
No action is required. |
EDIT-CONFIG
|
Message text |
User ([STRING], [STRING][STRING])[STRING] operation=[STRING] [STRING] [STRING], result=[STRING]. No attributes. Or: User ([STRING], [STRING],[STRING]),[STRING] operation=[STRING] [STRING] [STRING], result=[STRING]. Attributes: [STRING]. |
|
Variable fields |
$1: Username or user line type. · If scheme login authentication was performed for the user, this field displays the username. · If no login authentication was performed or password authentication was performed, this field displays the user line type, such as VTY. $2: User IP address, or user line type and relative line number. · For a Telnet or SSH user, this field displays the IP address of the user. · For a user who logged in through the console or AUX port, this field displays the user line type and the relative line number, such as console0. $3: ID of the NETCONF session. This field is not displayed if no NETCONF session ID exists. $4: Message ID of the NETCONF request. This field is not displayed if a NETCONF request does not contain a message ID. $5: Name of the NETCONF row operation. $6: Module name and table name. $7: Index information. If there are multiple indexes, this field uses a comma as the delimiter. This field is displayed only when there are indexes. $8: Operation result, Succeeded or Failed. $9: Attribute column information. This field is displayed only when the operation configures an attribute column. |
|
Severity level |
6 |
|
Example |
XMLSOAP/6/EDIT-CONFIG: -MDC=1; User (test, 192.168.200.220, session ID 1), message ID=101, operation=merge DHCP/DHCPServerPoolStatic (PoolIndex=1, Ipv4Address=1.1.1.1), result=Failed. Attributes: CID="aaaaa", HType=1. |
|
Explanation |
The device outputs this log message for each row operation after performing an <action> or <edit-config> operation. |
|
Recommended action |
No action is required. |
NETCONF_MSG_DEL
|
Message text |
A NETCONF message was dropped. Reason: Packet size exceeded the upper limit. |
|
Variable fields |
N/A |
|
Severity level |
7 |
|
Example |
NETCONF/7/NETCONF_MSG_DEL: A NETCONF message was dropped. Reason: Packet size exceeded the upper limit. |
|
Explanation |
The system dropped a NETCONF request message that was received from a NETCONF over SSH client or at the XML view. The reason is that the message size exceeded the upper limit. |
|
Recommended action |
1. Reduce the size of the request message. For example, delete blank spaces, carriage returns, and tab characters. 2. Contact H3C Support to segment the request message and then re-encapsulate the segments before sending them to the device. |
REPLY
|
Message text |
Sent a NETCONF reply to the client: Session ID=[UINT16], Content=[STRING]. Or: Sent a NETCONF reply to the client: Session ID=[UINT16], Content (partial)=[STRING]. |
|
Variable fields |
$1: ID of the NETCONF session. This field displays a hyphen (-) before the NETCONF session is established. $2: NETCONF packet that the device sent to the NETCONF client. |
|
Severity level |
7 |
|
Example |
XMLSOAP/7/REPLY: -MDC=1; Sent a NETCONF reply to the client: Session ID=1, Content=</env:Body></env:Envelope>. |
|
Explanation |
When sending a NETCONF packet to a client, the device outputs this log message for NETCONF debugging purposes. If a NETCONF packet cannot be sent in one log message, the device uses multiple log messages and adds the partial flag in each log message. |
|
Recommended action |
No action is required. |
SOAP_XML_LOGIN
|
Message text |
[STRING] logged in from [STRING], session id [STRING]. |
|
Variable fields |
$1: Username. $2: User IP address. $3: ID of the NETCONF session. |
|
Severity level |
6 |
|
Example |
NETCONF/6/SOAP_XML_LOGIN: test logged in from 192.168.56.101, session id 1. |
|
Explanation |
A NETCONF over SOAP client logged in to the device. |
|
Recommended action |
No action is required. |
SOAP_XML_LOGOUT
|
Message text |
[STRING] logged out from [STRING], session id [STRING]. |
|
Variable fields |
$1: Username. $2: User IP address. $3: ID of the NETCONF session. |
|
Severity level |
6 |
|
Example |
NETCONF/6/SOAP_XML_LOGOUT: test logged out from 192.168.56.101, session id 1. |
|
Explanation |
A NETCONF over SOAP client logged out from the device. |
|
Recommended action |
No action is required. |
SSH_XML_LOGIN
|
Message text |
User ([STRING], [STRING], session ID=[STRING]) logged in. |
|
Variable fields |
$1: Username. $2: User IP address. $3: ID of the NETCONF session. |
|
Severity level |
6 |
|
Example |
NETCONF/6/SSH_XML_LOGIN: User (test, 192.168.56.101, session ID=1) logged in. |
|
Explanation |
A NETCONF over SSH client logged in to the device. |
|
Recommended action |
No action is required. |
SSH_XML_LOGOUT
|
Message text |
User ([STRING], [STRING], session ID=[STRING]) logged out. |
|
Variable fields |
$1: Username. $2: User IP address. $3: ID of the NETCONF session. |
|
Severity level |
6 |
|
Example |
NETCONF/6/SSH_XML_LOGOUT: User (test, 192.168.56.101, session ID=1) logged out. |
|
Explanation |
A NETCONF over SSH client logged out from the device. |
|
Recommended action |
No action is required. |
THREAD
|
Message text |
Maximum number of NETCONF threads already reached. |
|
Variable fields |
N/A |
|
Severity level |
3 |
|
Example |
XMLCFG/3/THREAD: -MDC=1; Maximum number of NETCONF threads already reached. |
|
Explanation |
The number of NETCONF threads already reached the upper limit. |
|
Recommended action |
Please try again later. |
NETSLICE
This section contains SRv6 network slicing messages.
NETSLICING_IF_BANDWIDTH_CHG
|
Message text |
The modified bandwidth value [UINT32] of interface [String] is less than the bandwidth value [UINT32] configured for slices. |
|
Variable fields |
$1: Edited bandwidth of the main interface. $2: Name of the main interface. $3: Bandwidth (of the main interface and its subinterfaces) specified for the network slice. |
|
Severity level |
4 |
|
Example |
NETSLICE/4/NETSLICING_IF_BANDWIDTH_CHG: The modified bandwidth value 10000 of the interface ForthGigE 3/0/32 is less than the configured bandwidth value 20000. |
|
Explanation |
The edited bandwidth of the main interface is smaller than the bandwidth specified for the network slice. |
|
Recommended action |
Edit the bandwidth of the main interface based on the bandwidth (of the main interface and its subinterfaces) specified for the network slice. Make sure the edited bandwidth of the main interface is greater than the bandwidth specified for the network slice. |
NETSLICING_BANDWIDTH_CONFLICT
|
Message text |
The slice bandwidth configuration conflicts with some existing settings such as HQoS, exclusive bandwidth, CBQ, and MPLS TE bandwidth. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
NETSLICE/4/NETSLICING_BANDWIDTH_CONFLICT: The slice bandwidth configuration conflicts with some existing settings such as HQoS, exclusive bandwidth, CBQ, and MPLS TE bandwidth. |
|
Explanation |
The bandwidth setting of the network slice conflicts with the HQoS, exclusive bandwidth, CBQ, and MPLS TE bandwidth reservation settings on the interface. |
|
Recommended action |
· Contact H3C Support. |
NETSLICING_BANDWIDTH_EXCEED
|
Message text |
The sum of the slice bandwidth and the channelized bandwidth configured for the interface exceeds the limit. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
NETSLICE/4/NETSLICING_ BANDWIDTH_EXCEED: The sum of the slice bandwidth and the channelized bandwidth configured for the interface exceeds the limit. |
|
Explanation |
The sum of the network slice bandwidth and channelized bandwidth exceeds the maximum bandwidth of the interface. |
|
Recommended action |
· Edit the channelized bandwidth for the subinterfaces. · Change the interface speed. |
NETSLICING_NO_ENOUGH_HARDWARE_RESOURCE
|
Message text |
Not enough hardware resources to complete the operation. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
NETSLICE/4/NETSLICING_NO_ENOUGH_HARDWARE_RESOURCE: Not enough hardware resources to complete the operation |
|
Explanation |
The hardware resources are insufficient to support the deployment or adjustment of the network slice bandwidth. |
|
Recommended action |
Contact H3C Support. |
NETSLICING_NOT_SUPPORT_PROTOCOLNUM
|
Message text |
The board on slot [USHORT] does not support protocol number configuration. |
|
Variable fields |
$1: Slot number of the interface card. |
|
Severity level |
4 |
|
Example |
NETSLICE/4/NETSLICING_NOT_SUPPORT_PROTOCOLNUM: The board on slot 3 does not support protocol number configuration. |
|
Explanation |
The interface card does not support protocol number configuration. |
|
Recommended action |
Use an interface card that supports protocol number configuration. |
NETSLICING_NOTSET_CHANNELBANDWIDTH
|
Message text |
Please set the channelized bandwidth for the subinterface [String] ,otherwise the network slice channel specified with the data-plane keyword on the slicing interface won't take effect. |
|
Variable fields |
$1: Subinterface name. |
|
Severity level |
4 |
|
Example |
NETSLICE/4/NETSLICING_NOTSET_CHANNELBANDWIDTH: Please set the channelized bandwidth for the subinterface ForthGigE 3/0/2,otherwise the network slice channel specified with the data-plane keyword on the slicing interface won't take effect. |
|
Explanation |
Network slice channels created by using the slice-id data-plane command on a subinterface cannot take effect if the subinterface acts as a slicing interface and the mode channel-bandwidth command is not configured on the subinterface. |
|
Recommended action |
Use the mode channel-bandwidth command on the subinterface. |
NPD
This section contains NPD messages.
ECC_ERROR
|
Message text |
ECC reset-level error occurred on slot [UINT32]. Error not corrected after three fast reset actions. |
|
Variable fields |
$1: Slot number of a card. |
|
Severity level |
2 (Critical) |
|
Example |
NPD/2/ECC_ERROR: -MDC=1-Slot=5; ECC reset-level error occurred on slot 5. Error not corrected after three fast reset actions. |
|
Impact |
A card error occurs, causing a large number of dropped packets and incorrect packets. |
|
Cause |
An ECC error occurred on the card chip and cannot be cleared. |
|
Recommended action |
Replace the card. |
NPS_ECC_ERROR
|
Message text |
ECC reset-level error occurred on slot [UINT32]. |
|
Variable fields |
$1: Slot number of a card. |
|
Severity level |
2 (Critical) |
|
Example |
NPD/2/NPS_ECC_ERROR: -MDC=1-Slot=5; ECC reset-level error occurred on slot 5. |
|
Impact |
A large number of dropped packets might occur on the card. |
|
Cause |
On the specified card, a reset-level error occurred. |
|
Recommended action |
1. Identify whether this message has been continuously reported. ¡ If yes, go to step 3. ¡ If not, go to step 2. 2. Identify whether the following message is generated: ECC reset-level error occurred on chassis [UINT32] slot [UINT32]. Error not corrected after three fast reset actions. ¡ If yes, go to step 3 ¡ If not, no action is required. 3. Replace the card. |
MACTX_FIFO_ERR
|
Message text |
Pattern 1: MAC TX FIFO error detected on interface. Pattern 2: MAC TX FIFO error detected on slot [UINT32]. |
|
Variable fields |
Pattern 1: N/A Pattern 2: $1: Slot number of a card. |
|
Severity level |
3 (Error) |
|
Example |
NPD/3/MACTX_FIFO_ERR: MAC TX FIFO error detected on interface. |
|
Impact |
A large number of dropped packets occur on the card. |
|
Cause |
A hardware error occurred on the card, which cannot be resolved. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
NPS_TND_BLOCK
|
Variable fields |
Pattern 1: $1: Slot number of the card in the device. $2: NP chip number. $3: NP chip part, 0 represents the left half of the chip, and 1 represents the right half of the chip. $4: Interface engine number. $5: Interface number. $6: ILKN channel number. Pattern 2: $1: Slot number of the card in the device. $2: NP chip number. $3: NP chip part, 0 represents the left half of the chip, and 1 represents the right half of the chip. $4: Interface engine number. $5: Interface number. |
|
Severity level |
3 (Error) |
|
Example |
NPD/3/NPS_TND_BLOCK: Eth TND is blocked detected on slot 3 chip 0 side1 IF Engine 1 IF Number 2 |
|
Impact |
The card cannot operate correctly. |
|
Cause |
An NP chip fault occurs on the card. |
|
Recommended action |
· Restart or replace the card. |
CP_TND
|
Message text |
Pattern 1: TND is blocked detected on slot [UINT32] chip [UINT32] side [INT32] IF Engine [UINT32] IF Number [UINT32]. Pattern 2: TND is blocked on slot [UINT32] chip [UINT32] side [INT32] IF Engine [UINT32] IF Number [UINT32] Channel Number [UINT32]. |
|
Variable fields |
Pattern 1: $1: Slot number of the card in the device. $2: NP chip number. $3: NP chip part, 0 represents the left half of the chip, and 1 represents the right half of the chip. $4: Interface engine number. $5: Interface number. Pattern 2: $1: Slot number of the card in the device. $2: NP chip number. $3: NP chip part, 0 represents the left half of the chip, and 1 represents the right half of the chip. $4: Interface engine number. $5: Interface number. $6: InterLaken channel number |
|
Severity level |
3 (Error) |
|
Example |
NPY/3/CP_TND: TND is blocked detected on slot 3 chip 0 side 0 IF Engine 1 IF Number 10. |
|
Impact |
The card cannot operate correctly. |
|
Cause |
An NP chip fault occurs on the card. |
|
Recommended action |
· Restart or replace the card. |
NQA messages
SESSION_NOTSPT
|
Message text |
The board on slot [STRING] doesn't support NQA sessions. |
|
Variable fields |
$1: Slot number. |
|
Severity level |
4 (Warning) |
|
Example |
NQA/4/SESSION_NOTSPT: -MDC=1-Slot=3; The board on slot 2 doesn't support NQA sessions. |
|
Impact |
NQA operations cannot start. |
|
Cause |
The card does not support NQA sessions. |
|
Recommended action |
1. Use the display device command in system view to view the hardware type of the card. 2. Contact Technical Support to identify whether the card supports the NQA feature. |
REFLECTOR_NOTSPT
|
Message text |
The board on slot [STRING] doesn't support reflectors on the NQA server. |
|
Variable fields |
$1: Slot number. |
|
Severity level |
4 (Warning) |
|
Example |
NQA/4/REFLECTOR_NOTSPT: -MDC=1-Slot=3; The board on slot 3 doesn't support reflectors on the NQA server. |
|
Impact |
NQA reflector settings cannot be configured. |
|
Cause |
The card does not support NQA reflector settings configured by the nqa reflector command. |
|
Recommended action |
1. Use the display device command in system view to view the hardware type of the card. 2. Contact Technical Support to identify whether the card supports NQA reflector configuration. |
NQA messages
This section contains NQA messages.
NQA_BATCH_START_FAILURE
|
Message text |
Failed to batch start the [STRING] operation. Reason: [STRING] |
|
Variable fields |
$1: Type of the NQA operation. The value is Y.1564. $3: Failure reason: · Invalid configuration. · Not enough resources. |
|
Severity level |
6 |
|
Example |
NQA/6/NQA_BATCH_START_FAILURE: Failed to batch start the Y.1564 operation. Invalid configuration. |
|
Explanation |
This message is sent when NQA failed to start the service performance test of the Y.1564 operation in batch due to invalid configuration or insufficient resources. |
|
Recommended action |
1. Examine the parameters for the incorrect settings, modify the settings, and restart the Y.1564 operation. 2. If the problem persists, contact H3C Support. |
NQA_LOG_UNREACHABLE
|
Message text |
Server [STRING] unreachable. |
|
Variable fields |
$1: IP address of the NQA server. |
|
Severity level |
6 |
|
Example |
NQA/6/NQA_LOG_UNREACHABLE: Server 192.168.30.117 unreachable. |
|
Explanation |
An unreachable server was detected. |
|
Recommended action |
Check the network environment. |
NQA_PACKET_OVERSIZE
|
Message text |
NQA entry ([STRING]-[STRING]): The payload size exceeds 65503 bytes, and all IPv6 UDP probe packets will be dropped by the NQA server. |
|
Variable fields |
$1: Admin name of the NQA operation. $2: Operation tag of the NQA operation. |
|
Severity level |
6 |
|
Example |
NQA/6/NQA_PACKET_OVERSIZE: NQA entry (1-1): The payload size exceeds 65503 bytes, and all IPv6 UDP probe packets will be dropped by the NQA server. |
|
Explanation |
A packet oversize warning message was sent when the NQA client attempted to send to an IPv6 NQA server UDP probe packets with the data size exceeding 65503 bytes. The message indicated that the oversized probe packets will be dropped by the NQA server. |
|
Recommended action |
Modify the probe packet data size for the NQA operation. |
NQA_REFLECTOR_START_FAILURE
|
Message text |
NQA reflector [UINT32]: Failed to start the NQA reflector. Please check the parameters. |
|
Variable fields |
$1: ID of a reflector. |
|
Severity level |
6 |
|
Example |
NQAS/6/NQA_REFLECTOR_START_FAILURE: NQA reflector 1: Failed to start the NQA reflector, Please check the parameters. |
|
Explanation |
This message is sent when the NQA server failed to start the NQA reflector. This message asks you to examine the parameter settings. |
|
Recommended action |
1. Execete the display this command to examine the parameter settings of the nqa reflector command. 2. Re-execute the nqa reflector command with the required parameters according to your network requirements. |
NQA_REFRESH_FAILURE
|
Message text |
Failed to refresh the [STRING] operation. Reason: [STRING] |
|
Variable fields |
$1: Type of the NQA operation. The value is RFC2544. $3: Failure reason: · Invalid configuration. · Not enough resources. |
|
Severity level |
6 |
|
Example |
NQA/6/NQA_REFRESH_FAILURE: Failed to refresh the RFC2544 operation. Invalid configuration. |
|
Explanation |
This message is sent when NQA consecutively fails to start path quality analysis operations (RFC2544 operations) due to invalid configuration or insufficient resources. The device clears results of the started path quality analysis operations and stops all path quality analysis operations. |
|
Recommended action |
1. Examine the parameters for the incorrect settings, modify the settings, and restart the Y.1564 operation. 2. If the problem persists, contact H3C Support. |
NQA_REFRESH_START
|
Message text |
Start to refresh the [STRING] operation and reset the result. |
|
Variable fields |
$1: Type of the NQA operation. The value is RFC2544. |
|
Severity level |
6 |
|
Example |
NQA/6/NQA_REFRESH_START: Start to refresh the RFC2544 operation and reset the result. |
|
Explanation |
This message is sent when a new path quality analysis operation (RFC2544 operation) is started through the start command during an ongoing path quality analysis operation. The system clears the results of the ongoing path quality analysis operation and starts all path quality analysis operations. |
|
Recommended action |
No action is required. |
NQA_SCHEDULE_FAILURE
|
Message text |
NQA entry ([ STRING ]- [ STRING ]): Failed to start the scheduled NQA operation because port [ STRING] used by the operation is not available. |
|
Variable fields |
$1: Admin name of the NQA operation. $2: Operation tag of the NQA operation. $3: Port number. |
|
Severity level |
4 |
|
Example |
NQA/4/NQA_SCHEDULE_FAILURE: NQA entry (admin-tag): Failed to start the scheduled NQA operation because port 10000 used by the operation is not available. |
|
Explanation |
Failed to start a scheduled NQA operation because the port number used by the operation is not available. |
|
Recommended action |
Change the port number of the NQA operation or disable the service that uses the port number. |
NQA_SEVER_FAILURE
|
Message text |
Failed to enable the NQA server because listening port [ STRING ] is not available. |
|
Variable fields |
$1: Port number. |
|
Severity level |
4 |
|
Example |
NQA/4/NQA_SEVER_FAILURE: Failed to enable the NQA server because listening port 10000 is not available. |
|
Explanation |
Failed to enable the NQA server because the port number specified for a listening service is not available. |
|
Recommended action |
Change the port number of the listening service or disable the service that uses the port number. |
NQA_START_FAILURE
|
Message text |
NQA entry ([STRING]-[STRING]): [STRING] |
|
Variable fields |
$1: Admin name of the NQA operation. $2: Operation tag of the NQA operation. $3: Failure reason: · Operation failed due to configuration conflicts. · Operation failed because the driver was not ready to perform the operation. · Operation not supported. · Not enough resources to complete the operation. · Operation failed due to an unknown error. |
|
Severity level |
6 |
|
Example |
NQA/6/NQA_START_FAILURE: NQA entry 1-1: Operation failed due to configuration conflicts. |
|
Explanation |
The message is sent when the system fails to issue an NQA operation to the drive because of the configuration conflicts. |
|
Recommended action |
1. Examine the parameters for the incorrect settings, modify the settings, and restart the Y.1564 operation. 2. If the problem persists, contact H3C Support. |
NQA_TWAMP_LIGHT_PACKET_INVALID
|
Message text |
NQA TWAMP Light test session [UINT32] index [UINT32]: The number of packets captured for statistics collection is invalid. |
|
Variable fields |
$1: Test session ID. $2: Serial number of the statistics data. |
|
Severity level |
6 |
|
Example |
NQA/6/ NQA_TWAMP_LIGHT_PACKET_INVALID: NQA TWAMP Light test session 1 index 7: The number of packets captured for statistics collection is invalid. |
|
Explanation |
The number of probe packets was invalid in the TWAMP Light test because the test collection interval was shorter than the packet sending interval. |
|
Recommended action |
Verify that the test collection interval is no less than the packet sending interval. |
NQA_TWAMP_LIGHT_REACTION
|
Message text |
NQA TWAMP Light test session [UINT32] reaction entry [UINT32]: Detected continual violation of the [STRING] [STRING] threshold for a threshold violation monitor time of [UINT32] ms. |
|
Variable fields |
$1: Test session ID. $2: Reaction entry ID. $3: Reaction entry type: · Two-way delay. · Two-way loss. · Two-way jitter. $4: Threshold violation value: · upper—Be equal to or greater than the upper threshold limit. · lower—Be equal to or less than the lower threshold limit. $5: Statistics collection interval. |
|
Severity level |
6 |
|
Example |
NQA/6/NQA_TWAMP_LIGHT_REACTION: NQA TWAMP Light test session 1 reaction entry 1: Detected continual violation of the two-way loss upper threshold for a threshold violation monitor time of 2000 ms. |
|
Explanation |
In a TWAMP test, the device monitors the test result, and starts the monitoring time when either of the following conditions is met: · The monitoring result goes beyond the upper threshold limit. · The monitoring result drops below the lower threshold limit from a monitoring result higher than the lower limit. If either condition is always true during the monitoring time, a threshold violation occurs. |
|
Recommended action |
No action is required. |
NQA_TWAMP_LIGHT_SENDER_START_FAILURE
|
Message text |
NQA TWAMP Light sender test session [UINT32]: Failed to start the test session. Reason: [TEXT]. |
|
Variable fields |
$1: Test session ID. $2: Test failure reason: · Test tx-interval is mutually exclusive with the timestamp format of NTP. |
|
Severity level |
6 |
|
Example |
NQA/6/NQA_TWAMP_LIGHT_SENDER_START_FAILURE: NQA TWAMP Light sender test session 1:Failed to start the test session.Reason: Test tx-interval is mutually exclusive with the timestamp-format of NTP. |
|
Explanation |
A configuration conflict occurs and the TWAMP Light test fails because the timestamp on the TWAMP Light sender is NTP format and the test packet sending interval is 10 milliseconds or 100 milliseconds. |
|
Recommended action |
Use the start command on the TWAMP Light sender to modify the packet sending interval or use the timestamp-format to modify the timestamp format. |
NQA_TWAMP_LIGHT_START_FAILURE
|
Message text |
NQA TWAMP Light test session [UINT32]: Failed to start the test session. Please check the parameters. |
|
Variable fields |
$1: Test session ID. |
|
Severity level |
6 |
|
Example |
NQAS/6/NQA_TWAMP_LIGHT_START_FAILURE: NQA TWAMP Light test session 1: Failed to start the test session, Please check the parameters. |
|
Explanation |
This message is sent when the TWAMP Light responder failed to start the test session. The message asks you to examine the parameter settings. |
|
Recommended action |
1. Execete the display this command to examine the parameter settings of the test-session command. 2. Re-execute the test-session command with the required parameters according to your network requirements. |
NTP messages
This section contains NTP messages.
NTP_CLOCK_CHANGE
|
Message text |
System clock changed from [STRING] to [STRING], the NTP server's IP address is [STRING]. |
|
Variable fields |
$1: Time before synchronization. $2: Time after synchronization. $3: IP address. |
|
Severity level |
5 |
|
Example |
NTP/5/NTP_CLOCK_CHANGE: System clock changed from 02:12:58:345 12/28/2012 to 02:29:12:879 12/28/2012, the NTP server's IP address is 192.168.30.116. |
|
Explanation |
The NTP client has synchronized its time to the NTP server. |
|
Recommended action |
No action is required. |
NTP_DynSession_Limit
|
Message text |
The maximum number of NTP dynamic sessions already reached: MaxNumber=[UINT32]. |
|
Variable fields |
$1: Maximum number of dynamic NTP sessions. |
|
Severity level |
4 |
|
Example |
NTP/4/NTP_DynSession_Limit: The maximum number of NTP dynamic sessions already reached: MaxNumber=128. |
|
Explanation |
The number of dynamic NTP sessions has reached the upper limit. Possible reasons include: · The maximum number of dynamic NTP sessions is configured inappropriately. · Too many unauthenticated NTP connections. |
|
Recommended action |
· Use the ntp-service max-dynamic-sessions command to modify the maximum number of NTP dynamic sessions. · Configure NTP authentication. For information about how to configure NTP authentication, see the NTP configuration guide. |
NTP_DynSession_Limit_Resume
|
Message text |
The number of NTP dynamic sessions fell below the upper limit. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
NTP/4/NTP_DynSession_Limit_Resume: The number of NTP dynamic sessions fell below the upper limit. |
|
Explanation |
The number of dynamic NTP sessions fell below the upper limit to the normal range. |
|
Recommended action |
No action is required. |
NTP_LEAP_CHANGE
|
Message text |
System Leap Indicator changed from [UINT32] to [UINT32] after clock update. |
|
Variable fields |
$1: Original Leap Indicator. $2: Current Leap Indicator. |
|
Severity level |
5 |
|
Example |
NTP/5/NTP_LEAP_CHANGE: System Leap Indicator changed from 00 to 01 after clock update. |
|
Explanation |
The system Leap Indicator changed. For example, the NTP status changed from unsynchronized to synchronized. NTP Leap Indicator is a two-bit code warning of an impending leap second to be inserted in the NTP timescale. The bits are set before 23:59 on the day of insertion and reset after 00:00 on the following day. This causes the number of seconds (rolloverinterval) in the day of insertion to be increased or decreased by one. |
|
Recommended action |
No action is required. |
NTP_SERVER_ABNORMAL
|
Message text |
NTP server state went abnormal. |
|
Variable fields |
N/A |
|
Severity level |
3 |
|
Example |
NTP/3/NTP_SERVER_ABNORMAL: NTP server state went abnormal. |
|
Explanation |
The NTP server is in abnormal state. Possible reasons include: · The NTP server is not reachable. · The NTP server clock is not synchronized. · The NTP server failed to be authenticated. · The NTP server has limited access to the device. · The clock offset of the NTP server is greater than the threshold. · The NTP server packet verification failed. |
|
Recommended action |
· Execute the display ip routing-table command to view the effective routing entries on the device. Make sure the device and NTP server are reachable to reach other. · Log in to the NTP server and execute the display ntp-service status command to view the value of the Clock status field. If the value is unsynchronized, let the NTP server clock to be synchronized. · Check the NTP authentication settings on the NTP client and server. Make sure the authentication settings are the same on the two sides. · Check the ntp-service acl and ntp-service ipv6 acl command settings. Make sure the NTP server has access to the NTP service on the local device. · Execute the display clock command on both the NTP client and server to view the system date and time. If the clock on the NTP server is correct, execute the ntp-service time-offset-threshold command on the device to reconfigure the clock offset threshold. · Execute the display ntp-service status command on the NTP server to check whether the values of the Root delay, Root dispersion, and Clock stratum parameters meet the requirements. If they do not meet the requirements, adjust the NTP server parameters or replace the NTP server. |
NTP_SERVER_NORMAL
|
Message text |
NTP server state returned to normal. |
|
Variable fields |
N/A |
|
Severity level |
3 |
|
Example |
NTP/3/NTP_SERVER_NORMAL: NTP server state returned to normal. |
|
Explanation |
NTP server state changed from abnormal to normal. |
|
Recommended action |
No action is required. |
NTP_SESSION_LIMIT
|
Message text |
The number of NTP sessions exceeded the upper limit of 128: CurrentSessionNumber=[UINT32]. |
|
Variable fields |
$1: Number of current NTP sessions. |
|
Severity level |
4 |
|
Example |
NTP/4//NTP_SESSION_LIMIT: The number of NTP sessions exceeded the upper limit of 128: CurrentSessionNumber=128. |
|
Explanation |
The device supports a maximum number of 128 concurrent NTP sessions, including static and dynamic sessions. This log is generated when the number of concurrent NTP sessions reaches 128. |
|
Recommended action |
Use the undo peer command to delete unused NTP sessions. |
NTP_SOURCE_CHANGE
|
Message text |
NTP server's IP address changed from [STRING] to [STRING]. |
|
Variable fields |
$1: IP address of the original time source. $2: IP address of the new time source. |
|
Severity level |
5 |
|
Example |
NTP/5/NTP_SOURCE_CHANGE: NTP server's IP address changed from 1.1.1.1 to 1.1.1.2. |
|
Explanation |
The system changed the time source. |
|
Recommended action |
No action is required. |
NTP_SOURCE_LOST
|
Message text |
Lost synchronization with NTP server with IP address [STRING]. |
|
Variable fields |
$1: IP address. |
|
Severity level |
4 |
|
Example |
NTP/4/NTP_SOURCE_LOST: Lost synchronization with NTP server with IP address 1.1.1.1. |
|
Explanation |
The clock source of the NTP association is in unsynchronized state or it is unreachable. |
|
Recommended action |
1. Verify the NTP server and network connection. 2. For NTP server failures: ¡ Use the ntp-service unicast-server command to specify a new NTP server. ¡ Use the ntp-service multicast-client command to configure the device to operate in NTP multicast client mode and receive NTP multicast packets from a new NTP server. 3. If the problem persists, contract H3C Support. |
NTP_STEP_SET_TIME
|
Message text |
Failed to set system time in the one-step adjustment process. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
NTP/4//NTP_STEP_SET_TIME: Failed to set system time in the one-step adjustment process. |
|
Explanation |
This log is generated when the system time fails to be set in the one-step adjustment process. |
|
Recommended action |
No action is required. |
NTP_STRATUM_CHANGE
|
Message text |
System stratum changed from [UINT32] to [UINT32] after clock update. |
|
Variable fields |
$1: Original stratum. $2: Current stratum. |
|
Severity level |
5 |
|
Example |
NTP/5/NTP_STRATUM_CHANGE: System stratum changed from 6 to 5 after clock update. |
|
Explanation |
System stratum has changed. |
|
Recommended action |
No action is required. |
OFP messages
This section contains OpenFlow messages.
OFC_DATAPATH_CHANNEL_CONNECT
|
Message text |
OpenFlow Controller datapath [STRING], channel with IP address [STRING] connected |
|
Variable fields |
$1: Datapath ID of the OpenFlow instance. $2: IP address of the OpenFlow switch connected to the controller. |
|
Severity level |
5 |
|
Example |
OFC/5/OFC_DATAPATH_CHANNEL_CONNECT: OpenFlow Controller datapath 0x174258ae43182, channel with IP address 169.28.25.123 connected |
|
Explanation |
The OpenFlow instance established an OpenFlow channel with the controller. |
|
Recommended action |
No action is required. |
OFC_DATAPATH_CHANNEL_DISCONNECT
|
Message text |
OpenFlow Controller datapath [STRING], channel with IP address [STRING] disconnected |
|
Variable fields |
$1: Datapath ID of the OpenFlow instance. $2: IP address of the OpenFlow switch connected to the controller. |
|
Severity level |
5 |
|
Example |
OFC/6/OFC_DATAPATH_CHANNEL_DISCONNECT:OpenFlow Controller datapath 0x174258ae43182, channel with IP address 169.28.25.123 disconnected |
|
Explanation |
The OpenFlow channel is disconnected from the controller. |
|
Recommended action |
No action is required. |
OFC_FLOW_ADD
|
Message text |
App [CHAR] added flow entry: [STRING]. |
|
Variable fields |
$1: App ID. $2: Flow entry content. The match field specifies the match fields. The action field specifies the action set. |
|
Severity level |
5 |
|
Example |
OFC/5/OFC_FLOW_ADD: App 1 added flow entry: match(context 0x12a56, ipaddr 1.1.1.1, vxlan id 1), action(set svlan 2, set cvlan 3, modify destination mac 0-0-5, output 11). |
|
Explanation |
An app on the controller deployed information for adding flow entries to the OpenFlow switch. |
|
Recommended action |
No action is required. |
OFC_FLOW_DEL
|
Message text |
App [CHAR] deleted flow entry: [STRING]. |
|
Variable fields |
$1: App ID. $2: Flow entry content. The match field specifies the match fields. The action field specifies the action set. |
|
Severity level |
5 |
|
Example |
OFC/5/OFC_FLOW_DEL: App 1 deleted flow entry: match(context 0x12a56, ipaddr 1.1.1.1, vxlan id 1), action(set svlan 2, set cvlan 3, modify destination mac 0-0-5, output 11). |
|
Explanation |
An app on the controller deployed information for deleting flow entries to the OpenFlow switch. |
|
Recommended action |
No action is required. |
OFC_FLOW_MOD
|
Message text |
App [CHAR] modified flow entry: [STRING]. |
|
Variable fields |
$1: App ID. $2: Flow entry content. The match field specifies the match fields. The action field specifies the action set. |
|
Severity level |
5 |
|
Example |
OFC/5/OFC_FLOW_MOD: App 1 modified flow entry: match(context 0x12a56, ipaddr 1.1.1.1, vxlan id 1), action(set svlan 2, set cvlan 3, modify destination mac 0-0-5, output 11). |
|
Explanation |
An app on the controller deployed information for modifying flow entries to the OpenFlow switch. |
|
Recommended action |
No action is required. |
OFP_ACTIVE
|
Message text |
Activate openflow instance [UINT16]. |
|
Variable fields |
$1: Instance ID. |
|
Severity level |
5 |
|
Example |
OFP/5/OFP_ACTIVE: Activate openflow instance 1. |
|
Explanation |
A command was received from comsh to activate an OpenFlow instance. |
|
Recommended action |
No action is required. |
OFP_ACTIVE_FAILED
|
Message text |
Failed to activate instance [UINT16]. |
|
Variable fields |
$1: Instance ID. |
|
Severity level |
4 |
|
Example |
OFP/4/OFP_ACTIVE_FAILED: Failed to activate instance 1. |
|
Explanation |
An OpenFlow instance failed to be activated. |
|
Recommended action |
No action is required. |
OFP_ACTIVE_MAC_LEARN_FORBIDDEN_F
|
Message text |
Failed to execute the mac-learning forbidden command when activating instance [UINT16] |
|
Variable fields |
$1: Instance ID. |
|
Severity level |
4 |
|
Example |
OFP/4/OFP_ACTIVE_MAC_LEARN_FORBIDDEN_F: Failed to execute the mac-learning forbidden command when activating instance 1 |
|
Explanation |
During activating an OpenFlow instance, the system failed to issue the mac-learning forbidden command probably because the hardware does not support this command. The system automatically deleted the configuration of this command. |
|
Recommended action |
No action is required. |
OFP_CONNECT
|
Message text |
Openflow instance [UINT16], controller [CHAR] is [STRING]. |
|
Variable fields |
$1: Instance ID. $2: Controller ID. $3: Connection status: connected or disconnected. |
|
Severity level |
5 |
|
Example |
OFP/5/OFP_CONNECT: Openflow instance 1, controller 0 is connected. |
|
Explanation |
The status of the connection between an OpenFlow instance and a controller changed. |
|
Recommended action |
No action is required. |
OFP_FAIL_OPEN
|
Message text |
Openflow instance [UINT16] is in fail [STRING] mode. |
|
Variable fields |
$1: Instance ID. $2: Connection interruption mode: secure or standalone. |
|
Severity level |
5 |
|
Example |
OFP/5/OFP_FAIL_OPEN: Openflow instance 1 is in fail secure mode. |
|
Explanation |
An activated instance failed to connect to a controller or was disconnected from all controllers. The connection interruption mode was displayed. |
|
Recommended action |
No action is required. |
OFP_FLOW_ADD
|
Message text |
Openflow instance [UINT16] controller [CHAR]: add flow entry [UINT32], xid 0x[HEX], cookie 0x[HEX], table id [CHAR]. |
|
Variable fields |
$1: Instance ID. $2: Controller ID. $3: Rule ID. $4: XID. $5: Cookie of the flow entry. $6: Table ID. |
|
Severity level |
5 |
|
Example |
OFP/5/OFP_FLOW_ADD: Openflow instance 1 controller 0: add flow entry 1, xid 0x1, cookie 0x0, table id 0. |
|
Explanation |
A flow entry was to be added to a flow table according to a flow table modification message that has passed the packet check. |
|
Recommended action |
No action is required. |
OFP_FLOW_ADD_DUP
|
Message text |
|
|
Variable fields |
$1: Instance ID. $2: Controller ID. $3: Rule ID. $4: XID. $5: Cookie. $6: Table ID. |
|
Severity level |
5 |
|
Example |
|
|
Explanation |
A duplicate flow entry was added. |
|
Recommended action |
No action is required. |
OFP_FLOW_ADD_FAILED
|
Message text |
Openflow instance [UINT16] controller [CHAR]: failed to add flow entry [UINT32], table id [CHAR]. |
|
Variable fields |
$1: Instance ID. $2: Controller ID. $3: Rule ID. $4: Table ID. |
|
Severity level |
4 |
|
Example |
OFP/4/OFP_FLOW_ADD_FAILED: Openflow instance 1 controller 0: failed to add flow entry1, table id 0. |
|
Explanation |
A flow entry failed to be added. |
|
Recommended action |
No action is required. |
OFP_FLOW_ADD_TABLE_MISS
|
Message text |
Openflow instance [UINT16] controller [CHAR]: add table miss flow entry, xid 0x[HEX], cookie 0x[HEX], table id [CHAR]. |
|
Variable fields |
$1: Instance ID. $2: Controller ID. $3: XID. $4: Cookie of the flow entry. $5: Table ID. |
|
Severity level |
5 |
|
Example |
OFP/5/OFP_FLOW_ADD_TABLE_MISS: Openflow instance 1 controller 0: add table miss flow entry, xid 0x1, cookie 0x0, table id 0. |
|
Explanation |
A table-miss flow entry was to be added to a flow table according to a flow table modification message that has passed the packet check. |
|
Recommended action |
No action is required. |
OFP_FLOW_ADD_TABLE_MISS_FAILED
|
Message text |
Openflow instance [UINT16] controller [CHAR]: failed to add table miss flow entry, table id [CHAR]. |
|
Variable fields |
$1: Instance ID. $2: Controller ID. $3: Table ID. |
|
Severity level |
4 |
|
Example |
OFP/4/OFP_FLOW_ADD_TABLE_MISS_FAILED: Openflow instance 1 controller 0: failed to add table miss flow entry, table id 0. |
|
Explanation |
A table-miss flow entry failed to be added. |
|
Recommended action |
No action is required. |
OFP_FLOW_DEL
|
Message text |
Openflow instance [UINT16] controller [CHAR]: delete flow entry, xid 0x[HEX], cookie 0x[HEX], table id [STRING]. |
|
Variable fields |
$1: Instance ID. $2: Controller ID. $3: XID. $4: Cookie of the flow entry. $5: Table ID. |
|
Severity level |
5 |
|
Example |
OFP/5/OFP_FLOW_DEL: Openflow instance 1 controller 0: delete flow entry, xid 0x1, cookie 0x0, table id 0. |
|
Explanation |
A list of flow entries were to be deleted according to a flow table modification message that has passed the packet check. |
|
Recommended action |
No action is required. |
OFP_FLOW_DEL_TABLE_MISS
|
Message text |
Openflow instance [UINT16] controller [CHAR]: delete table miss flow entry, xid 0x[HEX], cookie 0x[HEX], table id [STRING]. |
|
Variable fields |
$1: Instance ID. $2: Controller ID. $3: XID. $4: Cookie of the flow entry. $5: Table ID. |
|
Severity level |
5 |
|
Example |
OFP/5/OFP_FLOW_DEL_TABLE_MISS: Openflow instance 1 controller 0: delete table miss flow entry, xid 0x1, cookie 0x0, table id 0. |
|
Explanation |
A list of table-miss flow entries were to be deleted according to a flow table modification message that has passed the packet check. |
|
Recommended action |
No action is required. |
OFP_FLOW_DEL_TABLE_MISS_FAILED
|
Message text |
Openflow instance [UINT16] controller [CHAR]: failed to delete table miss flow entry, table id [STRING]. |
|
Variable fields |
$1: Instance ID. $2: Controller ID. $3: Table ID. |
|
Severity level |
4 |
|
Example |
OFP/4/OFP_FLOW_DEL_TABLE_MISS_FAILED: Openflow instance 1 controller 0: failed to delete table miss flow entry, table id 0. |
|
Explanation |
A table-miss flow entry failed to be deleted. |
|
Recommended action |
No action is required. |
OFP_FLOW_MOD
|
Message text |
Openflow instance [UINT16] controller [CHAR]: modify flow entry, xid 0x[HEX], cookie 0x[HEX], table id [CHAR]. |
|
Variable fields |
$1: Instance ID. $2: Controller ID. $3: XID. $4: Cookie of the flow entry. $5: Table ID. |
|
Severity level |
5 |
|
Example |
OFP/5/OFP_FLOW_MOD: Openflow instance 1 controller 0: modify flow entry, xid 0x1, cookie 0x0, table id 0. |
|
Explanation |
A list of flow entries were to be modified according to a flow table modification message that has passed the packet check. |
|
Recommended action |
No action is required. |
OFP_FLOW_MOD_FAILED
|
Message text |
Openflow instance [UINT16] controller [CHAR]: failed to modify flow entry, table id [CHAR]. |
|
Variable fields |
$1: Instance ID. $2: Controller ID. $3: Table ID. |
|
Severity level |
4 |
|
Example |
OFP/4/OFP_FLOW_MOD_FAILED: Openflow instance 1 controller 0: failed to modify flow entry, table id 0. |
|
Explanation |
A flow entry failed to be modified. |
|
Recommended action |
Retry to modify the flow entry. If the flow entry still cannot be modified, delete it. |
OFP_FLOW_MOD_TABLE_MISS
|
Message text |
Openflow instance [UINT16] controller [CHAR]: modify table miss flow entry, xid 0x[HEX], cookie 0x[HEX], table id [CHAR]. |
|
Variable fields |
$1: Instance ID. $2: Controller ID. $3: XID. $4: Cookie of the flow entry. $5: Table ID. |
|
Severity level |
5 |
|
Example |
OFP/5/OFP_FLOW_MOD_TABLE_MISS: Openflow instance 1 controller 0: modify table miss flow entry, xid 0x1, cookie 0x0, table id 0. |
|
Explanation |
A list of table-miss flow entries were to be modified according to a flow table modification message that has passed the packet check. |
|
Recommended action |
No action is required. |
OFP_FLOW_MOD_TABLE_MISS_FAILED
|
Message text |
Openflow instance [UINT16] controller [CHAR]: failed to modify table miss flow entry, table id [CHAR]. |
|
Variable fields |
$1: Instance ID. $2: Controller ID. $3: Table ID. |
|
Severity level |
4 |
|
Example |
OFP/4/OFP_FLOW_MOD_TABLE_MISS_FAILED: Openflow instance 1 controller 0: failed to modify table miss flow entry, table id 0. |
|
Explanation |
A table-miss flow entry failed to be modified. |
|
Recommended action |
Retry to modify the table-miss flow entry. If the entry still cannot be modified, delete it. |
OFP_FLOW_RMV_GROUP
|
Message text |
The flow entry [UINT32] in table [CHAR] of instance [UINT16] was deleted with a group_mod message. |
|
Variable fields |
$1: Rule ID. $2: Table ID. $3: Instance ID. |
|
Severity level |
5 |
|
Example |
|
|
Explanation |
A flow entry was deleted due to a group modification message. |
|
Recommended action |
No action is required. |
OFP_FLOW_RMV_HARDTIME
|
Message text |
|
|
Variable fields |
$1: Rule ID. $2: Table ID. $3: Instance ID. |
|
Severity level |
5 |
|
Example |
|
|
Explanation |
A flow entry was deleted because of a hard time expiration. |
|
Recommended action |
No action is required. |
OFP_FLOW_RMV_IDLETIME
|
Message text |
|
|
Variable fields |
$1: Rule ID. $2: Table ID. $3: Instance ID. |
|
Severity level |
5 |
|
Example |
|
|
Explanation |
A flow entry was deleted because of an idle time expiration. |
|
Recommended action |
No action is required. |
OFP_FLOW_RMV_METER
|
Message text |
The flow entry [UINT32] in table [CHAR] of instance [UINT16] was deleted with a meter_mod message. |
|
Variable fields |
$1: Rule ID. $2: Table ID. $3: Instance ID. |
|
Severity level |
5 |
|
Example |
|
|
Explanation |
A flow entry was deleted due to a meter modification message. |
|
Recommended action |
No action is required. |
OFP_FLOW_UPDATE_FAILED
|
Message text |
OpenFlow instance [UINT16] table [CHAR]: failed to update or synchronize flow entry [UINT32]. |
|
Variable fields |
$1: Instance ID. $2: Controller ID. $3: Table ID. |
|
Severity level |
4 |
|
Example |
OFP/4/OFP_FLOW_UPDATE_FAILED: OpenFlow instance 1 table 0: failed to update or synchronize flow entry 10000. |
|
Explanation |
When an active/standby switchover occurred, the new active MPU failed to update flow entries. When a new interface card was installed on the device, the interface card failed to synchronize flow entries from the MPUs. When a master/subordinate switchover occurred in an IRF fabric, the new master device failed to update flow entries. When new member devices were added to an IRF fabric, the new member devices failed to synchronize flow entries from the master device. |
|
Recommended action |
Delete the flow entries that fail to be deployed. |
OFP_GROUP_ADD
|
Message text |
Openflow instance [UINT16] controller [CHAR]: add group [STRING], xid 0x[HEX]. |
|
Variable fields |
$1: Instance ID. $2: Controller ID. $3: Group ID. $4: XID. |
|
Severity level |
5 |
|
Example |
OFP/5/OFP_GROUP_ADD: Openflow instance 1 controller 0: add group 1, xid 0x1. |
|
Explanation |
A group entry was to be added to a group table according to a group table modification message that has passed the packet check. |
|
Recommended action |
No action is required. |
OFP_GROUP_ADD_FAILED
|
Message text |
Openflow instance [UINT16] controller [CHAR]: failed to add group [STRING]. |
|
Variable fields |
$1: Instance ID. $2: Controller ID. $3: Group ID. |
|
Severity level |
4 |
|
Example |
OFP/4/OFP_GROUP_ADD_FAILED: Openflow Instance 1 controller 0: failed to add group 1. |
|
Explanation |
A group entry failed to be added. |
|
Recommended action |
No action is required. |
OFP_GROUP_DEL
|
Message text |
Openflow instance [UINT16] controller [CHAR]: delete group [STRING], xid [HEX]. |
|
Variable fields |
$1: Instance ID. $2: Controller ID. $3: Group ID. $4: XID. |
|
Severity level |
5 |
|
Example |
OFP/5/OFP_GROUP_DEL: Openflow instance 1 controller 0: delete group 1, xid 0x1. |
|
Explanation |
A group entry was to be deleted according to a group table modification message that has passed the packet check. |
|
Recommended action |
No action is required. |
OFP_GROUP_MOD
|
Message text |
Openflow instance [UINT16] controller [CHAR]: modify group [STRING], xid 0x[HEX]. |
|
Variable fields |
$1: Instance ID. $2: Controller ID. $3: Group ID. $4: XID. |
|
Severity level |
5 |
|
Example |
OFP/5/OFP_GROUP_MOD: Openflow instance 1 controller 0: modify group 1, xid 0x1. |
|
Explanation |
A group entry was to be modified according to a group table modification message that has passed the packet check. |
|
Recommended action |
No action is required. |
OFP_GROUP_MOD_FAILED
|
Message text |
Openflow instance [UINT16] controller [CHAR]: failed to modify group [STRING]. |
|
Variable fields |
$1: Instance ID. $2: Controller ID. $3: Group ID. |
|
Severity level |
4 |
|
Example |
OFP/4/OFP_GROUP_MOD_FAILED: Openflow instance 1 controller 0: failed to modify group 1. |
|
Explanation |
A group entry failed to be modified. |
|
Recommended action |
Retry to modify the group entry. If the group entry still cannot be modified, delete it. |
OFP_METER_ADD
|
Message text |
Openflow instance [UINT16] controller [CHAR]: add meter [STRING], xid 0x[HEX]. |
|
Variable fields |
$1: Instance ID. $2: Controller ID. $3: Meter ID. $4: XID. |
|
Severity level |
5 |
|
Example |
OFP/5/OFP_METER_ADD: Openflow instance 1 controller 0: add meter 1, xid 0x1. |
|
Explanation |
A meter entry was to be added to a meter table. |
|
Recommended action |
No action is required. |
OFP_METER_ADD_FAILED
|
Message text |
Openflow instance [UINT16] controller [CHAR]: failed to add meter [STRING]. |
|
Variable fields |
$1: Instance ID. $2: Controller ID. $3: Meter ID. |
|
Severity level |
4 |
|
Example |
OFP/4/OFP_METER_ADD_FAILED: Openflow Instance 1 controller 0: failed to add meter 1. |
|
Explanation |
A meter entry failed to be added. |
|
Recommended action |
No action is required. |
OFP_METER_DEL
|
Message text |
Openflow instance [UINT16] controller [CHAR]: delete meter [STRING], xid 0x[HEX]. |
|
Variable fields |
$1: Instance ID. $2: Controller ID. $3: Meter ID. $4: XID. |
|
Severity level |
5 |
|
Example |
OFP/5/OFP_METER_DEL: Openflow instance 1 controller 0: delete meter 1, xid 0x1. |
|
Explanation |
A meter entry was to be deleted according to a meter table modification message that has passed the packet check. |
|
Recommended action |
No action is required. |
OFP_METER_MOD
|
Message text |
Openflow instance [UINT16] controller [CHAR]: modify meter [STRING], xid 0x[HEX]. |
|
Variable fields |
$1: Instance ID. $2: Controller ID. $3: Meter ID. $4: XID. |
|
Severity level |
5 |
|
Example |
OFP/5/OFP_METER_MOD: Openflow Instance 1 controller 0: modify meter 1, xid 0x1. |
|
Explanation |
A meter entry was to be modified according to a meter table modification message that has passed the packet check. |
|
Recommended action |
No action is required. |
OFP_METER_MOD_FAILED
|
Message text |
Openflow instance [UINT16] controller [CHAR]: failed to modify meter [STRING]. |
|
Variable fields |
$1: Instance ID. $2: Controller ID. $3: Meter ID. |
|
Severity level |
4 |
|
Example |
OFP/4/OFP_METER_MOD_FAILED: Openflow instance 1 controller 0: failed to modify meter 1. |
|
Explanation |
A meter entry failed to be modified. |
|
Recommended action |
Retry to modify the meter entry. If the meter entry still cannot be modified, delete it. |
OFP_MISS_RMV_GROUP
|
Message text |
The table-miss flow entry in table [CHAR] of instance [UINT16] was deleted with a group_mod message. |
|
Variable fields |
$1: Table ID. $2: Instance ID. |
|
Severity level |
5 |
|
Example |
|
|
Explanation |
The table-miss flow entry was deleted due to a group modification message. |
|
Recommended action |
No action is required. |
OFP_MISS_RMV_HARDTIME
|
Message text |
|
|
Variable fields |
$1: Table ID. $2: Instance ID. |
|
Severity level |
5 |
|
Example |
|
|
Explanation |
The table-miss flow entry was deleted because of a hard time expiration. |
|
Recommended action |
No action is required. |
OFP_MISS_RMV_IDLETIME
|
Message text |
|
|
Variable fields |
$1: Table ID. $2: Instance ID. |
|
Severity level |
5 |
|
Example |
|
|
Explanation |
The table-miss flow entry was deleted because of an idle time expiration. |
|
Recommended action |
No action is required. |
OFP_MISS_RMV_METER
|
Message text |
The table-miss flow entry in table [CHAR] of instance [UINT16] was deleted with a meter_mod message. |
|
Variable fields |
$1: Table ID. $2: Instance ID. |
|
Severity level |
5 |
|
Example |
|
|
Explanation |
The table-miss flow entry was deleted due to a meter modification message. |
|
Recommended action |
No action is required. |
OPTMOD messages
This section contains transceiver module messages.
BIAS_HIGH
|
Message text |
[STRING]: Bias current is high. |
|
Variable fields |
$1: Interface type and number. |
|
Severity level |
2 |
|
Example |
OPTMOD/2/BIAS_HIGH: GigabitEthernet1/0/1: Bias current is high. |
|
Explanation |
The bias current of the transceiver module exceeded the high threshold. |
|
Recommended action |
1. Execute the display transceiver diagnosis interface command to verify that the bias current of the transceiver module has exceeded the high threshold. 2. Execute the display transceiver alarm interface command to verify that a high bias current alarm for the transceiver module has been generated and not cleared. 3. Replace the transceiver module. |
BIAS_LOW
|
Message text |
[STRING]: Bias current is low. |
|
Variable fields |
$1: Interface type and number. |
|
Severity level |
3 |
|
Example |
OPTMOD/3/BIAS_LOW: GigabitEthernet1/0/1: Bias current is low. |
|
Explanation |
The bias current of the transceiver module went below the low threshold. |
|
Recommended action |
1. Execute the display transceiver diagnosis interface command to verify that the bias current of the transceiver module is below the low threshold. 2. Execute the display transceiver alarm interface command to verify that a low bias current alarm for the transceiver module has been generated and not cleared. 3. Replace the transceiver module. |
BIAS_NORMAL
|
Message text |
[STRING]: Bias current is normal. |
|
Variable fields |
$1: Interface type and number. |
|
Severity level |
3 |
|
Example |
OPTMOD/3/BIAS_NORMAL: GigabitEthernet1/0/1: Bias current is normal. |
|
Explanation |
The bias current of the transceiver module returned to the acceptable range. |
|
Recommended action |
No action is required. |
CFG_ERR
|
Message text |
[STRING]: Transceiver type and port configuration mismatched. |
|
Variable fields |
$1: Interface type and number. |
|
Severity level |
3 |
|
Example |
OPTMOD/3/CFG_ERR: GigabitEthernet1/0/1: Transceiver type and port configuration mismatched. |
|
Explanation |
The transceiver module type does not match the port configurations. |
|
Recommended action |
Check for the transceiver module type and the current port configurations. If they mismatch, replace the transceiver module or update the port configurations. |
CHKSUM_ERR
|
Message text |
[STRING]: Transceiver information checksum error. |
|
Variable fields |
$1: Interface type and number. |
|
Severity level |
3 |
|
Example |
OPTMOD/3/CHKSUM_ERR: GigabitEthernet1/0/1: Transceiver information checksum error . |
|
Explanation |
Checksum verification on the register information on the transceiver module failed. |
|
Recommended action |
Replace the transceiver module, or contact H3C Support. |
FIBER_SFP MODULE_INVALID
|
Message text |
[STRING]: This transceiver module is not compatible with the interface card. HP does not guarantee the correct operation of the transceiver module. The transceiver module will be invalidated in [UINT32] days. Please replace it with a compatible one as soon as possible. |
|
Variable fields |
$1: Interface type and number. $2: Number of days that the transceiver module will be invalid. |
|
Severity level |
4 |
|
Example |
OPTMOD/4/FIBER_SFPMODULE_INVALID: GigabitEthernet1/0/1: This transceiver module is not compatible with the interface card. HP does not guarantee the correct operation of the transceiver module. The transceiver module will be invalidated in 3 days. Please replace it with a compatible one as soon as possible. |
|
Explanation |
The transceiver module is not compatible with the interface card. |
|
Recommended action |
Replace the transceiver module. |
FIBER_SFPMODULE_NOWINVALID
|
Message text |
[STRING]: This is not a supported transceiver for this platform. HP does not guarantee the normal operation or maintenance of unsupported transceivers. Please review the platform datasheet on the HP web site or contact your HP sales rep for a list of supported transceivers. |
|
Variable fields |
$1: Interface type and number. |
|
Severity level |
4 |
|
Example |
OPTMOD/4/FIBER_SFPMODULE_NOWINVALID: GigabitEthernet1/0/1: This is not a supported transceiver for this platform. HP does not guarantee the normal operation or maintenance of unsupported transceivers. Please review the platform datasheet on the HP web site or contact your HP sales rep for a list of supported transceivers. |
|
Explanation |
The system does not support the transceiver module. |
|
Recommended action |
Replace the transceiver module. |
IO_ERR
|
Message text |
[STRING]: The transceiver information I/O failed. |
|
Variable fields |
$1: Interface type and number. |
|
Severity level |
3 |
|
Example |
OPTMOD/3/IO_ERR: GigabitEthernet1/0/1: The transceiver information I/O failed. |
|
Explanation |
The device failed to access the register information of the transceiver module. |
|
Recommended action |
Execute the display transceiver diagnosis interface and display transceiver alarm interface commands. If both commands fail to be executed, the transceiver module is faulty. Replace the transceiver module. |
MOD_ALM_OFF
|
Message text |
[STRING]: [STRING] was removed. |
|
Variable fields |
$1: Interface type and number. $2: Fault type. |
|
Severity level |
3 |
|
Example |
OPTMOD/3/MOD_ALM_OFF: GigabitEthernet1/0/1: Module_not_ready was removed.. |
|
Explanation |
A fault was removed from the transceiver module. |
|
Recommended action |
No action is required. |
MOD_ALM_ON
|
Message text |
[STRING]: [STRING] was detected. |
|
Variable fields |
$1: Interface type and number. $2: Fault type. |
|
Severity level |
3 |
|
Example |
OPTMOD/3/MOD_ALM_ON: GigabitEthernet1/0/1: Module_not_ready was detected. |
|
Explanation |
A fault was detected on the transceiver module. |
|
Recommended action |
1. Execute the display transceiver alarm interface command to verify that a corresponding alarm for the fault has been generated and not cleared. 2. Replace the transceiver module. |
MODULE_IN
|
Message text |
[STRING]: The transceiver is [STRING]. |
|
Variable fields |
$1: Interface type and number. $2: Type of the transceiver module. |
|
Severity level |
4 |
|
Example |
OPTMOD/4/MODULE_IN: GigabitEthernet1/0/1: The transceiver is 1000_BASE_T_AN_SFP. |
|
Explanation |
When a transceiver module is inserted, the OPTMOD module generates the message to display the transceiver module type. |
|
Recommended action |
No action is required. |
MODULE_OUT
|
Message text |
[STRING]: Transceiver absent. |
|
Variable fields |
$1: Interface type and number. |
|
Severity level |
4 |
|
Example |
OPTMOD/4/MODULE_OUT: GigabitEthernet1/0/1: Transceiver absent. |
|
Explanation |
The transceiver module was removed. |
|
Recommended action |
No action is required. |
OPTICAL_WARNING_CLEAR
|
Message text |
Transceiver warning alarm cleared. (PhysicalIndex=<[UINT]>, PhysicalName=<[STRING]>, RelativeResource=<[STRING]>, ErrorCode=<[UINT]>, Reason=<[STRING]>) |
|
Variable fields |
$1: Entity index. $2: Entity name. $3: Failure location. $4: Error code. $5: Failure reason. |
|
Severity level |
4 |
|
Example |
OPTMOD/4/OPTICAL_WARNING_CLEAR: Transceiver warning alarm cleared. (PhysicalIndex=8833, PhysicalName=HGE1/3/0/7, RelativeResource=1/3/0, ErrorCode=600060, Reason=Transceiver RXCDR_unlock detected. Lane = 1.) |
|
Explanation |
The transceiver module alarm was removed. |
|
Recommended action |
No action is required. |
OPTICAL_WARNING_OCCUR
|
Message text |
Transceiver warning alarm occurred. (PhysicalIndex=<[UINT]>, PhysicalName=<[STRING]>, RelativeResource=<[STRING]>, ErrorCode=<[UINT]>, Reason=<[STRING]>) |
|
Variable fields |
$1: Entity index. $2: Entity name. $3: Failure location. $4: Error code. $5: Failure reason. |
|
Severity level |
4 |
|
Example |
OPTMOD/4/OPTICAL_WARNING_OCCUR: Transceiver warning alarm occurred. (PhysicalIndex=8833, PhysicalName=HGE1/3/0/7, RelativeResource=1/3/0, ErrorCode=600060, Reason=Transceiver RXCDR_unlock detected. Lane = 1.) |
|
Explanation |
A transceiver module alarm occurred. |
|
Recommended action |
1. Ensure secure connection betwee the fiber and transceiver module. 2. Remove the transceiver module and then reinsert it into the fiber port. 3. Verify that the module where the transceiver module is installed is operating correctly. 4. Take actions based on the fault ID. 5. If the issue persists, contact H3C Support. |
OPTMOD_COUNTERFEIT_MODULE
|
Message text |
The following transceiver you are using is suspected to be a counterfeit/pirated/unauthorized H3C transceiver, which might cause compatibility problems and expose your device to security threats. Please contact H3C for further detection and verification promptly. [STRING]: Transceiver type [STRING], SN [STRING]. |
|
Variable fields |
$1: Interface type and number. $2: Transceiver type. $3: Transceiver sequence number. |
|
Severity level |
3 |
|
Example |
OPTMOD/3/OPTMOD_COUNTERFEIT_MODULE: The following transceiver you are using is suspected to be a counterfeit/pirated/unauthorized H3C transceiver, which might cause compatibility problems and expose your device to security threats. Please contact H3C for further detection and verification promptly. GigabitEthernet1/0/1: Transceiver type 1000_BASE_SX_SFP, SN 2013AYU0711103. GigabitEthernet1/0/2: Transceiver type 1000_BASE_SX_SFP, SN 2013AYU0711103. |
|
Explanation |
This log is generated when a probably counterfeited H3C transceiver module is detected. For a counterfeit H3C transceiver module, you cannot obtain any data from the display transceiver diagnosis command. |
|
Recommended action |
Contact Technical Support. |
OPTMOD_MODULE_CHECK
|
Message text |
An H3C transceiver is detected. Please go to the website www.h3c.com to verify its authenticity. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
OPTMOD/6/OPTMOD_MODULE_CHECK: An H3C transceiver is detected. Please go to the website www.h3c.com to verify its authenticity. |
|
Explanation |
The log is generated when an H3C transceiver module is detected. It reminds the user to verify the authenticity of the transceiver module from the H3C website (www.h3c.com). |
|
Recommended action |
No action is required. |
PHONY_MODULE
|
Message text |
[STRING]: A non-H3C transceiver is detected. Please confirm the label of the transceiver. If there is an H3C Logo, it is suspected to be a counterfeit H3C transceiver. This transceiver is NOT sold by H3C. H3C therefore shall NOT guarantee the normal function of the device or assume the maintenance responsibility thereof! |
|
Variable fields |
$1: Interface type and number. |
|
Severity level |
4 |
|
Example |
OPTMOD/4/PHONY_MODULE: GigabitEthernet1/0/1: A non-H3C transceiver module is detected. Please confirm the label of the transceiver. If there is an H3C Logo, it is suspected to be a counterfeit H3C transceiver. This transceiver is NOT sold by H3C. H3C therefore shall NOT guarantee the normal function of the device or assume the maintenance responsibility thereof! |
|
Explanation |
This log is generated when a non-H3C transceiver module is detected. |
|
Recommended action |
Purchase and use genuine H3C transceiver modules for the device. |
RX_ALM_OFF
|
Message text |
STRING]: [STRING] was removed. |
|
Variable fields |
$1: Interface type and number. $2: RX fault type. |
|
Severity level |
3 |
|
Example |
OPTMOD/3/RX_ALM_OFF: GigabitEthernet1/0/1: RX_not_ready was removed. |
|
Explanation |
An RX fault was removed from the transceiver module. |
|
Recommended action |
No action is required. |
RX_ALM_ON
|
Message text |
[STRING]: [STRING] was detected. |
|
Variable fields |
$1: Interface type and number. $2: RX fault type. |
|
Severity level |
3 |
|
Example |
OPTMOD/3/RX_ALM_ON: GigabitEthernet1/0/1: RX_not_ready was detected. |
|
Explanation |
An RX fault was detected on the transceiver module. |
|
Recommended action |
1. Execute the display transceiver alarm interface command to verify that a corresponding alarm for the fault has been generated and not cleared. 2. Replace the transceiver module. |
RX_POW_HIGH
|
Message text |
[STRING]: RX power is high. |
|
Variable fields |
$1: Interface type and number. |
|
Severity level |
3 |
|
Example |
OPTMOD/3/RX_POW_HIGH: GigabitEthernet1/0/1: RX power is high. |
|
Explanation |
The RX power of the transceiver module exceeded the high threshold. |
|
Recommended action |
1. Execute the display transceiver diagnosis interface command to verify that the RX power of the transceiver module has exceeded the high threshold. 2. Execute the display transceiver alarm interface command to verify that a high RX power alarm for the transceiver module has been generated and not cleared. 3. Replace the transceiver module. |
RX_POW_LOW
|
Message text |
[STRING]: RX power is low. |
|
Variable fields |
$1: Interface type and number. |
|
Severity level |
3 |
|
Example |
OPTMOD/3/RX_POW_LOW: GigabitEthernet1/0/1: RX power is low. |
|
Explanation |
The RX power of the transceiver module went below the low threshold. |
|
Recommended action |
1. Execute the display transceiver diagnosis interface command to verify that the RX power of the transceiver module is below the low threshold. 2. Execute the display transceiver alarm interface command to verify that a low RX power alarm for the transceiver module has been generated and not cleared. 3. Replace the transceiver module. |
RX_POW_NORMAL
|
Message text |
[STRING]: RX power is normal. |
|
Variable fields |
$1: Interface type and number. |
|
Severity level |
3 |
|
Example |
OPTMOD/3/RX_POW_NORMAL: GigabitEthernet1/0/1: RX power is normal. |
|
Explanation |
The RX power of the transceiver module returned to the acceptable range. |
|
Recommended action |
No action is required. |
TEMP_HIGH
|
Message text |
[STRING]: Temperature is high. |
|
Variable fields |
$1: Interface type and number |
|
Severity level |
3 |
|
Example |
OPTMOD/3/TEMP_HIGH: GigabitEthernet1/0/1: Temperature is high. |
|
Explanation |
The temperature of the transceiver module exceeded the high threshold. |
|
Recommended action |
1. Verify that the fan trays are operating correctly. ¡ If there are no fan trays, install fan trays. ¡ If the fan trays fail, replace the fan trays. 2. Verify that the ambient temperature is in the acceptable range. If it is out of the acceptable range, take measures to lower the temperature. 3. Replace the transceiver module. |
TEMP_LOW
|
Message text |
[STRING]: Temperature is low. |
|
Variable fields |
$1: Interface type and number. |
|
Severity level |
3 |
|
Example |
OPTMOD/3/TEMP_LOW: GigabitEthernet1/0/1: Temperature is low. |
|
Explanation |
The temperature of the transceiver module went below the low threshold. |
|
Recommended action |
1. Verify that the ambient temperature is in the acceptable range. If it is out of the acceptable range, take measures to raise the temperature. 2. Replace the transceiver module. |
TEMP_NORMAL
|
Message text |
[STRING]: Temperature is normal. |
|
Variable fields |
$1: Interface type and number. |
|
Severity level |
3 |
|
Example |
OPTMOD/3/TEMP_NORMAL: GigabitEthernet1/0/1: Temperature is normal. |
|
Explanation |
The temperature of the transceiver module returned to the acceptable range. |
|
Recommended action |
No action is required. |
TX_ALM_OFF
|
Message text |
[STRING]: [STRING] was removed. |
|
Variable fields |
$1: Interface type and number. $2: TX fault type. |
|
Severity level |
3 |
|
Example |
OPTMOD/3/TX_ALM_OFF: GigabitEthernet1/0/1: TX_fault was removed. |
|
Explanation |
A TX fault was removed from the transceiver module. |
|
Recommended action |
No action is required. |
TX_ALM_ON
|
Message text |
[STRING]: [STRING] was detected. |
|
Variable fields |
$1: Interface type and number. $2: TX fault type. |
|
Severity level |
3 |
|
Example |
OPTMOD/3/TX_ALM_ON: GigabitEthernet1/0/1: TX_fault was detected. |
|
Explanation |
A TX fault was detected on the transceiver module. |
|
Recommended action |
1. Execute the display transceiver alarm interface command to verify that a corresponding alarm for the fault has been generated and not cleared. 2. Replace the transceiver module. |
TX_POW_HIGH
|
Message text |
[STRING]: TX power is high. |
|
Variable fields |
$1: Interface type and number. |
|
Severity level |
2 |
|
Example |
OPTMOD/2/TX_POW_HIGH: GigabitEthernet1/0/1: TX power is high. |
|
Explanation |
The TX power of the transceiver module exceeded the high threshold. |
|
Recommended action |
1. Execute the display transceiver diagnosis interface command to verify that the TX power of the transceiver module has exceeded the high threshold. 2. Execute the display transceiver alarm interface command to verify that a high TX power alarm for the transceiver module has been generated and not cleared. 3. Replace the transceiver module. |
TX_POW_LOW
|
Message text |
[STRING]: TX power is low. |
|
Variable fields |
$1: Interface type and number. |
|
Severity level |
3 |
|
Example |
OPTMOD/3/TX_POW_LOW: GigabitEthernet1/0/1: TX power is low. |
|
Explanation |
The TX power of the transceiver module went below the low threshold. |
|
Recommended action |
1. Execute the display transceiver diagnosis interface command to verify that the TX power of the transceiver module is below the low threshold. 2. Execute the display transceiver alarm interface command to verify that a low TX power alarm for the transceiver module has been generated and not cleared. 3. Replace the transceiver module. |
TX_POW_NORMAL
|
Message text |
[STRING]: TX power is normal. |
|
Variable fields |
$1: Interface type and number. |
|
Severity level |
3 |
|
Example |
OPTMOD/3/TX_POW_NORMAL: GigabitEthernet1/0/1: TX power is normal. |
|
Explanation |
The TX power of the transceiver module returned to the acceptable range. |
|
Recommended action |
No action is required. |
TYPE_ERR
|
Message text |
[STRING]: The transceiver type is not supported by port hardware. |
|
Variable fields |
$1: Interface type and number. |
|
Severity level |
3 |
|
Example |
OPTMOD/3/TYPE_ERR: GigabitEthernet1/0/1: The transceiver type is not supported by port hardware. |
|
Explanation |
The transceiver module is not supported by the port. |
|
Recommended action |
Replace the transceiver module. |
VOLT_HIGH
|
Message text |
[STRING]: Voltage is high. |
|
Variable fields |
$1: Interface type and number |
|
Severity level |
3 |
|
Example |
OPTMOD/3/VOLT_HIGH: GigabitEthernet1/0/1: Voltage is high. |
|
Explanation |
The voltage of the transceiver module exceeded the high threshold. |
|
Recommended action |
1. Execute the display transceiver diagnosis interface command to verify that the voltage of the transceiver module has exceeded the high threshold. 2. Execute the display transceiver alarm interface command to verify that a high voltage alarm for the transceiver module has been generated and not cleared. 3. Replace the transceiver module. |
VOLT_LOW
|
Message text |
[STRING]: Voltage is low. |
|
Variable fields |
$1: Interface type and number. |
|
Severity level |
3 |
|
Example |
OPTMOD/3/VOLT_LOW: GigabitEthernet1/0/1: Voltage is low. |
|
Explanation |
The voltage of the transceiver module went below the low threshold. |
|
Recommended action |
1. Execute the display transceiver diagnosis interface command to verify that the voltage of the transceiver module is below the low threshold. 2. Execute the display transceiver alarm interface command to verify that a low voltage alarm for the transceiver module has been generated and not cleared. 3. Replace the transceiver module. |
VOLT_NORMAL
|
Message text |
[STRING]: Voltage is normal. |
|
Variable fields |
$1: Interface type and number. |
|
Severity level |
3 |
|
Example |
OPTMOD/3/VOLT_NORMAL: GigabitEthernet1/0/1: Voltage is normal. |
|
Explanation |
The voltage of the transceiver module returned to the acceptable range. |
|
Recommended action |
No action is required. |
OSPF messages
This section contains OSPF messages.
OSPF_ADJSID_CONFLICT
|
Message text |
OSPF [UINT16] failed to allocate adjacent SID [UINT32] to interface [STRING] because of SID conflict. |
|
Variable fields |
$1: OSPF process ID. $2: Adjacency SID. $3: Interface name. |
|
Severity level |
4 |
|
Example |
OSPF/4/OSPF_ADJSID_CONFLICT: OSPF 1 failed to allocate adjacent SID 15010 to interface Route-Aggregation1 because of SID conflict. |
|
Explanation |
The configured adjacency SID is being used by another interface. |
|
Recommended action |
Verify that the configured adjacency SID is free by using the display mpls label command to view MPLS label information. |
OSPF_CANNOT_ENTER_HELPER
|
Message text |
OSPF [ProcessId] cannot act as GR helper on interface [STRING] due to [STRING]. (RouterID=[STRING], AreaID=[STRING], NbrIPAddr=[STRING], NbrRtrID=[STRING]) |
|
Variable fields |
$1: OSPF process ID. $2: Interface name. $3: Reason why the OSPF process cannot enter GR helper mode: · HelperDisable—The process is not enabled with the helper capability. · GRConfigMismatch—The GR helper and restarter settings do not match. · NbrNotFull—The neighbor is not in Full state. · RxmtChgLSA—The retransmission list of the restarting neighbor contains changed LSAs. · GRPeriodError—GR period error. · GRReasonError—GR reason error. $4: Router ID of the local process. $5: OSPF area ID. $6: IP address of the neighbor. $7: Router ID of the neighbor. |
|
Severity level |
6 |
|
Example |
OSPF/6/OSPF_CANNOT_ENTER_HELPER: OSPF 1 cannot act as GR helper on interface GE1/0/1 due to GRPeriodError. (RouterID=1.1.1.1, AreaID=0.0.0.1, NbrIPAddr=10.1.1.12, NbrRtrID=2.2.2.2) |
|
Explanation |
Reason why the OSPF process cannot enter GR helper mode. |
|
Recommended action |
Check the associated settings according to the specific reason. |
OSPF_DUP_RTRID_NBR
|
Message text |
OSPF [UINT16] Duplicate router ID [STRING] on interface [STRING], sourced from IP address [IPADDR]. |
|
Variable fields |
$1: OSPF process ID. $2: Router ID. $3: Interface name. $4: IP address. |
|
Severity level |
4 |
|
Example |
OSPF/4/OSPF_DUP_RTRID_NBR: OSPF 1 Duplicate router ID 11.11.11.11 on interface GigabitEthernet0/0/3, sourced from IP address 11.2.2.2. |
|
Explanation |
Two directly connected devices were configured with the same router ID. |
|
Recommended action |
Modify the router ID on one device and use the reset ospf process command to make the new router ID take effect. |
OSPF_IF_CONFIG_ERROR
|
Message text |
OSPF [UINT16] dropped a [STRING] packet on interface [STRING] due to incorrect configuration. (RouterID=[STRING], AreaID=[STRING], PacketSrc=[STRING], ConfigErrorType=[STRING]) |
|
Variable fields |
$1: OSPF process ID. $2: Packet type. Options include Hello, DD, LSR, LSU, and LSAck. $3: Interface name. $4: Router ID. $5: OSPF area ID. $6: Source IP address of the packet. $7: Error type: · VersionMismatch—Version number mismatch. · AreaMismatch—Area mismatch. · UnknownNbmaNbr—Unknown NBMA neighbor. · UnknownVirNbr—Unknown virtual link neighbor. · AuthTypeMismatch—Authentication type mismatch. · AuthCheckFail—Authentication failure. · NetworkMaskMismatch—Network mask mismatch. · HelloTimeMismatch—Hello time mismatch. · DeadTimeMismatch—Dead timer mismatch. · OptionMismatch—Option field mismatch. · MtuMismatch—MTU mismatch. · RouterIdConflict—Router ID conflict. · OtherReason—Unknown error. |
|
Severity level |
4 |
|
Example |
OSPF/4/OSPF_IF_CONFIG_ERROR: OSPF 1 dropped a Hello packet on interface GE1/0/1 due to incorrect configuration. (RouterID=1.1.1.1, AreaID=0.0.0.1, PacketSrc=10.10.1.1, ConfigErrorType= HelloTimeMismatch) |
|
Explanation |
Reason why the OSPF interface discarded the received hello packet. |
|
Recommended action |
Verify that the two ends have consistent settings. |
OSPF_IP_CONFLICT_INTRA
|
Message text |
OSPF [UINT16] Received newer self-originated network-LSAs. Possible conflict of IP address [IPADDR] in area [STRING] on interface [STRING]. |
|
Variable fields |
$1: OSPF process ID. $2: IP address. $3: OSPF area ID. $4: Interface name. |
|
Severity level |
6 |
|
Example |
OSPF/6/OSPF_IP_CONFLICT_INTRA: OSPF 1 Received newer self-originated network-LSAs. Possible conflict of IP address 11.1.1.1 in area 0.0.0.1 on interface GigabitEthernet0/0/3. |
|
Explanation |
The interfaces on two devices in the same OSPF area might have the same primary IP address. At least one of the devices is a DR. |
|
Recommended action |
Modify IP address configuration after you make sure no router ID conflict occurs in the same OSPF area. |
OSPF_LAST_NBR_DOWN
|
Message text |
OSPF [UINT32] Last neighbor down event: Router ID: [STRING] Local address: [STRING] Remote address: [STRING] Reason: [STRING] |
|
Variable fields |
$1: OSPF process ID. $2: Router ID. $3: Local IP address. $4: Neighbor IP address. $5: Reason. |
|
Severity level |
6 |
|
Example |
OSPF/6/OSPF_LAST_NBR_DOWN: OSPF 1 Last neighbor down event: Router ID: 2.2.2.2 Local address: 10.1.1.1 Remote address: 10.1.1.2 Reason: Dead Interval timer expired. |
|
Explanation |
The device records the OSPF neighbor down event caused by a specific reason. |
|
Recommended action |
· When a down event occurred because of configuration changes (for example, interface parameter changes), check for the configuration errors. · When a down event occurred because of dead interval expiration, check for the dead interval configuration error and loss of network connectivity. · When a down event occurred because of BFD session down, check for the BFD detection time configuration error and loss of network connectivity. · When a down event occurred because of interface status changes, check for loss of network connectivity. |
OSPF_LDP_SYNC_STATUS
|
Message text |
The LDP synchronization state of OSPF [UINT16] interface [STRING] changed from [STRING] to [STRING]. (AreaId=[STRING]) |
|
Variable fields |
$1: OSPF process ID. $2: Interface name. $3: Previous state of the local device. Options include: · INIT—Initialized state. · HOLD_MAX_COST—Keeps the maximum cost advertised in the IGP route. · SYNC_ACHIEVED—Synchronization completed. · UNKNOWN—Unknown state. $4: Current state of the local device. Options include: · INIT—Initialized state. · HOLD_MAX_COST—Keeps the maximum cost advertised in the IGP route. · SYNC_ACHIEVED—Synchronization completed. · UNKNOWN—Unknown state. |
|
Severity level |
6 |
|
Example |
OSPF/6/OSPF_LDP_SYNC_STATUS: The LDP synchronization state of OSPF 1 interface GE1/0/1 changed from HOLD_MAX_COST to SYNC_ACHIEVED. (AreaId=[0.0.0.0]) |
|
Explanation |
The LDP synchronization state changed. |
|
Recommended action |
No action is required. |
OSPF_LSDB_APPROACH_OVERFLOW
|
Message text |
The number of AS-external LSAs in the OSPF [UINT16] LSDB is approaching the limit [UINT32]. |
|
Variable fields |
$1: OSPF process ID. $2: Maximum number of external routes in the LSDB. |
|
Severity level |
6 |
|
Example |
OSPF/6/OSPF_LSDB_APPROACH_OVERFLOW: The number of AS-external LSAs in the OSPF 1 LSDB is approaching the limit 10000. |
|
Explanation |
The number of external routes in the LSDB reached 90% of the upper limit. |
|
Recommended action |
Check the LSDB. If the issue exists, you can adjust the upper limit by using the lsdb-overflow-limit command, or contact H3C Support. |
OSPF_LSDB_OVERFLOW_ACTIVE
|
Message text |
The number of AS-external LSAs in the LSDB of OSPF [UINT16] has exceeded the limit [UINT]. |
|
Variable fields |
$1: OSPF process ID. $2: Maximum number of external routes in the LSDB. |
|
Severity level |
5 |
|
Example |
OSPF/5/OSPF_LSDB_OVERFLOW_ACTIVE: The number of AS-external LSAs in the LSDB of OSPF 1 has exceeded the limit 10000. |
|
Explanation |
The number of external routes in the LSDB exceeded the upper limit. |
|
Recommended action |
Check the LSDB. If the issue exists, you can adjust the upper limit by using the lsdb-overflow-limit command. If the issue does not exist, contact H3C Support. |
OSPF_LSDB_OVERFLOW_CLEAR
|
Message text |
The number of AS-external LSAs in the LSDB of OSPF [UINT16] has dropped below the limit [UINT]. |
|
Variable fields |
$1: OSPF process ID. $2: Maximum number of external routes in the LSDB. |
|
Severity level |
6 |
|
Example |
OSPF/6/OSPF_LSDB_OVERFLOW_CLEAR: The number of AS-external LSAs in the LSDB of OSPF 1 has dropped below the limit 10000. |
|
Explanation |
The number of external routes in the LSDB dropped below the upper limit set by the lsdb-overflow-limit command. |
|
Recommended action |
No action is required. |
OSPF_MEM_ALERT
|
Message text |
OSPF Process received system memory alert [STRING] event. |
|
Variable fields |
$1: Type of the memory alarm. |
|
Severity level |
5 |
|
Example |
OSPF/5/OSPF_MEM_ALERT: OSPF Process received system memory alert start event. |
|
Explanation |
OSPF received a memory alarm. |
|
Recommended action |
Check the system memory and release memory for the modules that occupy too many memory resources. |
OSPF_NBR_CHG
|
Message text |
OSPF [UINT32] Neighbor [STRING] ([STRING]) changed from [STRING] to [STRING] |
|
Variable fields |
$1: OSPF process ID. $2: Neighbor router ID. $3: Interface name. $4: Old adjacency state. $5: New adjacency state. |
|
Severity level |
3 |
|
Example |
OSPF/3/OSPF_NBR_CHG: OSPF 1 Neighbor 2.2.2.2 (Vlan-interface100) changed from Full to Down. |
|
Explanation |
The OSPF adjacency state changed on an interface. |
|
Recommended action |
When the adjacency with a neighbor changes from Full to another state on an interface, check for OSPF configuration errors and loss of network connectivity. |
OSPF_NBR_CHG_REASON
|
Message text |
OSPF [UINT32] Area [STRING] Router [STRING]([STRING]) CPU usage: [STRING], VPN name: [STRING], IfMTU: [UINT32], Neighbor address: [STRING], NbrID [STRING] changed from [STRING] to [STRING] at [STRING]. Last 4 hello packets received at: [STRING] Last 4 hello packets sent at: [STRING] |
|
Variable fields |
$1: OSPF process ID. $2: Area ID. $3: Router ID. $4: Abbreviated interface name. $5: CPU usage. $6: VPN instance name. $7: Interface MTU. $8: IP address of the neighbor. $9: Router ID of the neighbor. $10: Original neighbor state. $11: New neighbor state and the state change cause. $12: Time when the neighbor state changed. $13: Time when the last four hello packets were received before neighbor state change. $14: Time when the last four hello packets were sent before neighbor state change. |
|
Severity level |
5 |
|
Example |
OSPF/5/OSPF_NBR_CHG_REASON: OSPF 1 Area 0.0.0.0 Router 2.2.2.2(GE1/0/1) CPU usage:3.80%, VPN name: a, IfMTU:1500, Neighbor address:10.1.1.2, NbrID:1.1.1.1 changed from Full to Down because OSPF interface parameters changed at 2019-04-01 15:20:57:034. Last 4 hello packets received at: 2019-09-01 15:19:46:225 2019-09-01 15:19:56:224 2019-09-01 15:20:06:225 2019-09-01 15:20:16:225 Last 4 hello packets sent at: 2019-09-01 15:20:22:033 2019-09-01 15:20:32:033 2019-09-01 15:20:42:032 2019-09-01 15:20:52:033 |
|
Explanation |
The OSPF neighbor state changed on an interface. |
|
Recommended action |
Verify the OSPF settings and the network connectivity. |
OSPF_NBR_GR_HELPER_STATUS
|
Message text |
The GR helper status of OSPF [UINT16]’s neighbor on interface [STRING] changed to [STRING]. (RouterID=[STRING], AreaID=[STRING], NbrIPAddr=[STRING], NbrRtrID=[STRING], GRHelperAge=[UINT], GRHelperExitReason=[STRING]) |
|
Variable fields |
$1: OSPF process ID. $2: Interface name. $3: New state of the GR helper, Normal or Helper. $4: Router ID of the local process. $5: OSPF area ID. $6: IP address of the neighbor. $7: Router ID of the neighbor. $8: Remaining time for the neighbor to complete GR. $9: Reason why the neighbor quits helper state. · Success—GR completes. · Recv1WayHello—A one-way hello packet is received. · RecvNoLRBitHello—A hello packet with the LSDB Resynchronization (LR) bit not set is received. · RecvNoLRBitDD—A DD packet with the LR bit not set is received. · RecvNoEABitDD—A DD packet with the EA bit not set is received. · RecvNoRBitDD—A DD packet with the R bit not set is received. · WaitTimerExpire—The timer expires. · OOBResyncTimerExpire—OOB sync timer expires. · GracePeriodExpire—Grace period expires. · TopoChange—Topology change. · NbrReset—Neighbor restart. |
|
Severity level |
4 |
|
Example |
OSPF/4/OSPF_NBR_GR_HELPER_STATUS: The GR helper status of OSPF 1’s neighbor on interface GE1/0/1 changed to Normal. (RouterID=1.1.1.1, AreaID=0.0.0.0, NbrIPAddr=10.0.0.11, NbrRtrID=2.2.2.2, GRHelperAge=10, GRHelperExitReason=NbrReset) |
|
Explanation |
The GR helper state for the OSPF neighbor changed. |
|
Recommended action |
No action is required if an active/standby switchover or process restart was performed. If no such operations were performed, contact H3C Support. |
OSPF_PEER_FLAPPING_STATUS
|
Message text |
The peer flapping suppression status of OSPF [UINT16] on interface [STRING] changed to [STRING] due to [STRING].(AreaID=[STRING]) |
|
Variable fields |
$1: OSPF process ID. $2: Interface name. $3: Neighbor flapping suppression state. Options include: · NoSuppress—No suppression. · HoldDown—Hold-down mode. · HoldMaxCost—Hold-max-cost mode. $4: Reason for the neighbor flapping suppression state change: · ExitSuppress—Quits the suppression state when the flapping detection resume threshold is reached. · ConfigurationChanged—Configuration change (for example, OSPF process reset). · PeerFlapping—Frequent neighbor flappings. · ExitHoldDownAndEnterHoldMaxCost—Quits the hold-down mode and enter the hold-max-cost mode. $5: OSPF area ID. |
|
Severity level |
6 |
|
Example |
OSPF/6/OSPF_PEER_FLAPPING_STATUS: The peer flapping suppression status of OSPF 1 on interface GE1/0/1 changed to HoldMaxCost due to ExitHoldDownAndEnterHoldMaxCost. (AreaID=0.0.0.0) |
|
Explanation |
Reason why the neighbor flapping suppression state changed for the OSPF interface. |
|
Recommended action |
Check whether frequent neighbor flappings occur on the OSPF interface, and identify the flapping reason. |
OSPF_PREFIX_SID_OVER_RANGE
|
Message text |
OSPF [UINT16] received prefix SID [UINT32]. The prefix SID is not included in the local SRGB range. (Prefix=[STRING], AdvertiseSource=[STRING], localSRGB=[UINT32]-[UINT32]) |
|
Variable fields |
$1: OSPF process ID. $2: Received prefix SID. $3: Prefix address and mask. $4: Advertising source. $5: Minimum value of the local SRGB. $6: Maximum value of the local SRGB. |
|
Severity level |
4 |
|
Example |
OSPF/4/OSPF_PREFIX_SID_OVER_RANGE: OSPF 1 received prefix SID 16020. The prefix SID is not included in the local SRGB range. (Prefix=10.1.1.0/24, AdvertiseSource=2.2.2.2, localSRGB=16000-16010) |
|
Explanation |
OSPF received a remote prefix SID whose value is out of the local SRGB range. |
|
Recommended action |
Edit the remote prefix SID value and make sure the value is in the local SRGB range. |
OSPF_PREFIXSID_CONFLICT
|
Message text |
OSPF failed to allocate prefix SID [UINT32] for IP address [STRING] because of SID conflict. |
|
Variable fields |
$1: Prefix SID. $2: IP address and subnet mask. |
|
Severity level |
4 |
|
Example |
OSPF/4/OSPF_PREFIXSID_CONFLICT: OSPF failed to allocate prefix SID 18020 for IP address 103.0.0.1/32 because of SID conflict. |
|
Explanation |
Prefix SID conflict occurred. |
|
Recommended action |
Execute the display mpls label command to verify that the prefix SID is available. |
OSPF_PREFIXSID_CONFLICT_CLEAR
|
Message text |
OSPF prefix SID conflict is resolved. (PrefixSID=[UINT32], PrefixAddr=[STRING]) |
|
Variable fields |
$1: Prefix label. $2: Prefix address. |
|
Severity level |
5 |
|
Example |
OSPF/5/OSPF_PREFIXSID_CONFLICT_CLEAR: OSPF prefix SID conflict is resolved. (PrefixSID=18020, PrefixAddr=103.0.0.1/32) |
|
Explanation |
The prefix SID conflict was resolved. |
|
Recommended action |
No action is required. |
OSPF_RT_LMT
|
Message text |
OSPF [UINT32] route limit reached. |
|
Variable fields |
$1: OSPF process ID. |
|
Severity level |
4 |
|
Example |
OSPF/4/OSPF_RT_LMT: OSPF 1 route limit reached. |
|
Explanation |
The number of routes of an OSPF process reached the upper limit. |
|
Recommended action |
1. Check for network attacks. 2. Reduce the number of routes. |
OSPF_RTRID_CHG
|
Message text |
OSPF [UINT32] New router ID elected, please restart OSPF if you want to make the new router ID take effect. |
|
Variable fields |
$1: OSPF process ID. |
|
Severity level |
5 |
|
Example |
OSPF/5/OSPF_RTRID_CHG: OSPF 1 New router ID elected, please restart OSPF if you want to make the new router ID take effect. |
|
Explanation |
The OSPF router ID was changed because the user had changed the router ID or the interface IP address used as the router ID had changed. |
|
Recommended action |
Use the reset ospf process command to make the new router ID take effect. |
OSPF_RTRID_CONFLICT_INTER
|
Message text |
OSPF [UINT16] Received newer self-originated ase-LSAs. Possible conflict of router ID [STRING]. |
|
Variable fields |
$1: OSPF process ID. $2: Router ID. |
|
Severity level |
6 |
|
Example |
OSPF/6/OSPF_RTRID_CONFILICT_INTER: OSPF 1 Received newer self-originated ase-LSAs. Possible conflict of router ID 11.11.11.11. |
|
Explanation |
Two indirectly connected devices in the same OSPF area might have the same router ID. One of the devices is an ASBR. |
|
Recommended action |
Modify the router ID on one device and use the reset ospf process command to make the new router ID take effect. |
OSPF_RTRID_CONFLICT_INTRA
|
Message text |
OSPF [UINT16] Received newer self-originated router-LSAs. Possible conflict of router ID [STRING] in area [STRING]. |
|
Variable fields |
$1: OSPF process ID. $2: Router ID. $3: OSPF area ID. |
|
Severity level |
4 |
|
Example |
OSPF/4/OSPF_RTRID_CONFLICT_INTRA: OSPF 1 Received newer self-originated router-LSAs. Possible conflict of router ID 11.11.11.11 in area 0.0.0.1. |
|
Explanation |
Two indirectly connected devices in the same OSPF area might have the same router ID. |
|
Recommended action |
Modify the router ID on one device and use the reset ospf process command to make the new router ID take effect. |
OSPF_VIF_CONFIG_ERROR
|
Message text |
OSPF [UINT16] dropped a [STRING] packet on a virtual interface due to incorrect configuration. (RouterID=[STRING], VirtNbrAreaID=[STRING], VirtNbrRtrID=[STRING], PacketSrc=[STRING], ConfigErrorType=[STRING]) |
|
Variable fields |
$1: OSPF process ID. $2: Packet type. Options include Hello, DD, LSR, LSU, and LSAck. $3: Router ID of the local process. $4: Area ID of the virtual link. $5: Router ID of the virtual link neighbor. $6: Source IP address of the packet. $7: Error type: · VersionMismatch—Version number mismatch. · AreaMismatch—Area mismatch. · AuthTypeMismatch—Authentication type mismatch. · AuthCheckFail—Authentication failure. · NetworkMaskMismatch—Network mask mismatch. · HelloTimeMismatch—Hello time mismatch. · DeadTimeMismatch—Dead timer mismatch. · OptionMismatch—Option field mismatch. · OtherReason—Unknown error. |
|
Severity level |
4 |
|
Example |
OSPF/4/OSPF_VIF_CONFIG_ERROR: OSPF 1 dropped a hello packet on a virtual interface due to incorrect configuration. (RouterID=1.1.1.1, VirtNbrAreaID=0.0.0.1, VirtNbrRtrID=2.2.2.2, PacketSrc=10.0.0.1, ConfigErrorType= HelloTimeMismatch) |
|
Explanation |
Reason why the virtual interface discarded the hello packet. |
|
Recommended action |
Check the virtual interface configuration by executing the display ospf vlink command to resolve the configuration mismatch issue. |
OSPF_VIR_INTF_CHG
|
Message text |
The status of OSPF [UNIT16] virtual interface change to [STRING]. (RouterID=[STRING], VirtIfAreaID=[STRING], VirtNbrRtrID=[STRING]) |
|
Variable fields |
$1: OSPF process ID. $2: Virtual link interface state, Down or P2P. $3: Router ID of the local process. $4: Transit area ID. $5: Router ID of the virtual link neighbor. |
|
Severity level |
6 |
|
Example |
OSPF/6/OSPF_VIR_INTF_CHG: The status of OSPF 1 virtual interface changed to P2P. (RouterID=1.1.1.1, VirtIfAreaID=0.0.0.2, VirtNbrRtrID=10.1.1.3) |
|
Explanation |
The virtual link interface state changed. |
|
Recommended action |
No action is required if the virtual link interface state changed from Down to P2P. If the virtual link interface state changed from P2P to Down, check whether the route associated with the virtual link interface exists. If the route does not exist, identify the reason. If the route exists, check whether the virtual link interface settings are correct on the local and peer ends. |
OSPF_VIR_NBR_GR_HELPER_STATUS
|
Message text |
The GR helper status of OSPF [UINT16]’s virtual neighbor changed to [STRING]. (RouterID=[STRING], VirtNbrAreaID=[STRING], VirtNbrRtrID=[STRING], GRHelperAge=[UINT], GRHelperExitReason=[STRING]) |
|
Variable fields |
$1: OSPF process ID. $2: New state of the GR helper, Normal or Helper. $3: Router ID of the local process. $4: Transit area ID of the virtual link neighbor. $5: Router ID of the virtual link neighbor. $6: Remaining time for the virtual link neighbor to complete GR. $7: Reason why the virtual link neighbor quits helper state. · Success—GR completes. · Recv1WayHello—A one-way hello packet is received. · RecvNoLRBitHello—A hello packet with the LR bit not set is received. · RecvNoLRBitDD—A DD packet with the LR bit not set is received. · RecvNoEABitDD—A DD packet with the EA bit not set is received. · RecvNoRBitDD—A DD packet with the R bit not set is received. · WaitTimerExpire—The timer expires. · OOBResyncTimerExpire—OOB sync timer expires. · GracePeriodExpire—Grace period expires. · TopoChange—Topology change. · NbrReset—Neighbor restart. |
|
Severity level |
4 |
|
Example |
OSPF/4/OSPF_VIR_NBR_GR_HELPER_STATUS: The GR helper status of OSPF 1’s virtual neighbor changed to Normal. (RouterID=1.1.1.1, VirtNbrAreaID=0.0.0.1, VirtNbrRtrID=2.2.2.2, GRHelperAge=112, GRHelperExitReason= Success) |
|
Explanation |
The GR helper state for the OSPF virtual link neighbor changed. |
|
Recommended action |
Execute the display ospf graceful-restart command to check the virtual link neighbor state and GR state. |
OSPF_VLINKID_CHG
|
Message text |
OSPF [UINT32] Router ID changed, reconfigure Vlink on peer |
|
Variable fields |
$1: OSPF process ID. |
|
Severity level |
5 |
|
Example |
OSPF/5/OSPF_VLINKID_CHG:OSPF 1 Router ID changed, reconfigure Vlink on peer |
|
Explanation |
A new OSPF router ID takes effect. |
|
Recommended action |
Check and modify the virtual link configuration on the peer router to match the new router ID. |
OSPFV3 messages
This section contains OSPFv3 messages.
OSPFv3_IF_CONFIG_ERROR
|
Message text |
OSPFv3 [UINT16] dropped a [STRING] packet on interface [STRING] due to incorrect configuration. (RouterID=[STRING], AreaID=[STRING], IfInstID=[UINT8], PacketSrc=[STRING], ConfigErrorType=[STRING]) |
|
Variable fields |
$1: OSPFv3 process ID. $2: Packet type. Options include Hello, DD, LSR, LSU, and LSAck. $3: Interface name. $4: Router ID. $5: Area ID of the interface. $6: Instance ID of the interface. $7: Source IPv6 address of the packet. $7: Error type: · VersionMismatch—Version number mismatch. · AreaMismatch—Area mismatch. · UnknownNbmaNbr—Unknown NBMA neighbor. · AuthTypeMismatch—Authentication type mismatch. · AuthCheckFail—Authentication failure. · HelloTimeMismatch—Hello time mismatch. · DeadTimeMismatch—Dead timer mismatch. · OptionMismatch—Option field mismatch. · MtuMismatch—MTU mismatch. · RouterIdConflict—Router ID conflict. · OtherReason—Unknown error. |
|
Severity level |
4 |
|
Example |
OSPFV3/4/OSPFV3_IF_CONFIG_ERROR: OSPFv3 1 dropped a Hello packet on interface GE1/0/1 due to incorrect configuration. (RouterID=1.1.1.1, AreaID=0.0.0.0, IfInstID=0, PacketSrc=FE80::212, ConfigErrorType=HelloTimeMismatch) |
|
Explanation |
Reason why the OSPFv3 interface discarded the received hello packet. |
|
Recommended action |
Execute the display ospfv3 interface command to verify that the two ends have consistent settings. If the settings are inconsistent, edit the Hello, Dead, and Poll timer settings to make sure they are consistent on the two ends. If the issue persists or the settings cannot be edited, contact H3C Support. |
OSPFV3_LAST_NBR_DOWN
|
Message text |
OSPFv3 [UINT32] Last neighbor down event: Router ID: [STRING] Local interface ID: [UINT32] Remote interface ID: [UINT32] Reason: [STRING]. |
|
Variable fields |
$1: OSPFv3 process ID. $2: Router ID. $3: Local interface ID. $4: Remote interface ID. $5: Reason. |
|
Severity level |
6 |
|
Example |
OSPFV3/6/OSPFV3_LAST_NBR_DOWN: OSPFv3 1 Last neighbor down event: Router ID: 2.2.2.2 Local interface ID: 1111 Remote interface ID: 2222 Reason: Dead Interval timer expired. |
|
Explanation |
The device records the OSPFv3 neighbor down event caused by a specific reason. |
|
Recommended action |
· When a down event occurred because of configuration changes (for example, interface parameter changes), check for the configuration errors. · When a down event occurred because of dead interval expiration, check for the dead interval configuration error and loss of network connectivity. · When a down event occurred because of BFD session down, check for the BFD detection time configuration error and loss of network connectivity. · When a down event occurred because of interface status changes, check for loss of network connectivity. |
OSPFV3_MEM_ALERT
|
Message text |
OSPFV3 Process received system memory alert [STRING] event. |
|
Variable fields |
$1: Type of the memory alarm. |
|
Severity level |
5 |
|
Example |
OSPFV3/5/OSPFV3_MEM_ALERT: OSPFV3 Process received system memory alert start event. |
|
Explanation |
OSPFv3 received a memory alarm. |
|
Recommended action |
Check the system memory and release memory for the modules that occupy too many memory resources. |
OSPFV3_NBR_CHG
|
Message text |
OSPFv3 [UINT32] Neighbor [STRING] ([STRING]) received [STRING] and its state changed from [STRING] to [STRING]. |
|
Variable fields |
$1: Process ID. $2: Neighbor router ID. $3: Interface name. $4: Neighbor event. $5: Old adjacency state. $6: New adjacency state. |
|
Severity level |
3 |
|
Example |
OSPFV3/3/OSPFV3_NBR_CHG: OSPFv3 1 Neighbor 2.2.2.2 (Vlan100) received 1-Way and its state changed from Full to Init. |
|
Explanation |
The OSPFv3 adjacency state changed on an interface. |
|
Recommended action |
When the adjacency with a neighbor changes from Full to another state on an interface, check for OSPFv3 configuration errors and loss of network connectivity. |
OSPFV3_NBR_GR_HELPER_STATUS
|
Message text |
The GR helper status of OSPFv3 [UINT16]’s neighbor on interface [STRING] changed to [STRING]. (RouterID=[STRING], AreaID=[STRING], IfInstID=[UINT8], NbrRtrID=[STRING], GRHelperAge=[UINT], GRHelperExitReason=[STRING]) |
|
Variable fields |
$1: OSPFv3 process ID. $2: Interface name. $3: New state of the GR helper, Normal or Helper. $4: Router ID of the local process. $5: OSPFv3 area ID. $6: Instance ID of the interface. $7: Router ID of the neighbor. $8: Remaining time for the neighbor to complete GR. $9: Reason why the neighbor quits helper state. · Success—GR completes. · GracePeriodExpire—Grace period expires. · LSAChange—LSA change. · NbrReset—Neighbor restart. |
|
Severity level |
4 |
|
Example |
OSPFV3/4/OSPFV3_NBR_GR_HELPER_STATUS: The GR helper status of OSPFv3 1’s neighbor on interface GE1/0/1 changed to Normal. (RouterID=1.1.1.1, AreaID=0.0.0.0, IfInstID=0, NbrRtrID=2.2.2.2, GRHelperAge=10, GRHelperExitReason= NbrReset) |
|
Explanation |
The GR helper state for the OSPFv3 neighbor changed. |
|
Recommended action |
No action is required if an active/standby switchover or process restart was performed. If no such operations were performed, contact H3C Support. |
OSPFV3_RT_LMT
|
Message text |
OSPFv3 [UINT32] route limit reached. |
|
Variable fields |
$1: Process ID. |
|
Severity level |
3 |
|
Example |
OSPFV3/3/OSPFV3_RT_LMT:OSPFv3 1 route limit reached. |
|
Explanation |
The number of routes of an OSPFv3 process reached the upper limit. |
|
Recommended action |
1. Check for network attacks. 2. Reduce the number of routes. |
PBR messages
This section contains PBR messages.
PBR_HARDWARE_BIND_ERROR
|
Message text |
Failed to apply the policy [STRING] to interface [STRING] because of [STRING]. |
|
Variable fields |
$1: Policy name. $2: Interface name. $2: Hardware error reasons: · insufficient hardware resources. · unsupported operations. · insufficient hardware resources and unsupported operations. |
|
Severity level |
4 |
|
Example |
PBR/4/PBR_HARDWARE_BIND_ERROR: Failed to apply the policy abc to interface GigabitEthernet1/0/1 because of unsupported operations. |
|
Explanation |
Failed to apply the unicast policy to the interface. |
|
Recommended action |
Modify the PBR policy configuration according to the failure reason. |
PBR_HARDWARE_ERROR
|
Message text |
Failed to update policy [STRING] due to [STRING]. |
|
Variable fields |
$1: Policy name. $2: Hardware error reasons: · insufficient hardware resources. · unsupported operations. · insufficient hardware resources and unsupported operations. |
|
Severity level |
4 |
|
Example |
PBR/4/PBR_HARDWARE_ERROR: Failed to update policy aaa due to insufficient hardware resources and not supported operations. |
|
Explanation |
The device failed to update PBR configuration. |
|
Recommended action |
Modify the PBR policy configuration according to the failure reason. |
PBR_NEXTHOP_CHANGE
|
Message text |
The link to next hop [IPADDR] of policy [STRING] (node ID: [STRING], VPN instance: [STRING]) changed due to [STRING]. |
|
Variable fields |
$1: Next hop address. $2: Policy name. $3: Node ID. $4: VPN instance name. For the public network, this field displays Public network. $5: Link change reasons: · FIB change—The FIB information changed. · reachable status—The next hop address became reachable. · unreachable status—The next hop address became unreachable. · direct change—The next hop changed from indirect to direct or from direct to indirect. · track change—The track entry status changed. |
|
Severity level |
4 |
|
Example |
PBR/4/PBR_NEXTHOP_CHANGE: The link to next hop 1.1.1.1 of policy a (node ID: 0, VPN instance: Public network) changed due to FIB change. |
|
Explanation |
The link to the next hop of the policy changed. |
|
Recommended action |
Locate and fix the fault according to the link change reason. |
PCE messages
This section contains PCE messages.
PCE_PCEP_SESSION_CHG
|
Message text |
Session ([STRING], [STRING]) is [STRING]. |
|
Variable fields |
$1: Peer address of the session. $2: VPN instance name. Value unknown indicates that the VPN instance cannot be obtained. $3: State of the session, up or down. When the state is down, this field also displays the reason for the down state error. Possible reasons include: · TCP connection down. · received a close message. The device receives a close message from the peer when the peer encounters one of the following situations: ¡ No explanation provided. (The session is closed because the idle time of the session exceeds three minutes.) ¡ DeadTimer expired. ¡ Reception of a malformed PCEP message. ¡ Reception of an unacceptable number of unknown requests/replies. ¡ Reception of an unacceptable number of unrecognized PCEP messages. · reception of a malformed PCEP message. · internal error. · memory in critical state. · dead timer expired. · process deactivated. · remote peer unavailable/untriggered. · reception of an unacceptable number of unrecognized PCEP messages. · reception of an unacceptable number of unknown requests/replies. · PCE address changed. · initialization failed. |
|
Severity level |
3 |
|
Example |
PCE/3/PCE_PCEP_SESSION_CHG: Session (22.22.22.2, public instance) is up. PCE/3/PCE_PCEP_SESSION_CHG: Session (22.22.22.2, public instance) is down (dead timer expired). |
|
Explanation |
The session state changed. |
|
Recommended action |
When the session state is up, no action is required. When the session state is down, verify the network and configuration according to the reason displayed. |
PFILTER messages
This section contains packet filter messages.
PFILTER_GLB_IPV4_DACT_NO_RES
|
Message text |
Failed to apply or refresh the IPv4 default action to the [STRING] direction globally. The resources are insufficient. |
|
Variable fields |
$1: Traffic direction. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_GLB_IPV4_DACT_NO_RES: Failed to apply or refresh the IPv4 default action to the inbound direction globally. The resources are insufficient. |
|
Explanation |
The system failed to perform one of the following actions because hardware resources are insufficient: · Applying the IPv4 default action to a specific direction globally. · Updating the IPv4 default action applied to a specific direction globally. |
|
Recommended action |
Use the display qos-acl resource command to check hardware resource usage. |
PFILTER_GLB_IPV4_DACT_UNK_ERR
|
Message text |
Failed to apply or refresh the IPv4 default action to the [STRING] direction globally. |
|
Variable fields |
$1: Traffic direction. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_GLB_IPV4_DACT_UNK_ERR: Failed to apply or refresh the IPv4 default action to the inbound direction globally. |
|
Explanation |
The system failed to perform one of the following actions due to an unknown error: · Applying the IPv4 default action to a specific direction globally. · Updating the IPv4 default action applied to a specific direction globally. |
|
Recommended action |
No action is required. |
PFILTER_GLB_IPV6_DACT_NO_RES
|
Message text |
Failed to apply or refresh the IPv6 default action to the [STRING] direction globally. The resources are insufficient. |
|
Variable fields |
$1: Traffic direction. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_GLB_IPV6_DACT_NO_RES: Failed to apply or refresh the IPv6 default action to the inbound direction globally. The resources are insufficient. |
|
Explanation |
The system failed to perform one of the following actions because hardware resources are insufficient: · Applying the IPv6 default action to a specific direction globally. · Updating the IPv6 default action applied to a specific direction globally. |
|
Recommended action |
Use the display qos-acl resource command to check hardware resource usage. |
PFILTER_GLB_IPV6_DACT_UNK_ERR
|
Message text |
Failed to apply or refresh the IPv6 default action to the [STRING] direction globally. |
|
Variable fields |
$1: Traffic direction. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_GLB_IPV6_DACT_UNK_ERR: Failed to apply or refresh the IPv6 default action to the inbound direction globally. |
|
Explanation |
The system failed to perform one of the following actions due to an unknown error: · Applying the IPv6 default action to a specific direction globally. · Updating the IPv6 default action applied to a specific direction globally. |
|
Recommended action |
No action is required. |
PFILTER_GLB_MAC_DACT_NO_RES
|
Message text |
Failed to apply or refresh the MAC default action to the [STRING] direction globally. The resources are insufficient. |
|
Variable fields |
$1: Traffic direction. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_GLB_MAC_DACT_NO_RES: Failed to apply or refresh the MAC default action to the inbound direction globally. The resources are insufficient. |
|
Explanation |
The system failed to perform one of the following actions because hardware resources are insufficient: · Applying the MAC default action to a specific direction globally. · Updating the MAC default action applied to a specific direction globally. |
|
Recommended action |
Use the display qos-acl resource command to check hardware resource usage. |
PFILTER_GLB_MAC_DACT_UNK_ERR
|
Message text |
Failed to apply or refresh the MAC default action to the [STRING] direction globally. |
|
Variable fields |
$1: Traffic direction. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_GLB_MAC_DACT_UNK_ERR: Failed to apply or refresh the MAC default action to the inbound direction globally. |
|
Explanation |
The system failed to perform one of the following actions due to an unknown error: · Applying the MAC default action to a specific direction globally. · Updating the MAC default action applied to a specific direction globally. |
|
Recommended action |
No action is required. |
PFILTER_GLB_NO_RES
|
Message text |
Failed to apply or refresh [STRING] ACL [UINT] [STRING] to the [STRING] direction globally. The resources are insufficient. |
|
Variable fields |
$1: ACL type. $2: ACL number. $3: ACL rule ID. $4: Traffic direction. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_GLB_NO_RES: Failed to apply or refresh IPv6 ACL 2000 rule 1 to the inbound direction globally. The resources are insufficient. |
|
Explanation |
The system failed to perform one of the following actions because hardware resources are insufficient: · Applying an ACL rule to a specific direction globally. · Updating an ACL rule applied to a specific direction globally. |
|
Recommended action |
Use the display qos-acl resource command to check hardware resource usage. |
PFILTER_GLB_NOT_SUPPORT
|
Message text |
Failed to apply or refresh [STRING] ACL [UINT] [STRING] to the [STRING] direction globally. The ACL is not supported. |
|
Variable fields |
$1: ACL type. $2: ACL number. $3: ACL rule ID. $4: Traffic direction. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_GLB_NOT_SUPPORT: Failed to apply or refresh IPv6 ACL 2000 rule 1 to the inbound direction globally. The ACL is not supported. |
|
Explanation |
The system failed to perform one of the following actions because the ACL rule is not supported: · Applying an ACL rule to a specific direction globally. · Updating an ACL rule applied to a specific direction globally. |
|
Recommended action |
Verify the ACL configuration and remove the settings that are not supported. |
PFILTER_GLB_ RES_CONFLICT
|
Message text |
Failed to apply or refresh [STRING] ACL [UINT] to the [STRING] direction globally. [STRING] ACL [UINT] has already been applied globally. |
|
Variable fields |
$1: ACL type. $2: ACL number. $3: Traffic direction. $4: ACL type. $5: ACL number. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_GLB_RES_CONFLICT: Failed to apply or refresh IPv6 ACL 2000 to the inbound direction globally. IPv6 ACL 3000 has already been applied globally. |
|
Explanation |
The system failed to perform one of the following actions because an ACL of the same type (IPv4 ACL, IPv6 ACL, or MAC ACL) has already been applied: · Applying the ACL to a specific direction globally. · Updating the ACL applied to a specific direction globally. |
|
Recommended action |
Remove the ACL of the same type. |
PFILTER_GLB_UNK_ERR
|
Message text |
Failed to apply or refresh [STRING] ACL [UINT] [STRING] to the [STRING] direction globally. |
|
Variable fields |
$1: ACL type. $2: ACL number. $3: ACL rule ID. $4: Traffic direction. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_GLB_UNK_ERR: Failed to apply or refresh IPv6 ACL 2000 rule 1 to the inbound direction globally. |
|
Explanation |
The system failed to perform one of the following actions due to an unknown error: · Applying an ACL rule to a specific direction globally. · Updating an ACL rule applied to a specific direction globally. |
|
Recommended action |
No action is required. |
PFILTER_IF_IPV4_DACT_NO_RES
|
Message text |
Failed to apply or refresh the IPv4 default action to the [STRING] direction of interface [STRING]. The resources are insufficient. |
|
Variable fields |
$1: Traffic direction. $2: Interface name. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_IF_IPV4_DACT_NO_RES: Failed to apply or refresh the IPv4 default action to the inbound direction of interface Ethernet 3/1/2. The resources are insufficient. |
|
Explanation |
The system failed to perform one of the following actions because hardware resources are insufficient: · Applying the IPv4 default action to a specific direction of an interface. · Updating the IPv4 default action applied to a specific direction of an interface. |
|
Recommended action |
Use the display qos-acl resource command to check hardware resource usage. |
PFILTER_IF_IPV4_DACT_UNK_ERR
|
Message text |
Failed to apply or refresh the IPv4 default action to the [STRING] direction of interface [STRING]. |
|
Variable fields |
$1: Traffic direction. $2: Interface name. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_IF_IPV4_DACT_UNK_ERR: Failed to apply or refresh the IPv4 default action to the inbound direction of interface Ethernet 3/1/2. |
|
Explanation |
The system failed to perform one of the following actions because an unknown error: · Applying the IPv4 default action to a specific direction of an interface. · Updating the IPv4 default action applied to a specific direction of an interface. |
|
Recommended action |
No action is required. |
PFILTER_IF_IPV6_DACT_NO_RES
|
Message text |
Failed to apply or refresh the IPv6 default action to the [STRING] direction of interface [STRING]. The resources are insufficient. |
|
Variable fields |
$1: Traffic direction. $2: Interface name. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_IF_IPV6_DACT_NO_RES: Failed to apply or refresh the IPv6 default action to the inbound direction of interface Ethernet 3/1/2. The resources are insufficient. |
|
Explanation |
The system failed to perform one of the following actions because hardware resources are insufficient: · Applying the IPv6 default action to a specific direction of an interface. · Updating the IPv6 default action applied to a specific direction of an interface. |
|
Recommended action |
Use the display qos-acl resource command to check hardware resource usage. |
PFILTER_IF_IPV6_DACT_UNK_ERR
|
Message text |
Failed to apply or refresh the IPv6 default action to the [STRING] direction of interface [STRING]. |
|
Variable fields |
$1: Traffic direction. $2: Interface name. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_IF_IPV6_DACT_UNK_ERR: Failed to apply or refresh the IPv6 default action to the inbound direction of interface Ethernet 3/1/2. |
|
Explanation |
The system failed to perform one of the following actions due to an unknown error: · Applying the IPv6 default action to a specific direction of an interface. · Updating the IPv6 default action applied to a specific direction of an interface. |
|
Recommended action |
No action is required. |
PFILTER_IF_MAC_DACT_NO_RES
|
Message text |
Failed to apply or refresh the MAC default action to the [STRING] direction of interface [STRING]. The resources are insufficient. |
|
Variable fields |
$1: Traffic direction. $2: Interface name. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_IF_MAC_DACT_NO_RES: Failed to apply or refresh the MAC default action to the inbound direction of interface Ethernet 3/1/2. The resources are insufficient. |
|
Explanation |
The system failed to perform one of the following actions because hardware resources are insufficient: · Applying the MAC default action to a specific direction of an interface. · Updating the MAC default action applied to a specific direction of an interface. |
|
Recommended action |
Use the display qos-acl resource command to check hardware resource usage. |
PFILTER_IF_MAC_DACT_UNK_ERR
|
Message text |
Failed to apply or refresh the MAC default action to the [STRING] direction of interface [STRING]. |
|
Variable fields |
$1: Traffic direction. $2: Interface name. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_IF_MAC_DACT_UNK_ERR: Failed to apply or refresh the MAC default action to the inbound direction of interface Ethernet 3/1/2. |
|
Explanation |
The system failed to perform one of the following actions due to an unknown error: · Applying the MAC default action to a specific direction of an interface. · Updating the MAC default action applied to a specific direction of an interface. |
|
Recommended action |
No action is required. |
PFILTER_IF_NO_RES
|
Message text |
Failed to apply or refresh [STRING] ACL [UINT] [STRING] to the [STRING] direction of interface [STRING]. The resources are insufficient. |
|
Variable fields |
$1: ACL type. $2: ACL number. $3: ACL rule ID. $4: Traffic direction. $5: Interface name. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_IF_NO_RES: Failed to apply or refresh IPv6 ACL 2000 rule 1 to the inbound direction of interface Ethernet 3/1/2. The resources are insufficient. |
|
Explanation |
The system failed to perform one of the following actions because hardware resources are insufficient: · Applying an ACL rule to a specific direction of an interface. · Updating an ACL rule applied to a specific direction of an interface. |
|
Recommended action |
Use the display qos-acl resource command to check hardware resource usage. |
PFILTER_IF_NOT_SUPPORT
|
Message text |
Failed to apply or refresh [STRING] ACL [UINT] [STRING] to the [STRING] direction of interface [STRING]. The ACL is not supported. |
|
Variable fields |
$1: ACL type. $2: ACL number. $3: ACL rule ID. $4: Traffic direction. $5: Interface name. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_IF_NOT_SUPPORT: Failed to apply or refresh IPv6 ACL 2000 rule 1 to the inbound direction of interface Ethernet 3/1/2. The ACL is not supported. |
|
Explanation |
The system failed to perform one of the following actions because the ACL rule is not supported: · Applying an ACL rule to a specific direction of an interface. · Updating an ACL rule applied to a specific direction of an interface. |
|
Recommended action |
Verify the ACL configuration and remove the settings that are not supported. |
PFILTER_IF_RES_CONFLICT
|
Message text |
Failed to apply or refresh [STRING] ACL [UINT] to the [STRING] direction of interface [STRING]. [STRING] ACL [UINT] has already been applied to the interface. |
|
Variable fields |
$1: ACL type. $2: ACL number. $3: Traffic direction. $4: Interface name. $5: ACL type. $6: ACL number. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_IF_RES_CONFLICT: Failed to apply or refresh IPv6 ACL 2000 to the inbound direction of interface Ethernet 3/1/2. IPv6 ACL 3000 has already been applied to the interface. |
|
Explanation |
The system failed to perform one of the following actions because an ACL of the same type (IPv4 ACL, IPv6 ACL, or MAC ACL) has already been applied: · Applying the ACL to a specific direction of an interface. · Updating the ACL applied to a specific direction of an interface. |
|
Recommended action |
Remove the ACL of the same type. |
PFILTER_IF_UNK_ERR
|
Message text |
Failed to apply or refresh [STRING] ACL [UINT] [STRING] to the [STRING] direction of interface [STRING]. |
|
Variable fields |
$1: ACL type. $2: ACL number. $3: ACL rule ID. $4: Traffic direction. $5: Interface name. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_IF_UNK_ERR: Failed to apply or refresh IPv6 ACL 2000 rule 1 to the inbound direction of interface Ethernet 3/1/2. |
|
Explanation |
The system failed to perform one of the following actions due to an unknown error: · Applying an ACL rule to a specific direction of an interface. · Updating an ACL rule applied to a specific direction of an interface. |
|
Recommended action |
No action is required. |
PFILTER_IPV6_STATIS_INFO
|
Message text |
[STRING] ([STRING]): Packet-filter IPv6 [UINT32] [STRING] [STRING] [UINT64] packet(s). |
|
Variable fields |
$1: Destination to which packet filter applies. $2: Traffic direction. $3: ACL number. $4: ID and content of an ACL rule. $5: Number of packets that matched the rule. |
|
Severity level |
6 |
|
Example |
PFILTER/6/PFILTER_IPV6_STATIS_INFO: Ethernet0/4/0 (inbound): Packet-filter IPv6 2000 rule 0 permit source 1:1::/64 logging 1000 packet(s). |
|
Explanation |
The number of packets matching the packet-filter IPv6 ACL rule changed. |
|
Recommended action |
No action is required. |
PFILTER_STATIS_INFO
|
Message text |
[STRING] ([STRING]): Packet-filter [UINT32] [STRING] [UINT64] packet(s). |
|
Variable fields |
$1: Destination to which packet filter applies. $2: Traffic direction. $3: ACL number. $4: ID and content of an ACL rule. $5: Number of packets that matched the rule. |
|
Severity level |
6 |
|
Example |
PFILTER/6/PFILTER_STATIS_INFO: Ethernet0/4/0 (inbound): Packet-filter 2000 rule 0 permit source 1.1.1.1 0 logging 10000 packet(s). |
|
Explanation |
The number of packets matching the packet-filter IPv4 ACL rule changed. |
|
Recommended action |
No action is required. |
PFILTER_VLAN_IPV4_DACT_NO_RES
|
Message text |
Failed to apply or refresh the IPv4 default action to the [STRING] direction of VLAN [UINT16]. The resources are insufficient. |
|
Variable fields |
$1: Traffic direction. $2: VLAN ID. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_VLAN_IPV4_DACT_NO_RES: Failed to apply or refresh the IPv4 default action to the inbound direction of VLAN 1. The resources are insufficient. |
|
Explanation |
The system failed to perform one of the following actions because hardware resources are insufficient: · Applying the IPv4 default action to a specific direction of a VLAN. · Updating the IPv4 default action applied to a specific direction of a VLAN. |
|
Recommended action |
Use the display qos-acl resource command to check hardware resource usage. |
PFILTER_VLAN_IPV4_DACT_UNK_ERR
|
Message text |
Failed to apply or refresh the IPv4 default action to the [STRING] direction of VLAN [UINT16]. |
|
Variable fields |
$1: Traffic direction. $2: VLAN ID. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_VLAN_IPV4_DACT_UNK_ERR: Failed to apply or refresh the IPv4 default action to the inbound direction of VLAN 1. |
|
Explanation |
The system failed to perform one of the following actions due to an unknown error: · Applying the IPv4 default action to a specific direction of a VLAN. · Updating the IPv4 default action applied to a specific direction of a VLAN. |
|
Recommended action |
No action is required. |
PFILTER_VLAN_IPV6_DACT_NO_RES
|
Message text |
Failed to apply or refresh the IPv6 default action to the [STRING] direction of VLAN [UINT16]. The resources are insufficient. |
|
Variable fields |
$1: Traffic direction. $2: VLAN ID. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_VLAN_IPV6_DACT_NO_RES: Failed to apply or refresh the IPv6 default action to the inbound direction of VLAN 1. The resources are insufficient. |
|
Explanation |
The system failed to perform one of the following actions because hardware resources are insufficient: · Applying the IPv6 default action to a specific direction of a VLAN. · Updating the IPv6 default action applied to a specific direction of a VLAN. |
|
Recommended action |
Use the display qos-acl resource command to check hardware resource usage. |
PFILTER_VLAN_IPV6_DACT_UNK_ERR
|
Message text |
Failed to apply or refresh the IPv6 default action to the [STRING] direction of VLAN [UINT16]. |
|
Variable fields |
$1: Traffic direction. $2: VLAN ID. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_VLAN_IPV6_DACT_UNK_ERR: Failed to apply or refresh the IPv6 default action to the inbound direction of VLAN 1. |
|
Explanation |
The system failed to perform one of the following actions due to an unknown error: · Applying the IPv6 default action to a specific direction of a VLAN. · Updating the IPv6 default action applied to a specific direction of a VLAN. |
|
Recommended action |
No action is required. |
PFILTER_VLAN_MAC_DACT_NO_RES
|
Message text |
Failed to apply or refresh the MAC default action to the [STRING] direction of VLAN [UINT16]. The resources are insufficient. |
|
Variable fields |
$1: Traffic direction. $2: VLAN ID. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_VLAN_MAC_DACT_NO_RES: Failed to apply or refresh the MAC default action to the inbound direction of VLAN 1. The resources are insufficient. |
|
Explanation |
The system failed to perform one of the following actions because hardware resources are insufficient: · Applying the MAC default action to a specific direction of a VLAN. · Updating the MAC default action applied to a specific direction of a VLAN. |
|
Recommended action |
Use the display qos-acl resource command to check hardware resource usage. |
PFILTER_VLAN_MAC_DACT_UNK_ERR
|
Message text |
Failed to apply or refresh the MAC default action to the [STRING] direction of VLAN [UINT16]. |
|
Variable fields |
$1: Traffic direction. $2: VLAN ID. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_VLAN_MAC_DACT_UNK_ERR: Failed to apply or refresh the MAC default action to the inbound direction of VLAN 1. |
|
Explanation |
The system failed to perform one of the following actions due to an unknown error: · Applying the MAC default action to a specific direction of a VLAN. · Updating the MAC default action applied to a specific direction of a VLAN. |
|
Recommended action |
No action is required. |
PFILTER_VLAN_NO_RES
|
Message text |
Failed to apply or refresh [STRING] ACL [UINT] [STRING] to the [STRING] direction of VLAN [UINT16]. The resources are insufficient. |
|
Variable fields |
$1: ACL type. $2: ACL number. $3: ACL rule ID. $4: Traffic direction. $5: VLAN ID. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_VLAN_NO_RES: Failed to apply or refresh IPv6 ACL 2000 rule 1 to the inbound direction of VLAN 1. The resources are insufficient. |
|
Explanation |
The system failed to perform one of the following actions because hardware resources are insufficient: · Applying an ACL rule to a specific direction of a VLAN. · Updating an ACL rule applied to a specific direction of a VLAN. |
|
Recommended action |
Use the display qos-acl resource command to check hardware resource usage. |
PFILTER_VLAN_NOT_SUPPORT
|
Message text |
Failed to apply or refresh [STRING] ACL [UINT] [STRING] to the [STRING] direction of VLAN [UINT16]. The ACL is not supported. |
|
Variable fields |
$1: ACL type. $2: ACL number. $3: ACL rule ID. $4: Traffic direction. $5: VLAN ID. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_VLAN_NOT_SUPPORT: Failed to apply or refresh ACL 2000 rule 1 to the inbound direction of VLAN 1. The ACL is not supported. |
|
Explanation |
The system failed to perform one of the following actions because the ACL rule is not supported: · Applying an ACL rule to a specific direction of a VLAN. · Updating an ACL rule applied to a specific direction of a VLAN. |
|
Recommended action |
Verify the ACL configuration and remove the settings that are not supported. |
PFILTER_VLAN_RES_CONFLICT
|
Message text |
Failed to apply or refresh [STRING] ACL [UINT] to the [STRING] direction of VLAN [UINT16]. [STRING] ACL [UINT] has already been applied to the VLAN. |
|
Variable fields |
$1: ACL type. $2: ACL number. $3: Traffic direction. $4: VLAN ID. $5: ACL type. $6: ACL number. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_VLAN_RES_CONFLICT: Failed to apply or refresh IPv6 ACL 2000 to the inbound direction of VLAN 1. IPv6 ACL 3000 has already been applied to the VLAN. |
|
Explanation |
The system failed to perform one of the following actions because an ACL of the same type (IPv4 ACL, IPv6 ACL, or MAC ACL) has already been applied: · Applying the ACL to a specific direction of a VLAN. · Updating the ACL applied to a specific direction of a VLAN. |
|
Recommended action |
Remove the ACL of the same type. |
PFILTER_VLAN_UNK_ERR
|
Message text |
Failed to apply or refresh [STRING] ACL [UINT] [STRING] to the [STRING] direction of VLAN [UINT16]. |
|
Variable fields |
$1: ACL type. $2: ACL number. $3: ACL rule ID. $4: Traffic direction. $5: VLAN ID. |
|
Severity level |
3 |
|
Example |
PFILTER/3/PFILTER_VLAN_UNK_ERR: Failed to apply or refresh ACL 2000 rule 1 to the inbound direction of VLAN 1. |
|
Explanation |
The system failed to perform one of the following actions due to an unknown error: · Applying an ACL rule to a specific direction of a VLAN. · Updating an ACL rule applied to a specific direction of a VLAN. |
|
Recommended action |
No action is required. |
PIM messages
This section contains PIM messages.
CRT_PIM_SG_FAIL
|
Message text |
PIM/4/CRT_PIM_SG_FAIL: Failed to create the (S,G) entry in the multicast routing table. (VPNName=[VPNName], ProtocolType=[ProtocolType], SrcAddr=[SrcAddr], GrpAddr=[GrpAddr] |
|
Variable fields |
VPNName: VPN instance name. ProtocolType: PIM mode, which is PIM-SM or PIM-DM. SrcAddr: Source IP address. GrpAddr: Group IP address. |
|
Severity level |
4 |
|
Example |
PIM/4/CRT_PIM_SG_FAIL: Failed to create the (S,G) entry in the multicast routing table. (VPNName=_public_, ProtocolType=PIM-SM, SrcAddr=10.0.0.10, GrpAddr=30.0.0.10. |
|
Explanation |
This message is generated if a (S,G) entry is created when the maximum number of (S,G) entries already reached. |
|
Recommended action |
1. Use the display multicast global statistics command to check whether the upper limit of (S,G) entries is too low. If yes, proceed to step 2. If not, proceed to step 3. 2. Use the multicast global limit command to increase the upper limit of (S,G) entries. 3. If the problem persists, collect log and configuration information and contact H3C Support. |
CRT_PIM_WC_FAIL
|
Message text |
PIM/4/CRT_PIM_WC_FAIL: Failed to create the (*,G) entry in the multicast routing table. (VPNName=[VPNName], ProtocolType=[ProtocolType], GrpAddr=[GrpAddr] |
|
Variable fields |
VPNName: VPN instance name. ProtocolType: PIM mode, which is PIM-SM or PIM-DM. SrcAddr: Source IP address. GrpAddr: Group IP address. |
|
Severity level |
4 |
|
Example |
PIM/4/CRT_PIM_WC_FAIL: Failed to create the (*,G) entry in the multicast routing table. (VPNName=_public_, ProtocolType=PIM-DM, GrpAddr=10.0.0.10. |
|
Explanation |
This message is generated if a (*,G) entry is created when the maximum number of (*,G) entries already reached. |
|
Recommended action |
1. Use the display multicast global statistics command to check whether the upper limit of (*,G) entries is too low. If yes, proceed to step 2. If not, proceed to step 3. 2. Use the multicast global limit command to increase the upper limit of (*,G) entries. 3. If the problem persists, collect log and configuration information and contact H3C Support. |
PIM_CHANGE_TO_NON_DR
|
Message text |
The interface is no longer a DR. (IfIndex:[UINT32], IfName:[STRING], IfAddr:[UINT32], VPNName:[STRING]). The new DR is [UINT32]. |
|
Variable fields |
$1: Interface index. $2: Interface name. $3: Interface address. $4: VPN instance name. $5: Address of the new DR. |
|
Severity level |
5 |
|
Example |
PIM/5/PIM_CHANGE_TO_NON_DR: The interface is no longer a DR. (IfIndex:12, IfName:iftest,IfAddr:10.1.1.1, VPNName:vpntest). The new DR is 1.1.1.1. |
|
Explanation |
This message is generated when an interface is no longer a DR. When a device receives a hello message with a higher DR priority or the neighbor has a higher IP address, the device becomes a non-DR device. |
|
Recommended action |
If the new DR is not the expected one, configure a lower DR priority or a lower IP address for the new DR. |
PIM_DR_ELECTION
|
Message text |
The interface is elected as a DR. (IfIndex:[UINT32], IfName:[STRING],, IfAddr:[UINT32], VPNName:[STRING]) |
|
Variable fields |
$1: Interface index. $2: Interface name. $3: Interface address. $4: VPN instance name. |
|
Severity level |
5 |
|
Example |
PIM/5/PIM_DR_ELECTION: The interface is elected as a DR. (IfIndex:12, IfName:iftest,, IfAddr:10.1.1.1, VPNName:vpntest) |
|
Explanation |
This message is generated when an interface is elected as a DR. |
|
Recommended action |
The DR election process is as follows: 1. The devices on the shared-media LAN send hello messages to one another. The hello messages contain the DR priority for DR election. The device with the highest DR priority is elected as the DR. 2. The device with the highest IP address wins the DR election under one of following conditions: ¡ All the devices have the same DR election priority. ¡ A device does not support carrying the DR priority in hello messages. If the DR is not the expected one, configure a lower DR priority or a lower IP address for the DR. |
PIM_NBR_DOWN
|
Message text |
[STRING] Neighbor [STRING] ([STRING]) is down. |
|
Variable fields |
$1: VPN instance name. If the PIM neighbor belongs to the public network, this field is not displayed. $2: IP address of the PIM neighbor. $3: Interface name. |
|
Severity level |
4 |
|
Example |
PIM/4/PIM_NBR_DOWN: Neighbor 10.1.1.1(Vlan-interface10) is down. |
|
Explanation |
A PIM neighbor went down. |
|
Recommended action |
Check the PIM configuration and network status. |
PIM_NBR_UP
|
Message text |
[STRING] Neighbor [STRING] ([STRING]) is up. |
|
Variable fields |
$1: VPN instance name. If the PIM neighbor belongs to the public network, this field is not displayed. $2: IP address of the PIM neighbor. $3: Interface name. |
|
Severity level |
4 |
|
Example |
PIM/4/PIM_NBR_UP: Neighbor 10.1.1.1(Vlan-interface10) is up. |
|
Explanation |
A PIM neighbor came up. |
|
Recommended action |
No action is required. |
PIM_ROUTE_THRESHOLD_CLEAR
|
Message text |
PIM/5/PIM_ROUTE_THRESHOLD_CLEAR: The number of existed routing entries falls below the global lower threshold.(LimitType=[LimitType], AddressFamily=[AddressFamily], CurrentCount=[CurrentCount], LimitCount=[LimitCount], ThresholdCount=[ThresholdCount], ReasonType=[ReasonType]). |
|
Variable fields |
· LimitType: PIM entry type. ¡ PIM-SM (*, G) entry ¡ PIM-SM (S, G) entry ¡ PIM-DM (*, G) entry ¡ PIM-DM (S, G) entry CurrentCount: Current number of global PIM entries. LimitCount: Maximum number of global PIM entries allowed. ThresholdCount: Lower limit of global PIM entries that causes a log message to be generated. ReasonType: Entry deleted or Configuration change. |
|
Severity level |
4 |
|
Example |
PIM/4/CRT_PIM_WC_FAIL: Failed to create the (*,G) entry in the multicast routing table. (VPNName=_public_, ProtocolType=PIM-DM, GrpAddr=10.0.0.10. |
|
Explanation |
This message is generated when the ratio of the number of global PIM entries to the Maximum number of global PIM entries allowed falls below the lower limit of global PIM entries. |
|
Recommended action |
No action is required. |
PIM_ROUTE_THRESHOLD_ACTIVE
|
Message text |
PIM/4/PIM_ROUTE_THRESHOLD_ACTIVE: The number of existed routing entries exceeded the global upper threshold.(LimitType=[LimitType], AddressFamily=[AddressFamily], CurrentCount=[CurrentCount], LimitCount=[LimitCount], ThresholdCount=[ThresholdCount], ReasonType=[ReasonType]). |
|
Variable fields |
· LimitType: PIM entry type. ¡ PIM-SM (*, G) entry ¡ PIM-SM (S, G) entry ¡ PIM-DM (*, G) entry ¡ PIM-DM (S, G) entry CurrentCount: Current number of global PIM entries. LimitCount: Maximum number of global PIM entries allowed. ThresholdCount: Upper limit of global PIM entries that causes a log message to be generated. ReasonType: Entry added or Configuration change. |
|
Severity level |
4 |
|
Example |
PIM/4/PIM_ROUTE_THRESHOLD_ACTIVE: The number of existed routing entries exceeded the global upper threshold.(LimitType=PIM-SM, AddressFamily=ipv6, CurrentCount=80, LimitCount=100, ThresholdCount=80, ReasonType=Entry added |
|
Explanation |
This message is generated when the ratio of the number of global PIM entries to the maximum number of global PIM entries allowed reaches the upper limit of global PIM entries. |
|
Recommended action |
1. Use the display multicast global statistics command to check whether the upper limit of PIM entries is too low. If yes, proceed to step 2. If not, proceed to step 3. 2. Use the multicast global limit command to increase the upper limit of PIM entries. 3. If the problem persists, collect log and configuration information and contact H3C Support. |
PIM_ROUTE_EXCEED_CLEAR
|
Message text |
PIM/5/PIM_ROUTE_EXCEED_clear: The number of existed routing entries falls below the global upper limit.(LimitType=[LimitType], AddressFamily=[AddressFamily], CurrentCount=[CurrentCount], LimitCount=[LimitCount],SrcAddr=[SrcAddr], GrpAddr=[GrpAddr], InstanceName=[InstanceName], ReasonType=[ReasonType]). |
|
Variable fields |
· LimitType: PIM entry type. ¡ PIM-SM (*, G) entry ¡ PIM-SM (S, G) entry ¡ PIM-DM (*, G) entry ¡ PIM-DM (S, G) entry CurrentCount: Current number of global PIM entries. LimitCount: Maximum number of global PIM entries allowed. SrcAddr: Source IP address. GrpAddr: Group IP address. InstanceName: VPN instance name. ReasonType: Entry deleted or Configuration change. |
|
Severity level |
4 |
|
Example |
PIM/5/PIM_ROUTE_EXCEED_clear: The number of existed routing entries falls below the global upper limit.(LimitType=PIM-DM, AddressFamily=ipv6, CurrentCount=100, LimitCount=100,SrcAddr=10.0.0.10, GrpAddr=30.0.0.10, InstanceName=_public_, ReasonType=Entry deleted |
|
Explanation |
This message is generated when the number of global PIM entries falls below the maximum number of global PIM entries allowed. |
|
Recommended action |
No action is required. |
PIM_ROUTE_EXCEED_ACTIVE
|
Message text |
PIM/4/PIM_ROUTE_EXCEED_active: The number of existed routing entries exceeded the global upper limit.(LimitType=[LimitType], AddressFamily=[AddressFamily], CurrentCount=[CurrentCount], LimitCount=[LimitCount],SrcAddr=[SrcAddr], GrpAddr=[GrpAddr], InstanceName=[InstanceName], ReasonType=[ReasonType]). |
|
Variable fields |
· LimitType: PIM entry type. ¡ PIM-SM (*, G) entry ¡ PIM-SM (S, G) entry ¡ PIM-DM (*, G) entry ¡ PIM-DM (S, G) entry CurrentCount: Current number of global PIM entries. LimitCount: Maximum number of global PIM entries allowed. SrcAddr: Source IP address. GrpAddr: Group IP address. InstanceName: VPN instance name. ReasonType: Entry deleted or Configuration change. |
|
Severity level |
4 |
|
Example |
PIM/4/PIM_ROUTE_EXCEED_active: The number of existed routing entries exceeded the global upper limit. (LimitType=PIM-DM, AddressFamily=ipv6, CurrentCount=100, LimitCount=100,SrcAddr=10.0.0.10, GrpAddr=30.0.0.10, InstanceName=_public_, ReasonType=Entry added |
|
Explanation |
This message is generated when the number of global PIM entries reaches the maximum number of global PIM entries allowed. |
|
Recommended action |
1. Use the display multicast global statistics command to check whether the maximum number of global PIM entries allowed is too low. If yes, proceed to step 2. If not, proceed to step 3. 2. Use the multicast global limit command to increase the maximum number of global PIM entries allowed. 3. If the problem persists, collect log and configuration information and contact H3C Support. |
PIM_RP_CHANGED
|
Message text |
The RP changes. (RPType:[STRING], GrpAddr:[UNIT32], GrpPfxLen:[UINT32], RPAddr:[UINT32], PimMode:[STRING], Priority:[UINT32], VPNName:[STRING]) |
|
Variable fields |
$1: RP type: ¡ static-rp ¡ auto-rp ¡ bsr-rp ¡ embedded $2: Multicast group address. $3: Mask length for the multicast group address. $4: RP address. $5: PIM mode: PIM-SM or Bidir-PIM. $6: RP priority. $7: VPN instance name. |
|
Severity level |
5 |
|
Example |
PIM/5/PIM_RP_CHANGED: The RP changes. (RPType:static-rp, GrpAddr:224.0.0.0, GrpPfxLen:4, RPAddr:10.1.1.1, PimMode:PIM-SM, Priority:64, VPNName:vpntest) |
|
Explanation |
This message is generated when the RP changes. |
|
Recommended action |
If the new RP is not the expected one, configure the device as a static RP or configure a higher RP priority for the device. |
PING messages
This section contains ping messages.
PING_STATISTICS
|
Message text |
[STRING] statistics for [STRING]: [UINT32] packets transmitted, [UINT32] packets received, [DOUBLE]% packet loss, round-trip min/avg/max/std-dev = [DOUBLE]/[DOUBLE]/[DOUBLE]/[DOUBLE] ms. |
|
Variable fields |
$1: The value can be Ping or Ping6. $2: IP address, IPv6 address, or host name for the destination. $3: Number of sent echo requests. $4: Number of received echo replies. $5: Percentage of unacknowledged packets against the total packets sent. $6: Minimum round-trip delay. $7: Average round-trip delay. $8: Maximum round-trip delay. $9: Standard deviation round-trip delay. |
|
Severity level |
6 |
|
Example |
PING/6/PING_STATISTICS: Ping statistics for 192.168.0.115: 5 packets transmitted, 5 packets received, 0.0% packet loss, round-trip min/avg/max/std-dev = 0.000/0.800/2.000/0.748 ms. |
|
Explanation |
The ping or ping ipv6 command was executed to test the reachability of a destination address on the public network. |
|
Recommended action |
If no ICMP echo reply packets were received, identify whether the interface is up. |
PING_VPN_STATISTICS
|
Message text |
[STRING] statistics for [STRING] in VPN instance [STRING] : [UINT32] packets transmitted, [UINT32] packets received, [DOUBLE]% packet loss, round-trip min/avg/max/std-dev = [DOUBLE]/[DOUBLE]/[DOUBLE]/[DOUBLE] ms. |
|
Variable fields |
$1: The value can be Ping or Ping6. $2: IP address, IPv6 address, or host name for the destination. $3: VPN instance name. $4: Number of sent echo requests. $5: Number of received echo replies. $6: Percentage of unacknowledged packets against the total packets sent. $7: Minimum round-trip delay. $8: Average round-trip delay. $9: Maximum round-trip delay. $10: Standard deviation round-trip delay. |
|
Severity level |
6 |
|
Example |
PING/6/PING_VPN_STATISTICS: Ping statistics for 192.168.0.115 in VPN instance vpn1: 5 packets transmitted, 5 packets received, 0.0% packet loss, round-trip min/avg/max/std-dev = 0.000/0.800/2.000/0.748 ms. |
|
Explanation |
The ping or ping ipv6 command was executed to test the reachability of a destination address in a VPN instance. |
|
Recommended action |
If no ICMP echo reply packets were received, identify whether the interface is up and whether a valid route exists in the routing table. |
PING6_SRV6_STATISTICS
|
Message text |
Ping6 SRv6 statistics: [UINT32] packets transmitted, [UINT32] packets received, [DOUBLE]% packet loss. |
|
Variable fields |
$1: Number of sent echo requests. $2: Number of received echo replies. $3: Percentage of unacknowledged packets against the total packets sent. |
|
Severity level |
6 |
|
Example |
PING/6/PING6_SRV6_STATISTICS: Ping6 SRv6 statistics: 5 packets transmitted, 5 packets received, 0.0% packet loss. |
|
Explanation |
The ping ipv6-sid command was executed to test the reachability of an SRv6 path. |
|
Recommended action |
If no ICMP echo reply packets were received, check the routing and SID information on each node in the SRv6 path. For more information about SRv6, see SRv6 in Segment Routing Configuration Guide. |
PKG messages
This section contains package management messages.
PKG_VERSION_CONSISTENT
|
Message text |
Pattern 1: Software images on slot [STRING] are not consistent with those on the active MPU. The slot will reboot to reload the images of the active MPU. Pattern 2: Software images on chassis [STRING] slot [STRING] are not consistent with those on the local active MPU. The slot will reboot to reload the images of the local active MPU. |
|
Variable fields |
Pattern 1: $1: Slot number. Pattern 2: $1: Chassis number. $2: Slot number. |
|
Severity level |
5 |
|
Example |
Pattern 1: PKG/5/PKG_VERSION_CONSISTENT: Software images on slot 2 are not consistent with those on the active MPU. The slot will reboot to reload the images of the active MPU. Pattern 2: PKG/5/PKG_VERSION_CONSISTENT: Software images on chassis 2 slot 2 are not consistent with those on the local active MPU. The slot will reboot to reload the images of the local active MPU. |
|
Explanation |
It is recommended that you install, uninstall, or upgrade software images when the system is stable. If you perform an installation, uninstallation, or upgrade operation when a card is being started, the results of the operation cannot be synchronized to that card. As a result, the card runs different software images than the active MPU after it completes startup. The system will restart the card to load the new software images from the active MPU. Before the system restarts the card, it prints this log. |
|
Recommended action |
Use the display system stable command to verify that the system is stable before you perform an installation, uninstallation, or upgrade operation. If the System State field displays Stable, the system is stable. |
PKG_VERSION_VM_CONSISTENT
|
Message text |
Software images on [STRING] slot [STRING] are inconsistent with those on the other [STRING]. |
|
Variable fields |
$1: VM type: CTRL-VM, FWD-VM, or BRAS-VM. $2: Slot number. $3: VM type: CTRL-VM, FWD-VM, or BRAS-VM. |
|
Severity level |
5 |
|
Example |
PKG/5/PKG_VERSION_VM_INCONSISTENT: Software images on BRAS-VM slot 66 are inconsistent with those on the other BRAS-VM. |
|
Explanation |
This message is generated if a newly online VM runs a different software version than an existing VM of the same type in the vBRAS-CP. |
|
Recommended action |
Upgrade the software version of the new VM. |
PKI messages
This section contains PKI messages.
PKI_CA_CERT_INVALID
|
Message text |
CA certificate is invalid. Issuer: [STRING]; Subject: [STRING]; Not before: [STRING]; Not after: [STRING]. |
|
Variable fields |
$1: Issuer of the CA certificate. $2: Subject of the CA certificate. $3: Time when the CA certificate becomes valid. $4: Time when the CA certificate expires. |
|
Severity level |
4 |
|
Example |
PKI/4/PKI_CA_CERT_INVALID: CA certificate is invalid, Issuer: C=cn, O=docm, OU=rnd, CN=rootca; Subject: C=cn, O=ccc, OU=ppp, CN=rootca; Not before: 2021-06-28T03:27:46; Not after: 2022-06-29T03:20:34. |
|
Explanation |
The device verifies that the CA certificate is invalid. |
|
Recommended action |
Obtain a new CA certificate by offline import or online request. |
PKI_CA_CERT_VALID
|
Message text |
CA certificate is valid. Issuer: [STRING]; Subject: [STRING]; Not before: [STRING]; Not after: [STRING]. |
|
Variable fields |
$1: Issuer of the CA certificate. $2: Subject of the CA certificate. $3: Time when the CA certificate becomes valid. $4: Time when the CA certificate expires. |
|
Severity level |
5 |
|
Example |
PKI/5/PKI_CA_CERT_VALID: CA certificate is valid, Issuer: C=cn, O=docm, OU=rnd, CN=rootca; Subject: C=cn, O=ccc, OU=ppp, CN=rootca; Not before: 2021-06-28T03:27:46; Not after: 2022-06-29T03:20:34. |
|
Explanation |
The device verifies that the CA certificate is valid. |
|
Recommended action |
No action is required. |
PKI_CRL_INVALID
|
Message text |
CRL is invalid. Issuer: [STRING]; Not before: [STRING]; Not after: [STRING]. |
|
Variable fields |
$1: Issuer of the CRL. $2: Time when the CRL becomes valid. $3: Time when the CRL expires. |
|
Severity level |
4 |
|
Example |
PKI/4/PKI_CRL_INVALID: CRL is invalid, Issuer: /C=cn/O=docm/OU=sec/CN=therootca; Not before: 2021-06-28T03:27:46; Not after: 2022-06-29T03:20:34. |
|
Explanation |
After CRL checking is enabled, the device verifies that the obtained CRL is invalid. |
|
Recommended action |
Obtain a new CRL. |
PKI_CRL_VALID
|
Message text |
CRL is valid. Issuer: [STRING]; Not before: [STRING]; Not after: [STRING]. |
|
Variable fields |
$1: Issuer of the CRL. $2: Time when the CRL becomes valid. $3: Time when the CRL expires. |
|
Severity level |
5 |
|
Example |
PKI/5/PKI_CRL_VALID: CRL is valid, Issuer: /C=cn/O=docm/OU=sec/CN=therootca; Not before: 2021-06-28T03:27:46; Not after: 2022-06-29T03:20:34. |
|
Explanation |
After CRL checking is enabled, the device verifies that the obtained CRL is valid. |
|
Recommended action |
No action is required. |
PKI_GET_CRL_FAIL_HTTP
|
Message text |
Failed to obtain CRL through the HTTP protocol. Domain name: [STRING]; URL path of CRL: [STRING]; VPN instance name: [STRING]. |
|
Variable fields |
$1: PKI domain name. $2: URL of the CRL. $3: VPN instance name. |
|
Severity level |
4 |
|
Example |
PKI/4/PKI_GET_CRL_FAIL_HTTP: Failed to obtain CRL through the HTTP protocol, Domain name: abc; URL path of CRL: http://169.254.0.1/certsrv/mscep/mscep.dll; VPN instance name: abc. |
|
Explanation |
Failed to obtain the CRL through the HTTP protocol. |
|
Recommended action |
Verify that the the device and the CRL repository server have correct configuration and they can communicate with each other. |
PKI_GET_CRL_FAIL_LDAP
|
Message text |
Failed to obtain CRL through the LDAP protocol. Domain name: [STRING]; URL path of CRL: [STRING]; VPN instance name: [STRING]. |
|
Variable fields |
$1: PKI domain name. $2: URL of the CRL . $3: VPN instance name. |
|
Severity level |
4 |
|
Example |
PKI/4/PKI_GET_CRL_FAIL_LDAP: Failed to obtain CRL through the LDAP protocol, Domain name: abc; URL path of CRL: http://169.254.0.1/certsrv/mscep/mscep.dll; VPN instance name: abc. |
|
Explanation |
Failed to obtain the CRL through the LDAP protocol. |
|
Recommended action |
Verify that the device and the LDAP server have correct configuration, and they can communicate with each other. |
PKI_GET_CRL_FAIL_SCEP
|
Message text |
Failed to obtain CRL through the SCEP protocol. Domain name: [STRING]; URL path of certificate: [STRING]; VPN instance name: [STRING]. |
|
Variable fields |
$1: PKI domain name. $2: URL of the certificate. $3: VPN instance name. |
|
Severity level |
4 |
|
Example |
PKI/4/PKI_GET_CRL_FAIL_SCEP: Failed to obtain CRL through the SCEP protocol, Domain name: abc; URL path of certificate: http://4.4.4.1:8080/certsrv/mscep/mscep.dll; VPN instance name: abc. |
|
Explanation |
Failed to obtain the CRL through the SCEP protocol. |
|
Recommended action |
Verify that the the device and the CRL repository server have correct configuration and they can communicate with each other. |
PKI_GET_CRL_SUCCESS_HTTP
|
Message text |
CRL was successfully obtained through the HTTP protocol. Domain name: [STRING]; URL path of CRL: [STRING]; VPN instance name: [STRING]. |
|
Variable fields |
$1: PKI domain name. $2: URL of the CRL. $3: VPN instance name. |
|
Severity level |
5 |
|
Example |
PKI/5/PKI_GET_CRL_SUCCESS_HTTP: CRL is successfully obtained through the HTTP protocol, Domain name: abc; URL path of CRL: http://169.254.0.1/certsrv/mscep/mscep.dll; VPN instance name: abc. |
|
Explanation |
Obtained the CRL successfully through the HTTP protocol. |
|
Recommended action |
No action is required. |
PKI_GET_CRL_SUCCESS_LDAP
|
Message text |
CRL was successfully obtained through the LDAP protocol. Domain name: [STRING]; URL path of CRL: [STRING]; VPN instance name: [STRING]. |
|
Variable fields |
$1: PKI domain name. $2: URL of the CRL. $3: VPN instance name. |
|
Severity level |
5 |
|
Example |
PKI/5/PKI_GET_CRL_SUCCESS_LDAP: CRL is successfully obtained through the LDAP protocol. Domain name: abc; URL path of CRL: http://169.254.0.1/certsrv/mscep/mscep.dll; VPN instance name: abc. |
|
Explanation |
Obtained the CRL successfully through the LDAP protocol. |
|
Recommended action |
No action is required. |
PKI_GET_CRL_SUCCESS_SCEP
|
Message text |
CRL was successfully obtained through the SCEP protocol. Domain name: [STRING]; URL path of certificate: [STRING]; VPN instance name: [STRING]. |
|
Variable fields |
$1: PKI domain name. $2: URL of the certificate. $3: VPN instance name. |
|
Severity level |
5 |
|
Example |
PKI/5/PKI_GET_CRL_SUCCESS_SCEP: CRL is successfully obtained through the SCEP protocol, Domain name: abc; URL path of certificate: http://4.4.4.1:8080/certsrv/mscep/mscep.dll; VPN instance name: abc. |
|
Explanation |
Obtained the CRL successfully through the SCEP protocol. |
|
Recommended action |
No action is required. |
PKI_LOCAL_CERT_HAS_EXPIRED
|
Message text |
Local [STRING] certificate in domain [STRING] has expired for [UINT64] days. |
|
Variable fields |
$1: Functions of the local certificate: · General—For both encryption and signature. · Signature—For signature. · Encryption—For encryption. $2: PKI domain name. $3: Period of time for which the local certificate has expired. |
|
Severity level |
4 |
|
Example |
PKI/4/PKI_LOCAL_CERT_HAS_EXPIRED: Local general certificate in domain abc has expired for 2 days. |
|
Explanation |
With local certificate expiration notification enabled (using the pki certificate logging local-has-expired enable command), when the local certificate has expired, the device sends a notification log message for the certificate at regular intervals of two days. |
|
Recommended action |
Obtain a new local certificate by offline import or online request. |
PKI_LOCAL_CERT_INVALID
|
Message text |
Local certificate is invalid. Domain name: [STRING]; Issuer: [STRING]; Subject: [STRING]; Not before: [STRING]; Not after: [STRING]. |
|
Variable fields |
$1: PKI domain name. $2: Issuer of the local certificate. $3: Subject of the local certificate. $4: Time when the local certificate becomes valid. $5: Time when the local certificate expires. |
|
Severity level |
4 |
|
Example |
PKI/4/PKI_LOCAL_CERT_INVALID: Local certificate is invalid, Domain name:abc; Issuer: C=CN, O=sec, OU=software, CN=abdfdc; Subject: O=OpenCA Labs, OU=Users, CN=abcde abcde-sec; Not before: 2021-06-28T03:27:46; Not after: 2022-06-29T03:20:34. |
|
Explanation |
The device verifies that the obtained local certificate is invalid. |
|
Recommended action |
Obtain a new local certificate by offline import or online request. |
PKI_LOCAL_CERT_VALID
|
Message text |
Local certificate is valid. Domain name: [STRING]; Issuer: [STRING]; Subject: [STRING]; Not before: [STRING]; Not after: [STRING]. |
|
Variable fields |
$1: PKI domain name. $2: Issuer of the local certificate. $3: Subject of the local certificate. $4: Time when the local certificate becomes valid. $5: Time when the local certificate expires. |
|
Severity level |
5 |
|
Example |
PKI/5/PKI_LOCAL_CERT_VALID: Local certificate is valid, Domain name:abc; Issuer: C=CN, O=sec, OU=software, CN=abdfdc; Subject: O=OpenCA Labs, OU=Users, CN=abcde abcde-sec; Not before: 2021-06-28T03:27:46; Not after: 2022-06-29T03:20:34. |
|
Explanation |
The device verifies that the obtained local certificate is valid. |
|
Recommended action |
No action is required. |
PKI_LOCAL_CERT_WILL_EXPIRED
|
Message text |
Local [STRING] certificate in domain [STRING] will expire in [UINT64] days. |
|
Variable fields |
$1: Functions of the local certificate: · General—For both encryption and signature. · Signature—For signature. · Encryption—For encryption. $2: PKI domain name. $3: Remaining validity period of the certificate. |
|
Severity level |
5 |
|
Example |
PKI/5/PKI_LOCAL_CERT_WILL_EXPIRED: Local general certificate in domain abc will expire in 2 days. |
|
Explanation |
With local certificate expiration notification enabled (using the pki certificate logging local-will-expired enable command), when the local certificate is about to expire in 30 days (included), the device sends a notification log message for the certificate at regular intervals of two days. |
|
Recommended action |
Obtain a new local certificate by offline import or online request. |
PKI_REQUEST_LOCAL_CERT_FAIL_LDAP
|
Message text |
Failed to request [STRING] certificate of domain [STRING] through the LDAP protocol. VPN instance name: [STRING]; URL path of certificate: [STRING]; Entity name: [STRING]; Saved certificate file name: [STRING]. |
|
Variable fields |
$1: Functions of the local certificate: · General—For both encryption and signature. · Signature—For signature. · Encryption—For encryption. $2: PKI domain name. $3: VPN instance name. $4: URL of the certificate. $5: PKI entity name. $6: Saved certificate file name. |
|
Severity level |
4 |
|
Example |
PKI/4/PKI_REQUEST_LOCAL_CERT_FAIL_LDAP: Failed to request [STRING] certificate of domain abc through the LDAP protocol. VPN instance name: abc;URL path of certificate: ldap://1.1.2.22:389/CN=mycert; Entity name: abc; Saved certificate file name: lo-8f14e45fceea167a5a36dedd4bea2543-1.cer. |
|
Explanation |
Failed to request a local certificate for the PKI domain through the LDAP protocol. |
|
Recommended action |
Verify that the device and the LDAP server have correct configuration, and they can communicate with each other. |
PKI_REQUEST_LOCAL_CERT_FAIL_SCEP
|
Message text |
Failed to request [STRING] certificate of domain [STRING] through the SCEP protocol. URL path of certificate: [STRING]; Saved certificate file name: [STRING]. |
|
Variable fields |
$1: Functions of the local certificate: · General—For both encryption and signature. · Signature—For signature. · Encryption—For encryption. $2: PKI domain name. $3: URL of the certificate. $4: Saved certificate file name. |
|
Severity level |
4 |
|
Example |
PKI/4/PKI_REQUEST_LOCAL_CERT_FAIL_SCEP: Failed to request general certificate of domain abc through the SCEP protocol, URL path of certificate: http://4.4.4.1:8080/certsrv/mscep/mscep.dll; Saved certificate file name: lo-8f14e45fceea167a5a36dedd4bea2543-1.cer. |
|
Explanation |
Failed to request a local certificate for the PKI domain through the SCEP protocol. |
|
Recommended action |
Verify that the device and the CA server have correct configuration, and they can communicate with each other. |
PKI_REQUEST_LOCAL_CERT_SUCCESS_LDAP
|
Message text |
Requested [STRING] certificate of domain [STRING] successfully through LDAP. VPN instance name: [STRING];URL path of certificate: [STRING]; Entity name: [STRING]; Saved certificate file name: [STRING]. |
|
Variable fields |
$1: Functions of the local certificate: · General—For both encryption and signature. · Signature—For signature. · Encryption—For encryption. $2: PKI domain name. $3: VPN instance name. $4: URL of the certificate. $5: PKI entity name. $6: Saved certificate file name. |
|
Severity level |
5 |
|
Example |
PKI/5/PKI_REQUEST_LOCAL_CERT_SUCCESS_LDAP: Requested general certificate of domain abc successfully through LDAP. VPN instance name: abc;URL path of certificate: ldap://1.1.2.22:389/CN=mycert; Entity name: abc; Saved certificate file name: lo-8f14e45fceea167a5a36dedd4bea2543-1.cer. |
|
Explanation |
Requested a local certificate for the PKI domain successfully through LDAP. |
|
Recommended action |
No action is required. |
PKI_REQUEST_LOCAL_CERT_SUCCESS_SCEP
|
Message text |
Requested [STRING] certificate of domain [STRING] successfully through SCEP. URL path of certificate: [STRING]; Saved certificate file name: [STRING]. |
|
Variable fields |
$1: Functions of the local certificate: · General—For both encryption and signature. · Signature—For signature. · Encryption—For encryption. $2: PKI domain name. $3: URL path of the certificate. $4: Saved certificate file name. |
|
Severity level |
5 |
|
Example |
PKI/5/PKI_REQUEST_LOCAL_CERT_SUCCESS_SCEP: Requested general certificate of domain abc successfully through SCEP, URL path of certificate: http://4.4.4.1:8080/certsrv/mscep/mscep.dll; Saved certificate file name: lo-8f14e45fceea167a5a36dedd4bea2543-1.cer. |
|
Explanation |
Requested a local certificate for the PKI domain successfully through SCEP. |
|
Recommended action |
No action is required. |
PKT2CPU messages
This section contains PKT2CPU messages.
PKT2CPU_NO_RESOURCE
|
Message text |
-Interface=[STRING]-ProtocolType=[UINT32]-MacAddr=[STRING]; The resources are insufficient. -Interface=[STRING]-ProtocolType=[UINT32]-SrcPort=[UINT32]-DstPort=[UINT32]; The resources are insufficient. |
|
Variable fields |
$1: Interface type and number. $2: Protocol type. $3: MAC address or source port. $4: Destination port. |
|
Severity level |
4 |
|
Example |
PKT2CPU/4/PKT2CPU_NO_RESOURCE: -Interface=Ethernet0/0/2-ProtocolType=21-MacAddr=0180-c200-0014; The resources are insufficient. |
|
Explanation |
Hardware resources were insufficient. |
|
Recommended action |
Cancel the configuration. |
PKTCPT
This section contains packet capture messages.
PKTCPT_AP_OFFLINE
|
Message text |
Failed to start packet capture. Reason: AP was offline. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
PKTCPT/6/PKTCPT_AP_OFFLINE: Failed to start packet capture. Reason: AP was offline. |
|
Explanation |
Packet capture failed to start because the AP configured with packet capture was offline. |
|
Recommended action |
1. Verify the AP configuration, and restart packet capture after the AP comes online. 2. If the problem persists, contact H3C Support. |
PKTCPT_AREADY_EXIT
|
Message text |
Failed to start packet capture. Reason: The AP was uploading frames captured during the previous capturing operation. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
PKTCPT/6/PKTCPT_AREADY_EXIT: Failed to start packet capture. Reason: The AP was uploading frames captured during the previous capturing operation. |
|
Explanation |
When packet capture is stopped on the AC, the fit AP might be still uploading the captured frames. This message is generated when the user restarted packet capture at that time. |
|
Recommended action |
1. Restart packet capture later. 2. If the problem persists, contact H3C Support. |
PKTCPT_CONN_FAIL
|
Message text |
Failed to start packet capture. Reason: Failed to connect to the FTP server. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
PKTCPT/6/PKTCPT_CONN_FAIL: Failed to start packet capture. Reason: Failed to connect to the FTP server. |
|
Explanation |
Packet capture failed to start because the device failed to be connected to the FTP server in the same network segment. |
|
Recommended action |
1. Verify that the URL of the FTP server is valid. Possible reasons for an invalid URL include the specified IP address does not exist or is not the FTP server address, and the specified FTP server port is disabled. 2. Verify that the domain name resolution is successful. 3. Verify that the FTP server is reachable for the device configured with packet capture. 4. Verify that the FTP server is online. 5. If the problem persists, contact H3C Support. |
PKTCPT_INVALID_FILTER
|
Message text |
Failed to start packet capture. Reason: Invalid expression for matching packets to be captured. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
PKTCPT/6/PKTCPT_INVALD_FILTER: Failed to start packet capture. Reason: Invalid expression for matching packets to be captured. |
|
Explanation |
Packet capture failed to start because the capture filter expression was invalid. |
|
Recommended action |
1. Correct the capture filter expression. 2. If the problem persists, contact H3C Support. |
PKTCPT_LOGIN_DENIED
|
Message text |
Packet capture aborted. Reason: FTP server login failure. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
PKTCPT/6/PKTCPT_LOGIN_DENIED: Packet capture aborted. Reason: FTP server login failure. |
|
Explanation |
Packet capture stopped because the user failed to log in to the FTP server. |
|
Recommended action |
1. Verify the username and password. 2. If the problem persists, contact H3C Support. |
PKTCPT_MEMORY_ALERT
|
Message text |
Packet capture aborted. Reason: Memory threshold reached. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
PKTCPT/6/PKTCPT_MEMORY_ALERT: Packet capture aborted. Reason: Memory threshold reached. |
|
Explanation |
Packet capture stopped because the memory threshold was reached. |
|
Recommended action |
N/A |
PKTCPT_OPEN_FAIL
|
Message text |
Failed to start packet capture. Reason: File for storing captured frames not opened. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
PKTCPT/6/PKTCPT_OPEN_FAIL: Failed to start packet capture. Reason: File for storing captured frames not opened. |
|
Explanation |
Packer capture failed to start because the file for storing the captured frames cannot be opened. |
|
Recommended action |
1. Verify that the user has the write permission to the file. If the user does not have the write permission, assign the permission to the user. 2. Verify that the specified file has been created and is not used by another feature. If the file is used by another feature, use another file. 3. If the problem persists, contact H3C Support. |
PKTCPT_OPERATION_TIMEOUT
|
Message text |
Failed to start or continue packet capture. Reason: Operation timed out. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
PKTCPT/6/PKTCPT_OPERATION_TIMEOUT: Failed to start or continue packet capture. Reason: Operation timed out. |
|
Explanation |
This message is generated when one of the following situations occurs: · Packet capture failed to start because the FTP server in a different network segment is not reachable and the connection timed out. · Packet capture stopped because the FTP server in a different network segment is offline and uploading the captured frames timed out. |
|
Recommended action |
1. Verify that the FTP server is reachable. 2. Verify that the FTP server is online. 3. If the problem persists, contact H3C Support. |
PKTCPT_SERVICE_FAIL
|
Message text |
Failed to start packet capture. Reason: TCP or UDP port binding faults. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
PKTCPT/6/PKTCPT_SERVICE_FAIL: Failed to start packet capture. Reason: TCP or UDP port binding faults. |
|
Explanation |
Packet capture failed to start because an error occurs during TCP or UDP port binding. |
|
Recommended action |
1. Verify that Wireshark has been closed before you start packet capture. If it is not closed, close Wireshark, and then restart packet capture. 2. Bind a new TCP or UDP port, and then restart packet capture. 3. If the problem persists, contact H3C Support. |
PKTCPT_UNKNOWN_ERROR
|
Message text |
Failed to start or continue packet capture. Reason: Unknown error. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
PKTCPT/6/PKTCPT_UNKNOWN_ERROR: Failed to start or continue the packet capture. Reason: Unknown error. |
|
Explanation |
Packet capture failed to start or packet capture stopped because of an unknown error. |
|
Recommended action |
N/A |
PKTCPT_UPLOAD_ERROR
|
Message text |
Packet capture aborted. Reason: Failed to upload captured frames. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
PKTCPT/6/PKTCPT_UPLOAD_ERROR: Packet capture aborted. Reason: Failed to upload captured frames. |
|
Explanation |
Packet capture stopped because the capture failed to upload the captured frames. |
|
Recommended action |
1. Verify that the FTP working directory is not changed. 2. Verify that the user has the write permission to the file on the FTP server. 3. Verify that the FTP server is online. 4. Verify that the FTP server is reachable. 5. Verify that the FTP server has enough memory space. 6. Verify that the packet capture is not stopped during the upload of captured frames. 7. If the problem persists, contact H3C Support. |
PKTCPT_WRITE_FAIL
|
Message text |
Packet capture aborted. Reason: Not enough space to store captured frames. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
PKTCPT/6/PKTCPT_WRITE_FAIL: Packet capture aborted. Reason: Not enough space to store captured frames. |
|
Explanation |
Packet capture stopped because the memory space is not enough for storing captured frames. |
|
Recommended action |
1. Delete unnecessary files to release the space. 2. If the problem persists, contact H3C Support. |
PORT
This section contains port messages.
LINK_FLAP_FREQ
|
Message text |
The link of [STRING] flaps frequently. Please check the hardware link! |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 (Warning) |
|
Example |
PORT/4/LINK_FLAP_FREQ: The link of Ten-GigabitEthernet5/0/1 flaps frequently. Please check the hardware link! |
|
Impact |
The interface cannot operate correctly, or packet loss or error will occur on the port. |
|
Cause |
Possible causes include: · The interface came up or went down frequently. · Unstable transceiver module, optical fiber, or network cable connection. · Interface fault. |
|
Recommended action |
1. Check and ensure link connectivity. 2. Check and ensure that the peer interface is operating correctly. 3. Restart the card where the peer interface resides. 4. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support. |
PORT_BW_NOTENOUGH
|
Message text |
Not enough limit resources. |
|
Variable fields |
N/A |
|
Severity level |
3 (Error) |
|
Example |
PORT/3/PORT_BW_NOTENOUGH: -MDC=1-Slot=2; Not enough limit resources. |
|
Impact |
GE/XGE switching cannot be performed. |
|
Cause |
Rate limiting resources are insufficient for GE/XGE switching. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support. |
PORT_FMEA_ERR
|
Message text |
Hardware error detected on subslot [INT32]. (ErrCode = [STRING]). |
|
Variable fields |
$1: Subslot ID. $2: Fault type. ¡ 0000000: FPGA PCIe access failure. ¡ 2000000: FPGA PLL loss of lock. ¡ 300000x: Interlaken interface failure on the NP side. When x is 1, it indicates that interface 1 has failed. When x is 2, it indicates that interface 2 has failed. When x is 3, it indicates that interfaces 1 and 2 have failed. ¡ 400000x: Interlaken interface failure on the FPGA side. When x is 1, it indicates that interface 1 has failed. When x is 2, it indicates that interface 2 has failed. When x is 3, it indicates that interfaces 1 and 2 have failed. ¡ 500000: PLL in a subcard clock chip loss of lock. ¡ 600000: Uncorrectable error in the SEU. ¡ 70000xx: XFI interface failure on the NPA side. When the xx value is 1 to 30, it indicates that the corresponding interface has failed. When xx is ff, it indicates that all the XFI interfaces have failed. ¡ d0000xx: XFI interface failure on the NPB side. When the xx value is 1 to 30, it indicates that the corresponding interface has failed. When xx is ff, it indicates that all the XFI interfaces have failed. ¡ 110000xx: XFI interface failure on the NPC side. When the xx value is 1 to 30, it indicates that the corresponding interface has failed. When xx is ff, it indicates that all the XFI interfaces have failed. ¡ 170000xx: PHY A chip read/write failure. When the xx value is 1 to 30, it indicates that the corresponding interface has a read/write failure. When xx is ff, it indicates that all the interfaces have read/write failures. ¡ 180000xx: PHY B chip read/write failure. When the xx value is 1 to 30, it indicates that the corresponding interface has a read/write failure. When xx is ff, it indicates that all the interfaces have read/write failures. ¡ 190000xx: PHY C chip read/write failure. When the xx value is 1 to 30, it indicates that the corresponding interface has a read/write failure. When xx is ff, it indicates that all the interfaces have read/write failures. ¡ 1a000000: XFI interface failure on the NP side. ¡ 1b000000: XFI interface failure on the FPGA side. ¡ 1c000000: Abnormal PLL lock status for the clock chip (reported by specific chips). ¡ 1d000000: Clock A chip read/write failure on the subcard (reported by specific chips). ¡ 1e000000: Clock B chip read/write failure on the subcard (reported by specific chips). ¡ 1f000000: Chip failure (reported by specific chips). ¡ 220000xx: PHY E chip read/write failure. When the xx value is 1 to 30, it indicates that the corresponding interface has a read/write failure. When xx is ff, it indicates that all the interfaces have read/write failures (reported by specific chips). ¡ 23000000: PLL in a subcard clock C chip loss of lock (reported by specific chips). ¡ 24000000: Clock C chip read/write failure on the subcard (reported by specific chips). ¡ 25000000: PLL in a subcard clock D chip loss of lock (reported by specific chips). ¡ 26000000: Clock D chip read/write failure on the subcard (reported by specific chips). ¡ 27000000: Connection failure between MAC and PHY. |
|
Severity level |
2 (Critical) |
|
Example |
PORT/2/PORT_FMEA_ERR: -MDC=1-Slot=2; Hardware error detected on subslot 2. (ErrCode = 6000000). |
|
Impact |
The subcard cannot operate correctly. |
|
Cause |
An error of the ErrCode type was detected on the subcard. |
|
Recommended action |
1. Reboot the subcard. 2. Replace the subcard or card in the faulty slot. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support. |
PORT_FMEA_RECOVER
|
Message text |
Hardware error recovered on subslot [INT32]. (ErrCode = [STRING]). |
|
Variable fields |
$1: Recovered subslot ID. $2: Recovered fault type. ¡ 0000000: FPGA PCIe access failure. ¡ 2000000: FPGA PLL loss of lock. ¡ 300000x: Interlaken interface failure on the NP side. When x is 1, it indicates that interface 1 has failed. When x is 2, it indicates that interface 2 has failed. When x is 3, it indicates that interfaces 1 and 2 have failed. ¡ 400000x: Interlaken interface failure on the FPGA side. When x is 1, it indicates that interface 1 has failed. When x is 2, it indicates that interface 2 has failed. When x is 3, it indicates that interfaces 1 and 2 have failed. ¡ 500000: PLL in a subcard clock chip loss of lock. ¡ 600000: Uncorrectable error in the SEU. ¡ 70000xx: XFI interface failure on the NPA side. When the xx value is 1 to 30, it indicates that the corresponding interface has failed. When xx is ff, it indicates that all the XFI interfaces have failed. ¡ d0000xx: XFI interface failure on the NPB side. When the xx value is 1 to 30, it indicates that the corresponding interface has failed. When xx is ff, it indicates that all the XFI interfaces have failed. ¡ 110000xx: XFI interface failure on the NPC side. When the xx value is 1 to 30, it indicates that the corresponding interface has failed. When xx is ff, it indicates that all the XFI interfaces have failed. ¡ 170000xx: PHY A chip read/write failure. When the xx value is 1 to 30, it indicates that the corresponding interface has a read/write failure. When xx is ff, it indicates that all the interfaces have read/write failures. ¡ 180000xx: PHY B chip read/write failure. When the xx value is 1 to 30, it indicates that the corresponding interface has a read/write failure. When xx is ff, it indicates that all the interfaces have read/write failures. ¡ 190000xx: PHY C chip read/write failure. When the xx value is 1 to 30, it indicates that the corresponding interface has a read/write failure. When xx is ff, it indicates that all the interfaces have read/write failures. ¡ 1a000000: XFI interface failure on the NP side. ¡ 1b000000: XFI interface failure on the FPGA side. ¡ 1c000000: Abnormal PLL lock status for the clock chip (reported by specific chips). ¡ 1d000000: Clock A chip read/write failure on the subcard (reported by specific chips). ¡ 1e000000: Clock B chip read/write failure on the subcard (reported by specific chips). ¡ 1f000000: Chip failure (reported by specific chips). ¡ 220000xx: PHY E chip read/write failure. When the xx value is 1 to 30, it indicates that the corresponding interface has a read/write failure. When xx is ff, it indicates that all the interfaces have read/write failures (reported by specific chips). ¡ 23000000: PLL in a subcard clock C chip loss of lock (reported by specific chips). ¡ 24000000: Clock C chip read/write failure on the subcard (reported by specific chips). ¡ 25000000: PLL in a subcard clock D chip loss of lock (reported by specific chips). ¡ 26000000: Clock D chip read/write failure on the subcard (reported by specific chips). ¡ 27000000: Connection failure between MAC and PHY. |
|
Severity level |
2 (Critical) |
|
Example |
PORT/2/PORT_FMEA_RECOVER: -MDC=1-Slot=2; Hardware error recovered on subslot 2. (ErrCode = 6000000). |
|
Impact |
· No negative impact on the system. |
|
Cause |
The hardware error of the ErrCode type on the subslot has been resolved. |
|
Recommended action |
1. N/A |
PORT_HW_ERROR_REBOOT
|
Message text |
Hardware error detected on subslot [INT32]. (ErrCode = [STRING]). Rebooting the subcard… |
|
Variable fields |
$1: Subslot ID. $2: Fault type. ¡ 0000000: FPGA PCIe access failure. ¡ 1000000: FPGA local-bus access failure. ¡ 2000000: FPGA PLL loss of lock. ¡ 300000x: Interlaken interface failure on the NP side. When x is 1, interface 1 has failed. When x is 2, interface 2 has failed. When x is 3, interfaces 1 and 2 have failed. ¡ 400000x: Interlaken interface failure on the FPGA side. When x is 1, interface 1 has failed. When x is 2, interface 2 has failed. When x is 3, interfaces 1 and 2 have failed. ¡ 500000: PLL in a subcard clock chip loss of lock. ¡ 600000: Uncorrectable error in the SEU. ¡ 70000xx: XFI interface failure on the NPA side. When the xx value is 1 to 30, it indicates that the corresponding interface has failed. When xx is ff, it indicates that all the XFI interfaces have failed. ¡ 190000xx: PHY C chip read/write failure. When the xx value is 1 to 30, it indicates that the corresponding interface has a read/write failure. When xx is ff, it indicates that all the interfaces have read/write failures. ¡ 1a000000: XFI interface failure on the NP side. ¡ 1b000000: XFI interface failure on the FPGA side. ¡ 1c000000: PLL in a subcard clock A chip loss of lock (reported by specific chips). ¡ 1d000000: Clock A chip read/write failure on the subcard (reported by specific chips). ¡ 1e000000: Clock B chip read/write failure on the subcard (reported by specific chips). ¡ 1f000000: Chip failure (reported by specific chips). ¡ 220000xx: PHY E chip read/write failure. When the xx value is 1 to 30, it indicates that the corresponding interface has a read/write failure. When xx is ff, it indicates that all the interfaces have read/write failures. ¡ 23000000: PLL in a subcard clock C chip loss of lock (reported by specific chips). ¡ 24000000: Clock C chip read/write failure on the subcard (reported by specific chips). ¡ 25000000: PLL in a subcard clock D chip loss of lock (reported by specific chips). ¡ 26000000: Clock D chip read/write failure on the subcard (reported by specific chips). |
|
Severity level |
3 (Error) |
|
Example |
PORT/3/PORT_HW_ERROR_REBOOT: -MDC=1-Slot=2; Hardware error detected on subslot 2. (ErrCode = 1000000). Rebooting the subcard… |
|
Impact |
· The subcard might be rebooted. · The subard cannot operate correctly. |
|
Cause |
· Access channel or interface failure on the subcard. · Hardware link status error on the subcard. You can see the fault types in the description for the variable fields. |
|
Recommended action |
1. Reboot the subard. 2. Replace the subcard. 3. Check whether a card connection fault or subcard slot fault is present. Fix it if such a fault is present. 4. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support. |
TRANS_IO_FAULT
|
Message text |
[STRING]: Transceiver module has I/O errors. Please check the transceiver module. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 (Warning) |
|
Example |
PORT/4/TRANS_IO_FAULT: -MDC=1-Slot=2; GigabitEthernet2/1/1: Transceiver module has I/O errors. Please check the transceiver module. |
|
Impact |
The transceiver module cannot operate correctly. |
|
Cause |
· The transceiver module is not supported. · The transceiver module is faulty. |
|
Recommended action |
1. Check if the interface supports the transceiver module. ¡ Check is a message "Transceiver type not supported" is display. ¡ Execute the display transceiver interface command to identify the transceiver module type and determine whether the interface supports the transceiver module. 2. If the interface supports the transceiver module, replace the faulty transceiver module. If the interface does not support the transceiver module, replace it with one supported by the interface. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support. |
Portal messages
This section contains portal messages.
PORTAL_LIMIT_GLOBAL
|
Message text |
User failed to come online. Reason=BAS global access limit already reached. |
|
Variable fields |
None. |
|
Severity level |
6 |
|
Example |
PORTAL/6/PORTAL_LIMIT_GLOBAL: -MDC=1; User failed to come online. Reason=BAS global access limit already reached. |
|
Explanation |
The maximum number of online portal users on the device was reached. |
|
Recommended action |
No action is required. |
PORTAL_LIMIT_IF
|
Message text |
User failed to come online through interface [STRING]. Reason=BAS access limit of the interface already reached. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
6 |
|
Example |
PORTAL/6/PORTAL_LIMIT_IF: -MDC=1-Slot=4; User failed to come online through interface GigabitEthernet4/2/20. Reason=BAS access limit of the interface already reached. |
|
Explanation |
The maximum number of online portal users on an interface was reached. |
|
Recommended action |
No action is required. |
PORTAL_USER_LOGON_SUCCESS
|
Message text |
-UserName=[STRING]-IPAddr=[IPADDR]-IfName=[STRING]-OuterVLAN=[UINT16]-InnerVLAN=[UINT16]-MACAddr=[MAC]: User came online successfully. |
|
Variable fields |
$1: Username. $2: IP address. $3: Interface name. $4: Outer VLAN ID. $5: Inner VLAN ID. $6: MAC address. |
|
Severity level |
6 |
|
Example |
PORTAL/6/PORTAL_USER_LOGON_SUCCESS: -UserName=abc-IPAddr=1.1.1.2-IfName=Route-Aggregation1023.4000- OuterVLAN=100-InnerVLAN=4000-MACAddr=0230-0103-5601; User came online successfully. |
|
Explanation |
A portal user came online successfully. |
|
Recommended action |
No action is required. |
PORTAL_USER_LOGON_FAIL
|
Message text |
-UserName=[STRING]-IPAddr=[IPADDR]-IfName=[STRING]-OuterVLAN=[UINT16]-InnerVLAN=[UINT16]-MACAddr=[MAC]-Reason=[STRING]; User failed to come online. |
|
Variable fields |
$1: Username. $2: IP address. $3: Interface name. $4: Outer VLAN ID. $5: Inner VLAN ID. $6: MAC address. $7: Login failure reason, see Table 8. |
|
Severity level |
6 |
|
Example |
PORTAL/6/PORTAL_USER_LOGON_FAIL: -UserName=abc-IPAddr=1.1.1.2-IfName=Route-Aggregation1023.4000- OuterVLAN=100-InnerVLAN=4000-MACAddr=0230-0103-5601-Reason=Authentication failure; User failed to come online. |
|
Explanation |
A portal user failed to come online. |
|
Recommended action |
Choose the recommended action according to the reason, see Table 8. |
Table 8 Reasons that a user fails to come online and recommended action
|
Reason |
Recommended action |
|
Authentication failure. |
· Verify that the device can correctly communicate with the authentication server. · Verify that the shared key is the same on the device and the authentication server. · Verify that the username is legal. · Verify that the password for the username is correct. · Verify that the authentication domain on the device is correct. |
|
Authorization failure. |
· Verify that the device can correctly communicate with the authorization server. · Verify that the authorization user attributes exist on the device and are correctly configured. · Verify that the device supports the authorization user attributes. |
|
Authentication ACK message was not received from the RADIUS server. |
Verify that the route to the RADIUS server is reachable. |
|
The device failed to send the authentication request to the RADIUS server. |
· Verify that the device can correctly communicate with the RADIUS server. · Verify that the RADIUS server is active. To display the server status, use the display radius scheme command. |
|
The RADIUS server rejected the authentication request. |
Verify that the username and password of the user is correct. |
|
Failed to add authorization information for the user. |
Verify that the authorized user attributes exist on the device and are correctly configured. |
|
Local authentication request was rejected. |
Verify that the username and password for the local user are correct. |
|
No authentication response was received from the authentication server. |
· Verify that the device can correctly communicate with the RADIUS server. · Verify that the RADIUS server is active. To display the server status, use the display radius scheme command. |
|
Maximum number of concurrent logins for the account already reached. |
· Examine the maximum number of concurrent logins using a username. · Modify the maximum number of concurrent logins using a username by using the access-limit command if necessary. |
|
Local user doesn't exist on the device. |
Verify that the local user configuration on the device is correct. |
|
Failed to assign a user rule. |
Release memory. |
|
Failed to obtain physical information. |
No action is required. |
|
Authorization ACL doesn't exist. |
Verify that the authorization ACL exists on the device. |
PORTAL_USER_LOGOFF
|
Message text |
-UserName=[STRING]-IPAddr=[IPADDR]-IfName=[STRING]-OuterVLAN=[UINT16]-InnerVLAN=[UINT16]-MACAddr=[MAC]-Reason=[STRING]-Input Octets=[UINT32]-Output Octets=[UINT32]-Input Gigawords=[UINT32]-Output Gigawords=[UINT32]; User went offline. |
|
Variable fields |
$1: Username. $2: IP address. $3: Interface name. $4: Outer VLAN ID. $5: Inner VLAN ID. $6: MAC address. $7: Reason for user offline. This field always displays User request, which indicates the user requests to go offline. $8: Number of input octets. $9: Number of output octets. $10: Number of input gigawords. $11: Number of output gigawords |
|
Severity level |
6 |
|
Example |
PORTAL/6/PORTAL_USER_LOGOFF: -UserName=abc-IPAddr=1.1.1.2-IfName=Route-Aggregation1023.4000- OuterVLAN=N/A-InnerVLAN=4000-MACAddr=0230-0103-5601-Reason=User request-Input Octets=100-Output Octets=200-Input Gigawords=100-Output Gigawords=200; User went offline. |
|
Explanation |
A portal user went offline successfully. |
|
Recommended action |
No action is required. |
PORTAL_USER_LOGOFF_ABNORMAL
|
Message text |
-UserName=[STRING]-IPAddr=[IPADDR]-IfName=[STRING]-OuterVLAN=[UINT16]-InnerVLAN=[UINT16]-MACAddr=[MAC]-Reason=[STRING]-Input Octets=[UINT32]-Output Octets=[UINT32]-Input Gigawords=[UINT32]-Output Gigawords=[UINT32]; User went offline abnormally. |
|
Variable fields |
$1: Username. $2: IP address. $3: Interface name. $4: Outer VLAN ID. $5: Inner VLAN ID. $6: MAC address. $7: Reason for user offline, see Table 9. $8: Number of input octets. $9: Number of output octets. $10: Number of input gigawords. $11: Number of output gigawords |
|
Severity level |
6 |
|
Example |
PORTAL/6/PORTAL_USER_LOGOFF_ABNORMAL: -UserName=abc-IPAddr=1.1.1.2-IfName=Route-Aggregation1023.4000- OuterVLAN=100-InnerVLAN=4000-MACAddr=0230-0103-5601-Reason=Port down-Input Octets=100-Output Octets=200-Input Gigawords=100-Output Gigawords=200; User went offline abnormally. |
|
Explanation |
A portal user went offline abnormally. |
|
Recommended action |
Choose the recommended action according to the reason (see Table 9). |
Table 9 Reasons that a user goes offline abnormally and recommended action
|
Reason |
Recommended action |
|
DHCP lease timeout. |
No action is required |
|
DHCP user request. |
No action is required. |
|
DHCP configuration changed. |
Verify that the DHCP server configuration is correct. |
|
Idle timeout. |
No action is required. |
|
Session timeout. |
No action is required. |
|
User detection failure |
No action is required. |
|
The RADIUS server forcibly logged out the user. |
No action is required. |
|
Interface down. |
· Verify that a cable is correctly inserted to the user access interface. · Verify that the user access interface is not shut down by using the shutdown command. |
|
Interface inactive. |
· Verify that a cable is correctly inserted to the user access interface. · Verify that the card or subcard where the user resides is correctly installed on the device. |
|
Port was removed from VLAN. |
Verify that portal roaming is enabled. |
|
Authorization ACL for the online user was deleted. |
No action is required. |
|
The device forcibly logged out the user. |
Make sure portal authentication is not disabled on the user access interface. |
|
Failed to synchronize user information with the server. |
· Make sure the user heartbeat interval configured on the portal authentication server is not greater than the user synchronization detection timeout configured on the access device. · Verify that the server is reachable. |
|
User recovery failure |
· Verify that the user access interface is up. · Verify that portal authentication is enabled on the user access interface. · Verify that the session timeout timer for the user does not expire. |
|
Authorization ACL for the online user changed. |
· Verify that the authorization ACL for the user is correctly assigned. · Verify that strict checking on authorized ACLs is disabled. |
|
Authorization user profile for the online user changed. |
· Verify that the authorization user profile for the user is correctly assigned by using the display user profile command. · Verify that strict checking on authorized user profiles is disabled. |
|
The RADIUS server doesn't reply to the accounting request. |
· Verify that the device can correctly communicate with the accounting server. · Verify that the status of the accounting server is active. |
|
Accounting update failure. |
· Verify that the device can correctly communicate with the accounting server. · Verify that the status of the accounting server is active. |
|
No AAA response for the accounting start packet was received. |
· Verify that the device can correctly communicate with the accounting server. · Verify that the status of the accounting server is active. |
|
Failed to send the accounting request for the user. |
· Verify that the device can correctly communicate with the accounting server. · Verify that the status of the accounting server is active. |
|
Traffic threshold for the user was reached. |
No action is required. |
PPP messages
This section contains PPP messages.
PPP_SESSIONS_LOWER_THRESHOLD (non-vBRAS-CPs)
|
Message text |
The PPP session number is below the lower warning threshold (LowerThreshold=[INT32]). |
|
Variable fields |
$1: Lower online PPP session count alarm threshold. |
|
Severity level |
4 |
|
Example |
PPP/4/PPP_SESSIONS_LOWER_THRESHOLD: The PPP session number is below the lower warning threshold (LowerThreshold=20). |
|
Explanation |
The online PPP session count is below the lower threshold. |
|
Recommended action |
1. Use the display access-user command to view the total number of online PPP users. 2. Identify whether a large number of PPP users go offline abnormally. |
PPP_SESSIONS_LOWER_THRESHOLD (vBRAS-CPs)
|
Message text |
The PPP session number on slot [INT32] is below the lower warning threshold (LowerThreshold=[INT32]). |
|
Variable fields |
$1: Slot number of the master BRAS-VM. $2: Lower online PPP session count alarm threshold. |
|
Severity level |
4 |
|
Example |
PPP/4/PPP_SESSIONS_LOWER_THRESHOLD: The PPP session number on slot 97 is below the lower warning threshold (LowerThreshold=20). |
|
Explanation |
The online PPP session count is below the lower threshold. |
|
Recommended action |
1. Use the display access-user command to view the total number of online PPP users. 2. Identify whether a large number of PPP users go offline abnormally. |
PPP_SESSIONS_LOWER_RECOVER (non-vBRAS-CPs)
|
Message text |
The PPP session number has recovered to normal state from below the lower warning threshold (LowerThreshold=[INT32]). |
|
Variable fields |
$1: Lower online PPP session count alarm threshold. |
|
Severity level |
5 |
|
Example |
PPP/5/PPP_SESSIONS_LOWER_RECOVER: The PPP session number has recovered to normal state from below the lower warning threshold (LowerThreshold=20). |
|
Explanation |
The online PPP session count recovers from below the lower threshold to the normal range. |
|
Recommended action |
No action is required. |
PPP_SESSIONS_LOWER_RECOVER (vBRAS-CPs)
|
Message text |
The PPP session number on slot [INT32] has recovered to normal state from below the lower warning threshold (LowerThreshold=[INT32]). |
|
Variable fields |
$1: Slot number of the master BRAS-VM. $2: Lower online PPP session count alarm threshold. |
|
Severity level |
5 |
|
Example |
PPP/5/PPP_SESSIONS_LOWER_RECOVER: The PPP session number on slot 97 has recovered to normal state from below the lower warning threshold (LowerThreshold=20). |
|
Explanation |
The online PPP session count recovers from below the lower threshold to the normal range. |
|
Recommended action |
No action is required. |
PPP_SESSIONS_UPPER_THRESHOLD (non-vBRAS-CPs)
|
Message text |
The PPP session number is above the upper warning threshold (UpperThreshold=[INT32]). |
|
Variable fields |
$1: Upper online PPP session count alarm threshold. |
|
Severity level |
4 |
|
Example |
PPP/4/PPP_SESSIONS_UPPER_THRESHOLD: The PPP session number is above the upper warning threshold (UpperThreshold=20). |
|
Explanation |
The online PPP session count is above the upper threshold. |
|
Recommended action |
1. Use the display access-user command to view the total number of online PPP users. 2. Identify whether a large number of illegal PPP users come online. |
PPP_SESSIONS_UPPER_THRESHOLD (vBRAS-CPs)
|
Message text |
The PPP session number on slot [INT32] is above the upper warning threshold (UpperThreshold=[INT32]). |
|
Variable fields |
$1: Slot number of the master BRAS-VM. $2: Upper online PPP session count alarm threshold. |
|
Severity level |
4 |
|
Example |
PPP/4/PPP_SESSIONS_UPPER_THRESHOLD: The PPP session number on slot 97 is above the upper warning threshold (UpperThreshold=20). |
|
Explanation |
The online PPP session count is above the upper threshold. |
|
Recommended action |
1. Use the display access-user command to view the total number of online PPP users. 2. Identify whether a large number of illegal PPP users come online. |
PPP_SESSIONS_UPPER_RECOVER (non-vBRAS-CPs)
|
Message text |
The PPP session number has recovered to normal state from above the upper warning threshold (UpperThreshold=[INT32]). |
|
Variable fields |
$1: Upper online PPP session count alarm threshold. |
|
Severity level |
5 |
|
Example |
PPP/5/PPP_SESSIONS_UPPER_RECOVER: The PPP session number has recovered to normal state from above the upper warning threshold (UpperThreshold=20). |
|
Explanation |
The online PPP session count recovers from above the upper threshold to the normal range. |
|
Recommended action |
No action is required. |
PPP_SESSIONS_UPPER_RECOVER (vBRAS-CPs)
|
Message text |
The PPP session number on slot [INT32] has recovered to normal state from above the upper warning threshold (UpperThreshold=[INT32]). |
|
Variable fields |
$1: Slot number of the master BRAS-VM. $2: Upper online PPP session count alarm threshold. |
|
Severity level |
5 |
|
Example |
PPP/5/PPP_SESSIONS_UPPER_RECOVER: The PPP session number on slot 97 has recovered to normal state from above the upper warning threshold (UpperThreshold =20). |
|
Explanation |
The online PPP session count recovers from above the upper threshold to the normal range. |
|
Recommended action |
No action is required. |
PPPOES_LIMIT
|
Message text |
Maximum number of PPPoE sessions already reached. |
|
Variable fields |
N/A |
|
Severity level |
3 |
|
Example |
PPPOES/3/PPPOES_LIMIT: Maximum number of PPPoE sessions already reached. |
|
Explanation |
New users failed to come online because the maximum number of PPPoE sessions was reached. |
|
Recommended action |
1. Check the PPPoE session upper limit that is configured by using the pppoe-server session-limit total command. 2. View the number of PPPoE sessions on the current card by executing the display pppoe-server session summary slot command. 3. Verify that the number of PPPoE sessions has not reached the upper limit. 4. If the problem persists, contact the support. |
PPPOES_LIMIT_VLAN
|
Message text |
Maximum number of PPPoE sessions for the VLAN already reached. |
|
Variable fields |
N/A |
|
Severity level |
3 |
|
Example |
PPPOES/3/PPPOES_LIMIT_VLAN: Maximum number of PPPoE sessions for the VLAN already reached. |
|
Explanation |
New users failed to come online because the maximum number of PPPoE sessions for the VLAN was reached. |
|
Recommended action |
1. Check the PPPoE session upper limit for the VLAN that is configured by using the pppoe-server session-limit per-vlan command. 2. View the number of PPPoE sessions on the current interface by executing the display pppoe-server session summary interface command. 3. Verify that the number of PPPoE sessions has not reached the upper limit for the VLAN. 4. If the problem persists, contact the support. |
PPPOES_LIMIT_IF
|
Message text |
Maximum number of PPPoE sessions for the interface already reached. |
|
Variable fields |
N/A |
|
Severity level |
3 |
|
Example |
PPPOES/3/PPPOES_LIMIT_IF: Maximum number of PPPoE sessions for the interface already reached. |
|
Explanation |
New users failed to come online because the maximum number of PPPoE sessions for the interface was reached. |
|
Recommended action |
1. Check the PPPoE session upper limit for the interface that is configured by using the pppoe-server session-limit command. 2. View the number of PPPoE sessions on the current interface by executing the display pppoe-server session summary interface command. 3. Verify that the number of PPPoE sessions has not reached the upper limit for the interface. 4. If the problem persists, contact the support. |
PPPOES_LIMIT_MAC
|
Message text |
Maximum number of PPPoE sessions for the user already reached. |
|
Variable fields |
N/A |
|
Severity level |
3 |
|
Example |
PPPOES/3/PPPOES_LIMIT_MAC: Maximum number of PPPoE sessions for the user already reached. |
|
Explanation |
New users failed to come online because the maximum number of PPPoE sessions for the user was reached. |
|
Recommended action |
1. Check the PPPoE session upper limit for the user that is configured by using the pppoe-server session-limit per-mac command. 2. View the number of PPPoE sessions on the current interface by executing the display pppoe-server session summary interface command. 3. Verify that the number of PPPoE sessions has not reached the upper limit for the user. 4. If the problem persists, contact the support. |
PPPOES_LOSS_RATIO_EXCEED_THRESHOLD
|
Message text |
Centralized devices: The keepalive packet loss ratio on the interface [STRING] is [UINT32]%, and exceeds [UINT32]%. Distributed devices in standalone mode: Centralized IRF devices: The keepalive packet loss ratio on the interface [STRING] on slot [UINT32] is [UINT32]%, and exceeds [UINT32]%. Distributed devices in IRF mode: The keepalive packet loss ratio on the interface [STRING] on chassis [UINT32] slot [UINT32] is [UINT32]%, and exceeds [UINT32]%. |
|
Variable fields |
$1: Interface name. $2: Chassis number. (Distributed devices in IRF mode.) $3: Slot number. (Distributed devices in standalone mode.)(Centralized IRF devices.)(Distributed devices in IRF mode.) $4: Packet loss ratio of detection packets. $5: Packet loss ratio alarm threshold for detection packets. |
|
Severity level |
4 |
|
Example |
Centralized devices: PPP/4/PPPOES_LOSS_RATIO_EXCEED_THRESHOLD: The keepalive packet loss ratio on the interface GigabitEthernet1/0/1 is 50%, and exceeds 30%. Distributed devices in standalone mode: Centralized IRF devices: PPP/4/PPPOES_LOSS_RATIO_EXCEED_THRESHOLD: The keepalive packet loss ratio on the interface GigabitEthernet1/0/1 on slot 1 is 50%, and exceeds 30%. Distributed devices in IRF mode: PPP/4/PPPOES_LOSS_RATIO_EXCEED_THRESHOLD: The keepalive packet loss ratio on the interface GigabitEthernet1/0/1 on chassis 1 slot 1 is 50%, and exceeds 30%. |
|
Explanation |
The packet loss ratio for PPPoE user detection packets exceeded the packet loss ratio alarm threshold on an interface. |
|
Recommended action |
1. Verify that the device interface cable connections and network configuration are normal. 2. Collect log messages, and contact the support. |
PPPOES_LOSS_RATIO_RECOVER_NORMAL
|
Message text |
Centralized devices: The keepalive packet loss ratio on the interface [STRING] has recovered to normal state. Distributed devices in standalone mode: Centralized IRF devices: The keepalive packet loss ratio on the interface [STRING] on slot [UINT32] has recovered to normal state. Distributed devices in IRF mode: The keepalive packet loss ratio on the interface [STRING] on chassis [UINT32] slot [UINT32] has recovered to normal state. |
|
Variable fields |
$1: Interface name. $2: Chassis number. (Distributed devices in IRF mode.) $3: Slot number. (Distributed devices in standalone mode.)(Centralized IRF devices.)(Distributed devices in IRF mode.) |
|
Severity level |
4 |
|
Example |
Centralized devices: PPP/4/PPPOES_LOSS_RATIO_RECOVER_NORMAL: The keepalive packet loss ratio on the interface GigabitEthernet1/0/1 has recovered to normal state. Distributed devices in standalone mode: Centralized IRF devices: PPP/4/PPPOES_LOSS_RATIO_RECOVER_NORMAL: The keepalive packet loss ratio on the interface GigabitEthernet1/0/1 on slot 1 has recovered to normal state. Distributed devices in IRF mode: PPP/4/PPPOES_LOSS_RATIO_RECOVER_NORMAL: The keepalive packet loss ratio on the interface GigabitEthernet1/0/1 on chassis 1 slot 1 has recovered to normal state. |
|
Explanation |
The packet loss ratio for PPPoE user detection packets restored to the normal range on an interface. |
|
Recommended action |
No action is required. |
PPPOES_MAC_THROTTLE
|
Message text |
The MAC [STRING] triggered MAC throttle on interface [STRING]. |
|
Variable fields |
$1: MAC address. $2: Interface name. |
|
Severity level |
5 |
|
Example |
PPPOES/5/PPPOES_MAC_THROTTLE: -MDC=1; The MAC 001b-21a8-0949 triggered MAC throttle on interface GigabitEthernet1/0/1. |
|
Explanation |
The maximum number of PPPoE session requests from a user within the monitoring time was reached. During the blocking period, the access interface discarded the excessive requests from the user. |
|
Recommended action |
1. Check the PPPoE session upper limit on the access interface that is configured by using the pppoe-server throttle per-mac command. 2. View the blocking time left for the blocked user on the access interface by executing the display pppoe-server throttled-mac command. 3. If the problem persists, contact the support. |
PPPOES_SESSION_ADD_DRIVER_FAILED
|
Message text |
Failed to add a PPPoE session Ifname=[STRING], SessionID=[UINT16]. Cause: Not enough hardware resources. |
|
Variable fields |
$1: Name of the interface where the PPPoE user came online. $2: PPPoE session ID. |
|
Severity level |
4 |
|
Example |
PPPOES/4/PPPOES_SESSION_ADD_DRIVER_FAILED: Failed to add a PPPoE session: Ifname=GigabitEthernet1/0/1, SessionID=100. Cause: Not enough hardware resources. |
|
Explanation |
Failed to add a PPPoE session because the hardware resources are insufficient. |
|
Recommended action |
Contact the support. |
PPPOES_SESSIONS_LOWER_THRESHOLD
|
Message text |
Form 1: The PPPoE session number is below the lower warning threshold (LowerThreshold=[INT32]). Form 2: The PPPoE session number on slot [INT32] is below the lower warning threshold (LowerThreshold=[INT32]). Form 3: The PPPoE session number on chassis [INT32] slot [INT32] is below the lower warning threshold (LowerThreshold=[INT32]). |
|
Variable fields |
Form 1: $1: Lower online PPPoE session count alarm threshold. Form 2: $1: Slot number. $2: Lower online PPPoE session count alarm threshold. Form 3: $1: Chassis number. $2: Slot number. $3: Lower online PPPoE session count alarm threshold. |
|
Severity level |
4 |
|
Example |
PPPOES/4/PPPOES_SESSIONS_LOWER_THRESHOLD: The PPPoE session number is below the lower warning threshold (LowerThreshold=20). |
|
Explanation |
Form 1: The online PPPoE session count is below the lower threshold. Form 2: The online PPPoE session count is below the lower threshold on the specified slot. Form 3: The online PPPoE session count is below the lower threshold on the specified slot of the specified chassis. |
|
Recommended action |
1. Execute the display pppoe-server session summary command to display the summary PPPoE session information. 2. Identify whether a large number of PPPoE users go offline abnormally. |
PPPOES_SESSIONS_RECOVER_NORMAL
|
Message text |
Form 1: The PPPoE session number has recovered to normal state. Form 2: The PPPoE session number on slot [INT32] has recovered to normal state. Form 3: The PPPoE session number on chassis [INT32] slot [INT32] has recovered to normal state. |
|
Variable fields |
N/A |
|
Severity level |
5 |
|
Example |
PPPOES/5/PPPOES_SESSIONS_RECOVER_NORMAL: The PPPoE session number has recovered to normal state. |
|
Explanation |
Form 1: The online PPPoE session count has recovered to the normal state. Form 2: The online PPPoE session count has recovered to the normal state on the specified slot. Form 3: The online PPPoE session count has recovered to the normal state on the specified slot of the specified chassis. |
|
Recommended action |
No action is required. |
PPPOES_SESSIONS_UPPER_THRESHOLD
|
Message text |
Form 1: The PPPoE session number is above the upper warning threshold (UpperThreshold=[INT32]). Form 2: The PPPoE session number on slot [INT32] is above the upper warning threshold (UpperThreshold=[INT32]). Form 3: The PPPoE session number on chassis [INT32] slot [INT32] is above the upper warning threshold (UpperThreshold=[INT32]). |
|
Variable fields |
Form 1: $1: Upper online PPPoE session count alarm threshold. Form 2: $1: Slot number. $2: Upper online PPPoE session count alarm threshold. Form 3: $1: Chassis number. $2: Slot number. $3: Upper online PPPoE session count alarm threshold. |
|
Severity level |
4 |
|
Example |
PPPOES/4/PPPOES_SESSIONS_UPPER_THRESHOLD: The PPPoE session number is above the upper warning threshold (UpperThreshold=20). |
|
Explanation |
Form 1: The online PPPoE session count is above the upper threshold. Form 2: The online PPPoE session count is above the upper threshold on the specified slot. Form 3: The online PPPoE session count is above the upper threshold on the specified slot of the specified chassis. |
|
Recommended action |
1. Execute the display pppoe-server session summary command to display the summary PPPoE session information. 2. Identify whether a large number of illegal PPPoE users come online. |
PTP messages
This section contains PTP messages.
PTP_SRC_CLASS_BELOW_THRESHOLD
|
Message text |
The clock source class fell below the threshold. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
PTP/4/PTP_SRC_CLASS_BELOW_THRESHOLD: The clock source class fell below the threshold. |
|
Explanation |
The class of the clock source fell below the threshold. Possible reasons include: · The device synchronizes its time to a clock source through its PTP input interface. The class of the clock source fell below the threshold and the number of removed steps from the GM to the clock source was 0. · The device directly obtains time from a ToD clock. The class of the ToD clock fell below the threshold. |
|
Recommended action |
Execute the display ptp clock or display ptp parent command to identify whether the class of the clock source is below the threshold. · If the class is below the threshold, raise the clock source class or change to another clock source with a higher class. Then identify whether a PTP_SRC_CLASS_RECOVER log has been output. ¡ If a PTP_CLOCK_SRC_RECOVER log has been output, the issue is resolved. ¡ If no PTP_CLOCK_SRC_RECOVER log is output, collect log and configuration information and contact the support. · If the class is higher than the threshold, collect log and configuration information and contact the support. |
PTP_CLOCK_SRC_RECOVER
|
Message text |
The clock source class crossed the threshold. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
PTP/4/PTP_SRC_CLASS_RECOVER: The clock source class crossed the threshold. |
|
Explanation |
The class of the clock source crossed the threshold. |
|
Recommended action |
No action is required. |
PTP_EXT_TIME_PORT_DISCONNECT
|
Message text |
The external time port became disconnect. (ExtTimePortType=[STRING]) |
|
Variable fields |
$1: ToD interface type: ¡ ToD0 ¡ ToD1 |
|
Severity level |
4 |
|
Example |
PTP/4/PTP_EXT_TIME_PORT_DISCONNECT: The external time port became disconnect. (ExtTimePortType=ToD0) |
|
Explanation |
The device failed to receive clock signals from the external clock source, or the external clock source terminated the connection to the device. |
|
Recommended action |
Identify whether the PTP interface connected to the external clock source is up. · If the PTP interface is up, collect log and configuration information and contact the support. · If the PTP interface is down, the link or the interface is down. Resolve the issue and recover the link. |
PTP_EXT_TIME_PORT_RECOVER
|
Message text |
The external time port status resumed. (ExtTimePortType=[STRING]) |
|
Variable fields |
¡ $1: External clock type: ¡ ToD0 ¡ ToD1 |
|
Severity level |
4 |
|
Example |
PTP/4/PTP_EXT_TIME_PORT_RECOVER: The external time port status resumed. (ExtTimePortType=ToD0) |
|
Explanation |
· The device resumed signal receiving from the external clock source. · The physical link between the device and the external clock source recovered. |
|
Recommended action |
No action is required. |
PTP_FREQUENCY_LOCK
|
Message text |
Clock frequency resumed to locked state. |
|
Variable fields |
N/A |
|
Severity level |
3 |
|
Example |
PTP/3/PTP_FREQUENCY_LOCK: Clock frequency resumed to locked state. |
|
Explanation |
The clock frequency resumed from not locked state. |
|
Recommended action |
No action is required. |
PTP_FREQUENCY_NOT_LOCK
|
Message text |
Clock frequency not in locked state. |
|
Variable fields |
N/A |
|
Severity level |
3 |
|
Example |
PTP/3/PTP_FREQUENCY_NOT_LOCK: Clock frequency not in locked state. |
|
Explanation |
The clock frequency is in unlocked state. Possible reasons include: · In SyncE frequency synchronization mode, the frequency offset of the reference source is large. · In 1588v2 frequency synchronization mode, the timestamps are abnormal. · The output frequency offset of the system clock exceeds +/-10 ppm. |
|
Recommended action |
Identify whether a PTP_FREQUENCY_LOCK log will be output after this log. · If a PTP_FREQUENCY_LOCK log is output, the device has just started up or frequency flapping has occurred. · If no PTP_FREQUENCY_LOCK log is output, identify whether the PTP settings have changed. ¡ If the PTP settings have changed, restore the settings. ¡ If the PTP settings have not changed, collect log and configuration information and contact the support. |
PTP_MASTER_CLOCK_CHANGE
|
Message text |
PTP master clock property changed. (OldMasterClockId=[STRING], CurrentMasterClockId=[STRING], NewSourceIfIndex=[UINT16], OldSourcePortNum=[UINT16], CurrentSourcePortNum=[UINT16], OldSourcePortName=[STRING], CurrentSourcePortName=[STRING]) |
|
Variable fields |
$1: ID of the original master clock. $2: ID of the current master clock. $3: Index of the new clock source. $4: Number of the interface through which the old clock source distributed its time to the device. $5: Number of the interface through which the new clock source distributes its time to the device. $6: Name of the interface through which the old clock source distributed its time to the device. $7: Name of the interface through which the new clock source distributes its time to the device. |
|
Severity level |
4 |
|
Example |
PTP/4/PTP_MASTER_CLOCK_CHANGE: PTP master clock property changed. (OldMasterClockId=000FE2-FFFE-FF0000, CurrentMasterClockId=000FE2-FFFE-FF0000, NewSourceIfIndex=1, OldSourcePortNum=2, CurrentSourcePortNum=1, OldSourcePortName=G1/0/2, CurrentSourcePortName=G1/0/1) |
|
Explanation |
The attributes of the master clock changed. Possible reasons include: · The attributes of the clock nodes in the PTP domain had changed. As a result, a clock source with higher priority appeared or the path to the clock source changed. · The device had connected to a clock source with higher priority. · The PTP interface that received clock source signals is down or its link is down. |
|
Recommended action |
Execute the display ptp interface brief command to check for PTP interfaces in Disabled state. · If a PTP interface is in Disabled state, the interface does not handle PTP messages. Collect log and configuration information and contact the support. · If no PTP interface is in Disabled state, identify whether PTP settings have changed. ¡ If PTP settings have changed, restore the settings. ¡ If PTP settings have not changed, collect log and configuration information and contact the support. |
PTP_PKT_ABNORMAL
|
Message text |
Received an abnormal PTP packet. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
PTP/6/PTP_PKT_ABNORMAL: Received an abnormal PTP packet. |
|
Explanation |
The device received a defective PTP packet. The TimeSource, TimeTraceable, or FreqencyTraceable field of the packet might be incorrect. |
|
Recommended action |
To resolve the issue: 1. Determine whether the peer device has been configured with a special PTP technical standard. ¡ If the peer device has been configured with a special PTP technical standard, go to 520. ¡ If the peer device has not been configured with a special PTP technical standard, go to 519. ¡ If a PTP_PKT_ABNORMALCOUNT log has been output, go to 521. ¡ If no PTP_PKT_ABNORMALCOUNT log has been output, the issue is resolved. 3. Wait 20 minutes. Then identify whether a PTP_PKT_ABNORMALCOUNT log has been output. ¡ If a PTP_PKT_ABNORMALCOUNT log has been output, go to 521. ¡ If no PTP_PKT_ABNORMALCOUNT log has been output, the issue is resolved. 4. Collect alarm, log, and configuration information and contact the support. |
PTP_PKT_ABNORMALCOUNT
|
Message text |
Received [ULONG] abnormal PTP packets in the last 10 minutes. |
|
Variable fields |
$1: Number of abnormal PTP packets received in the last 10 minutes. |
|
Severity level |
6 |
|
Example |
PTP/6/PTP_PKT_ABNORMALCOUNT: Received 300 abnormal PTP packets in the last 10 minutes. |
|
Explanation |
The device has received abnormal PTP packets in the last 10 minutes. |
|
Recommended action |
To resolve the issue: 1. Determine whether the peer device has been configured with a special PTP technical standard. ¡ If the peer device has been configured with a special PTP technical standard, go to 524. ¡ If the peer device has not been configured with a special PTP technical standard, go to 523. ¡ If a PTP_PKT_ABNORMALCOUNT log has been output, go to 525. ¡ If no PTP_PKT_ABNORMALCOUNT log has been output, the issue is resolved. 3. Wait 20 minutes. Then identify whether a PTP_PKT_ABNORMALCOUNT log has been output. ¡ If a PTP_PKT_ABNORMALCOUNT log has been output, go to 525. ¡ If no PTP_PKT_ABNORMALCOUNT log has been output, the issue is resolved. 4. Collect alarm, log, and configuration information and contact the support. |
PTP_PKTLOST_RECOVER
|
Message text |
PTP packets lost were recovered. (PktType=[STRING]) |
|
Variable fields |
$1: PTP message type: ¡ Delay_Resp ¡ Announce ¡ Sync ¡ Pdelay_Resp |
|
Severity level |
4 |
|
Example |
PTP/4/PTP_PKTLOST_RECOVER: PTP packets lost were recovered. (PktType =Announce) |
|
Explanation |
· The subordinate port resumed receiving of Announce, Delay_Resp, and Sync messages. A timeout had occurred before. · The device role changed from member clock to master clock. A PTP message receiving timeout had occurred before. |
|
Recommended action |
No action is required. |
PTP_PKTLOST
|
Message text |
PTP packets were lost. (PktType=[STRING]) |
|
Variable fields |
$1: PTP message type: ¡ Delay_Resp ¡ Announce ¡ Sync ¡ Pdelay_Resp |
|
Severity level |
4 |
|
Example |
PTP/4/PTP_PKTLOST: PTP packets were lost. (PktType=Announce) |
|
Explanation |
The subordinate port failed to receive Announce, Delay_Resp, and Sync messages within the timeout period. |
|
Recommended action |
Execute the display ptp statistics command to identify whether the counts of the received PTP messages are increasing. · If the counts are increasing, the timeout was caused by link delay. No action is required. · If the counts are not increasing, execute the display ptp statistics command to identify whether the counts of transmitted messages are increasing. ¡ If the counts are increasing, a link failure caused the timeout. Resolve the issue and recover the link. ¡ If the counts are not increasing, collect log and configuration information and contact the support. |
PTP_PORT_BMCINFO_CHANGE
|
Message text |
The BMC info for port [UINT16] changed. (PortName=[STRING], PortSourceId=[STRING], PortSourcePortNum=[UINT16], PortSourceStepsRemoved=[UINT16], CurrentMasterClockId=[STRING]) |
|
Variable fields |
$1: PTP interface index. $2: PTP interface name. $3: Clock source ID that the PTP interface receives. $4: Clock source port number that the PTP interface receives. $5: Number of removed steps that the PTP interface receives. $6: Master clock ID. |
|
Severity level |
5 |
|
Example |
PTP/5/PTP_PORT_BMCINFO_CHANGE: The BMC info for port 1 changed. (PortName=G1/0/1, PortSourceId=000FE2-FFFE-FF0001, PortSourcePortNum=1, PortSourceStepsRemoved=5, CurrentMasterClockId=000FE2-FFFE-FF0000) |
|
Explanation |
Clock source information received by the PTP interface changed, including the clock source ID, port number, and number of removed steps. |
|
Recommended action |
No action is required. |
PTP_PORT_STATE_CHANGE
|
Message text |
PTP port state changed. (IfIndex=[UINT16], PortName=[STRING], PortState=[STRING], OldPortState=[STRING]) |
|
Variable fields |
$1: PTP interface index. $2: PTP interface name. $3: PTP interface state. ¡ Master—Sends synchronization messages. ¡ Slave—Receives synchronization messages. ¡ Passive—Neither receives nor sends synchronization messages. A PTP interface is in passive state after it receives an announce message. ¡ Listening—Neither receives nor sends synchronization messages. A PTP interface is in listening state after being initialized. ¡ Faulty—PTP is running incorrectly. A PTP interface in faulty state does not process PTP messages. ¡ Initializing—The interface is initializing. A PTP interface in initializing state does not process PTP messages. ¡ Premaster—Temporary state before the interface enters Master state. ¡ Disabled—PTP is not running on the interface. The interface does not process PTP messages. ¡ Uncalibrated—Temporary state before the interface enters Slave state. $4: Previous state of the PTP interface. |
|
Severity level |
5 |
|
Example |
PTP/5/PTP_PORT_STATE_CHANGE: PTP port state changed. (IfIndex=1, PortName=G1/0/1, PortState=Slave, OldPortState=Master) |
|
Explanation |
PTP interface state changed. Possible reasons include: · The attributes of the clock nodes in the PTP domain had changed, including the priority, time class, time accuracy, and NotSlave feature. · The device had connected to another clock source with higher priority. · The PTP interface or its link had gone down. |
|
Recommended action |
Execute the display ptp interface brief command to identify whether a PTP interface is in Fault state. · If there is a PTP interface in Fault state, the PTP interface or its link was down. Resolve the issue and recover the link. · If no PTP interface is in Fault state, identify whether PTP settings have changed. ¡ If PTP settings have changed, restore the settings. ¡ If PTP settings have not changed, collect log and configuration information and contact the support. |
PTP_SRC_CHANGE
|
Message text |
Clock source property changed. (SourceName=[STRING], Priority1=[UCHAR], Priority2=[UCHAR], ClockClass=[UINT16], ClockAccuracy=[UINT16]], ClockSourceType=[STRING]) |
|
Variable fields |
$1: Clock source: ¡ Local ¡ ToD1 ¡ ToD2 $2: Priority 1 $3: Priority 2 $4: Class of the clock source $5: Accuracy of the clock source $6: GM type: ¡ Atomic clock. ¡ Global Positioning System (GPS). ¡ Handset. ¡ Internal oscillator. ¡ NTP. ¡ Other. ¡ PTP. ¡ Terrestrial radio. ¡ Unknown. |
|
Severity level |
5 |
|
Example |
PTP/5/PTP_SRC_CHANGE: Clock source property changed. (SourceName=Tod1, Priority1=1, Priority2=2, ClockClass=6, ClockAccuracy=20, ClockSourceType=Atomic clock) |
|
Explanation |
The attributes of the clock source changed. Possible reasons include: · Command lines had been executed to change the clock source attributes. · The device had connected to another clock source with a higher accuracy. |
|
Recommended action |
No action is required. |
PTP_SRC_SWITCH
|
Message text |
Clock source switched. (LastClockID=[STRING], CurrentClockID=[STRING]) |
|
Variable fields |
$1: ID of the original clock source $2: ID of the current clock source. |
|
Severity level |
4 |
|
Example |
PTP/4/PTP_SRC_SWITCH: Clock source switched.(LastSource=000FE2-FFFE-FF0000, CurrentSource=000FE2-FFFE-FF0001) |
|
Explanation |
A clock source with higher accuracy and priority had been added to the PTP domain. The device had selected another clock source. |
|
Recommended action |
No action is required. |
PTP_TIME_LOCK
|
Message text |
Time resumed to locked state. |
|
Variable fields |
N/A |
|
Severity level |
3 |
|
Example |
PTP/3/PTP_TIME_LOCK: Time resumed to locked state. |
|
Explanation |
The device time resumed from not locked state. |
|
Recommended action |
No action is required. |
PTP_TIME_NOT_LOCK
|
Message text |
Time not in locked state. |
|
Variable fields |
N/A |
|
Severity level |
3 |
|
Example |
PTP/3/PTP_TIME_NOT_LOCK: Time not in locked state. |
|
Explanation |
The device time is not in locked state. Possible reasons include: · The frequency is not in locked state. · A fault has occurred on the subcard logic or the clock daughter card. · The timestamps received by the DSP remain unchanged or are incorrect. |
|
Recommended action |
Identify whether the PTP subordinate port or its link is down. · If the PTP subordinate port or its link is down, resolve the issue and recover the link. · If the PTP subordinate port is operating correctly, identify whether PTP settings have changed. ¡ If PTP settings have changed, restore the settings. ¡ If PTP settings have not changed, collect log and configuration information and contact the support. |
PTP_TIME_OFFSE_EXCEED_THRESHOLD
|
Message text |
The PTP time offset exceeded the threshold. (TimeOffset=[UINT16], AlarmThresholdTimeOffset=[UINT16]) |
|
Variable fields |
$1: Offset between the PTP time and the external reference time. $2: Offset threshold between the PTP time and the external reference time. |
|
Severity level |
4 |
|
Example |
PTP/4/PTP_TIME_OFFSET_EXCEED_THRESHOLD: The PTP time offset exceeded the threshold. (TimeOffset=500, AlarmThresholdTimeOffset=400) |
|
Explanation |
The offset between the PTP time and the external reference time exceeded the threshold. |
|
Recommended action |
Execute the ptp asymmetry-correction command to set the asymmetric delay correction time so that the PTP time is consistent with the external reference time. Then identify whether a PTP_TIME_OFFSET_RECOVER log has been output. · If a PTP_TIME_OFFSET_RECOVER log has been output, the issue is resolved. · If no PTP_TIME_OFFSET_RECOVER log is output, collect log and configuration information and contact the support. |
PTP_TIME_OFFSET_RECOVER
|
Message text |
The PTP standard time offset resumed. (TimeOffset=[UINT16], AlarmThresholdTimeOffset=[UINT16]) |
|
Variable fields |
$1: Offset between the PTP time and the external reference time. $2: Offset threshold between the PTP time and the external reference time. |
|
Severity level |
4 |
|
Example |
PTP/4/PTP_STANDARD_TIME_OFFSET_RECOVER: The PTP standard time offset resumed. (TimeOffset=300, AlarmThresholdTimeOffset=400) |
|
Explanation |
The PTP time resumed from large offset with the external reference time. |
|
Recommended action |
No action is required. |
PTP_TIME_SYNC
|
Message text |
Time resumed to synchronized state. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
PTP/4/PTP_TIME_SYNC: Time resumed to synchronized state. |
|
Explanation |
The device time has been synchronized. |
|
Recommended action |
No action is required. |
PTP_TIME_UNSYNC
|
Message text |
Time changed to unsynchronized state. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
PTP/4/PTP_TIME_UNSYNC: Time changed to unsynchronized state. |
|
Explanation |
The device time is not synchronized. Possible reasons include: · The device failed to trace a clock source because of link or interface failure. · The clock source of the device has a priority so high that the device cannot synchronize time to another device. |
|
Recommended action |
1. Execute the display ptp interface brief command to identify whether a PTP subordinate port is available ¡ If a PTP subordinate port is available, contact the support. ¡ If no PTP subordinate port is available, go to step 2. 2. Execute the display ptp clock command to identify whether the clock type is ToD. ¡ If the clock type is ToD, go to step 3. ¡ If the clock type is not ToD, no clock source is available for the device. 3. Identify whether the ptp { tod0 | tod1 } input command has been executed to enable the device to receive signals from a ToD clock. ¡ If this configuration exists, contact the support. ¡ If no such configuration exists, go to step 4. 4. Execute the ptp { tod0 | tod1 } input command to specify the input direction for the device to receive ToD clock signals. Then identify whether a PTP_TIME_SYNC log has been output. ¡ If a PTP_TIME_SYNC log has been output, the issue is resolved. ¡ If no PTP_TIME_SYNC log is output, collect log and configuration information and contact the support. |
PTP_TIMESTAMP_CHANGE
|
Message text |
The timestamp state turned to normal. |
|
Variable fields |
N/A |
|
Severity level |
3 |
|
Example |
PTP/3/PTP_TIMESTAMP_CHANGE: The timestamp state turned to normal. |
|
Explanation |
The timestamp state resumed from remaining unchanged. |
|
Recommended action |
No action is required. |
PTP_TIMESTAMP_UNCHANGE
|
Message text |
The timestamp state turned to abnormal. |
|
Variable fields |
N/A |
|
Severity level |
3 |
|
Example |
PTP/3/PTP_TIMESTAMP_UNCHANGE: The timestamp state turned to abnormal. |
|
Explanation |
The timestamps in the PTP messages received by the device remained unchanged. |
|
Recommended action |
Execute the display ptp statistics command to identify whether the count of Sync messages is increasing. · If the count is increasing, collect log and configuration information and contact the support. · If the count is not increasing, check the link for errors. Fix the error if any and identify whether a PTP_TIMESTAMP_CHANGED log has been output. ¡ If a PTP_TIMESTAMP_CHANGED log has been output, the timestamp state has resumed. ¡ If no PTP_TIMESTAMP_CHANGED log is output, collect log and configuration information and contact the support. |
PTP_TIMOFFSUM_PK-PK_ALARM
|
Message text |
The PTP time offset sum exceeded the threshold. (TimeOffsetSum=[UINT16], TimeOffsetSumAlarmThreshold=[UINT16]) |
|
Variable fields |
$1: PTP time-offset-sum peak-to-peak value. $2: PTP time-offset-sum peak-to-peak threshold. |
|
Severity level |
4 |
|
Example |
PTP/4/PTP_TIMOFFSUM_PK-PK_ALARM: The PTP time offset sum exceeded the threshold. (TimeOffsetSum=500, TimeOffsetSumAlarmThreshold=400) |
|
Explanation |
The PTP time-offset-sum peak-to-peak value exceeded the threshold. |
|
Recommended action |
To resolve the issue: 1. Determine whether the PTP time is in locked state. ¡ If the PTP time is in locked state, go to 532. ¡ If the PTP time is in unlocked state, go to 531. 2. Wait 15 minutes. Then determine whether the PTP time is in locked state. ¡ If the PTP time is in locked state, go to 532. ¡ If the PTP time is in unlocked state, go to 533. 3. Wait 15 minutes. Then identify whether a PTP_TIMOFFSUM_RECOVER log has been output. ¡ If a PTP_TIMOFFSUM_RECOVER log has been output, the issue is resolved. ¡ If no PTP_TIMOFFSUM_RECOVER log has been output, go to 533. 4. Collect alarm, log, and configuration information and contact the support. |
PTP_TIMOFFSUM_PK-PK_RECOVER
|
Message text |
The PTP time offset sum resumed. (TimeOffsetSum=[UINT16], TimeOffsetSumAlarmThreshold=[UINT16]) |
|
Variable fields |
$1: PTP time-offset-sum peak-to-peak value. $2: PTP time-offset-sum peak-to-peak threshold. |
|
Severity level |
4 |
|
Example |
PTP/4/PTP_TIMOFFSUM_PK-PK_RECOVER: The PTP time offset sum resumed. (TimeOffsetSum=300, TimeOffsetSumAlarmThreshold=400) |
|
Explanation |
The PTP time-offset-sum peak-to-peak value dropped below the threshold. |
|
Recommended action |
No action is required. |
PWDCTL messages
This section contains password control messages.
PWDCTL_ADD_BLACKLIST
|
Message text |
User [STRING] from [IPADDR] was added to the blacklist for or failed login attempts. |
|
Variable fields |
$1: Username. $2: User IP address. |
|
Severity level |
6 |
|
Example |
PWDCTL/6/PWDCTL_ADD_BLACKLIST: User hhh from 1.1.1.1 was added to the blacklist for failed login attempts. |
|
Explanation |
A user failed to log in to the device and was added to the password control blacklist due to one of the following reasons: · The user entered an incorrect password. · The user's service type does not match. · The user is inactive. |
|
Recommended action |
No action is required. |
PWDCTL_CHANGE_PASSWORD
|
Message text |
[STRING] changed the password because [STRING]. |
|
Variable fields |
$1: Username. $2: The reasons for changing password. · it was the first login of the account. · the password had expired. · the password was too short. · the password was not complex enough. · the password was default password. |
|
Severity level |
6 |
|
Example |
PWDCTL/6/PWDCTL_CHANGE_PASSWORD: hhh changed the password because It was the first login of the account. |
|
Explanation |
The user changed the password for some reason. For example, the user changed the password because it is the first login of the user's account. |
|
Recommended action |
No action is required. |
PWDCTL_DELETE_BLACKLIST
|
Message text |
User [STRING] was deleted from the blacklist. |
|
Variable fields |
$1: Username. |
|
Severity level |
6 |
|
Example |
PWDCTL/6/PWDCTL_DELETE_BLACKLIST: User hhh was deleted from the blacklist. |
|
Explanation |
The user account is removed from the blacklist when the locking timer expires. Alternatively, the administrator executes the reset password-control blacklist command to remove the user account from the blacklist. |
|
Recommended action |
No action is required. |
PWDCTL_FAILED_TO_OPENFILE
|
Message text |
Failed to create or open the password file. |
|
Variable fields |
N/A |
|
Severity level |
3 |
|
Example |
PWDCTL/3/PWDCTL_FAILED_TO_OPENFILE: Failed to create or open the password file. |
|
Explanation |
The device failed to create or open a .dat file because of file system exception. |
|
Recommended action |
Check the file system of the device for memory space insufficiency. |
PWDCTL_FAILED_TO_WRITEPWD
|
Message text |
Failed to write the password records to file. |
|
Variable fields |
N/A |
|
Severity level |
3 |
|
Example |
PWDCTL/3/PWDCTL_FAILED_TO_WRITEPWD: Failed to write the password records to file. |
|
Explanation |
The device failed to write a password to a file. |
|
Recommended action |
Check the file system of the device for memory space insufficiency. |
PWDCTL_NOENOUGHSPACE
|
Message text |
Not enough free space on the storage media where the file is located. |
|
Variable fields |
N/A |
|
Severity level |
3 |
|
Example |
PWDCTL/3/PWDCTL_NOENOUGHSPACE: Not enough free space on the storage media where the file is located. |
|
Explanation |
Operation failed because not enough memory space is available on the storage media (such as the flash or CF card) where the .dat file is located. |
|
Recommended action |
Check the file system of the device for memory space insufficiency. |
PWDCTL_NOTFOUNDUSER
|
Message text |
Can't find the username in the file. |
|
Variable fields |
N/A |
|
Severity level |
3 |
|
Example |
PWDCTL/3/PWDCTL_NOTFOUNDUSER: Can't find the username in the file. |
|
Explanation |
The local user fails to set the password because the user information is not in the .dat file. |
|
Recommended action |
Create another local user, or disable the password control feature and then enable the feature. |
PWDCTL_UPDATETIME
|
Message text |
Last login time updated after clock update. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
PWDCTL/6/PWDCTL_UPDATETIME: Last login time updated after clock update. |
|
Explanation |
The most recent login time has been updated. |
|
Recommended action |
No action is required. |
PWDCTL_USER_LOCK
|
Message text |
User [STRING] from [IPADDR] was [STRING] after making the maximum login attempts. |
|
Variable fields |
$1: Username. $2: User IP address. $3: The locking action to be taken after the user fails the maximum number of consecutive login attempts: · locked in lock-time minutes—Locks the user account for a period of time. When the locking timer expires, users can use this user account to log in. · permanently locked—Locks the user account permanently. |
|
Severity level |
6 |
|
Example |
1. PWDCTL/6/PWDCTL_USER_LOCK: User hhh from 1.1.1.1 was locked in 1 minutes after making the maximum login attempts. 2. PWDCTL/4/PWDCTL_LOCKBLACKLIST: User hhh from 1.1.1.1 was permanently locked after making the maximum login attempts. |
|
Explanation |
The action to be taken after the user fails the maximum number of consecutive login attempts depends on the password-control login-attempt command. |
|
Recommended action |
Identify whether the user account is locked because the maximum number of consecutive login attempts was exceeded. · If yes, make login attempts after the locking timer expires or remove the user account from the blacklist by executing reset password-control blacklist. · If no, contact Technical Support. |
PWDCTL_USER_UNLOCK
|
Message text |
User [STRING] was unlocked when the lock time expired. |
|
Variable fields |
$1: Username. |
|
Severity level |
6 |
|
Example |
PWDCTL/6/PWDCTL_USER_UNLOCK: User hhh was unlocked when the lock time expired. |
|
Explanation |
The user account is unlocked after the locking timer expires. |
|
Recommended action |
No action is required. |
PWDCTL_USER_INLOCKING
|
Message text |
User [STRING] from [IPADDR] has been locked due to exceeding the maximum number of login attempts. |
|
Variable fields |
$1: Username. $2: User IP address. |
|
Severity level |
6 |
|
Example |
PWDCTL/6/PWDCTL_USER_INLOCKING: User hhh from 1.1.1.1 has been locked due to exceeding the maximum number of login attempts. |
|
Explanation |
Login attempts were made during the locking period of the user account. |
|
Recommended action |
Identify whether the user account is locked because the maximum number of consecutive login attempts was exceeded. · If yes, make login attempts after the locking timer expires or remove the user account from the blacklist by executing reset password-control blacklist. · If no, contact Technical Support. |
QACL messages
This section contains ACL and QoS messages.
ACL_PORTAL_NORES
|
Message text |
Insufficient resources for the portal session. Some functions of the session didn't take effect. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/ACL_PORTAL_NORES: -MDC=1-Slot=5 Insufficient resources for the portal session. Some functions of the session didn't take effect. |
|
Impact |
Some functions of the session (such as accounting and rate limiting) do not take effect. |
|
Cause |
During the portal session establishment, ACL resource insufficiency caused that some functions, such as session accounting and rate limit, did not take effect. |
|
Recommended action |
1. Use the display qos-acl resource command to check the ACL resource usage on the card. Use the display qos policy, display ip policy-based-route, and display packet-filter commands to view the ACLs that are referenced. Delete unnecessary ACLs to release resources. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
AGGPORT_CAR_NORES
|
Message text |
Due to insufficient hardware resources, the CAR action and the CBQ action applied to interface [STRING] did not work as expected. |
|
Variable fields |
$1: Layer 3 aggregate interface name. |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/AGGPORT_CAR_NORES: -MDC=1-Slot=4; Due to insufficient hardware resources, the CAR action and the CBQ action applied to interface RAGG1000 did not work as expected. |
|
Impact |
The CAR action or the CBQ action in the QoS policy does not take effect. |
|
Cause |
This message is generated if hardware resources are insufficient when the state of a member port of the Layer 3 aggregate interface changes between Selected and Unselected. |
|
Recommended action |
1. Reconfigure the CAR settings and CBQ settings. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
CHANNEL_BANDWIDTH_EXCEED
|
Message text |
The sum of channel bandwidth and network-slice bandwidth ([INT 32]) exceeds the bandwidth ([INT 32]) of interface [STRING] (chip:[INT 32]). |
|
Variable fields |
$1: Total channel bandwidth. $2: Interface bandwidth. $3: Interface name or interface index. $3: ID of the chip to which an aggregate interface belongs. This parameter appears only for an aggregate interface. |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/CHANNEL_BANDWIDTH_EXCEED: -MDC=1-Slot=3; The sum of channel bandwidth and network-slice bandwidth (1100000 kbps) exceeds the bandwidth (1000000 kbps) of interface GigabitEthernet 3/0/1. QOS/4/CHANNEL_BANDWIDTH_EXCEED: -MDC=1-Slot=2; The sum of channel bandwidth and network-slice bandwidth (12000000 kbps) exceeds the bandwidth (10000000 kbps) of interfa ce Route-Aggregation201(chip:0). |
|
Impact |
The channel bandwidth or network-slice bandwidth does not take effect. If the member ports of an aggregate interface belong to different chips, log messages will be generated for each chip. |
|
Cause |
This message is generated when the sum of channel bandwidth and network slice bandwidth exceeded the interface bandwidth. |
|
Recommended action |
1. Use the mode channel-bandwidth or slice-id flex-channel command to modify the channel bandwidth or network slice bandwidth. 2. Use the bandwidth command to modify the interface bandwidth. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
CHANNEL_EXCEED_MAXIMUM
|
Message text |
The sum of channel bandwidth and network-slice bandwidth ([INT 32]) exceeds the maximum bandwidth ([INT 32]). |
|
Variable fields |
$1: Sum of the channel bandwidth and network slice bandwidth. $2: Maximum channel bandwidth and network slice bandwidth issued by the interface. |
|
Severity level |
4 (Warning) |
|
Example |
QOS/4/CHANNEL_EXCEED_MAXIMUM: -MDC=1-Slot=3; The sum of channel bandwidth and network-slice bandwidth (855000000 kbps) exceeds the maximum bandwidth (2000000000 kbps). |
|
Impact |
The channel bandwidth or network-slice bandwidth does not take effect. |
|
Cause |
This message is generated when the sum of channel bandwidth and network slice bandwidth exceeded the maximum bandwidth. |
|
Recommended action |
1. Use the mode channel-bandwidth or slice-id flex-channel command to modify the channel bandwidth or network slice bandwidth. 2. Use the bandwidth command to modify the interface bandwidth. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
COPP_RATE_EXCEED
|
Message text |
Security cpu-defend drop packets alarmed. SlotId=$1, Chip=$2, ClassifierName=$3, DropPkts=$4, Speed=$5 (DropThreshold=$6, Interval=$7, SpeedTh=$8). |
|
Variable fields |
$1: Slot number. $2: Chip number. $3: Traffic class name. $4: Number of dropped packets. $5: Rate of dropping packets. $6: Packet drop count threshold. $7: Statistics collection period. $8: Packet drop rate threshold. |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/COPP_RATE_EXCEED: -MDC=1-Slot=4; Security cpu-defend drop packets alarmed. SlotId=4, Chip=0, ClassifierName=class1, DropPkts=53416502, Speed=821792(DropThreshold=1, Interval=65, SpeedTh=1000000). |
|
Impact |
The number or rate of packets of a traffic class dropped by the control plane exceeds the specified threshold. |
|
Cause |
This message is generated when the number or rate of packets of a traffic class dropped by the control plane exceeds the specified threshold. |
|
Recommended action |
1. Use the logging packet-drop { count-threshold | rate-threshold } * command to modify the packet drop thresholds. 2. Lower the rate of packets sent to the control plane. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
QOS_AGGPORT_POLICY
|
Message text |
Failed to synchronize the QoS policy on an aggregate interface to a new member port. Not enough hardware resources available. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/QOS_AGGPORT_POLICY:-MDC=1-Slot=5; Failed to synchronize the QoS policy on an aggregate interface to a new member port. Not enough hardware resources available. |
|
Impact |
The QoS policy applied to a Layer 3 aggregate interface does not take effect on new member ports. |
|
Cause |
The system failed to synchronize the QoS policy on a Layer 3 aggregate interface to a new member port, because hardware resources were insufficient. |
|
Recommended action |
1. Use the undo port link-aggregation group command to remove the member port from the Layer 3 aggregate interface. 2. Use the undo qos apply policy command to remove the QoS policy from the Layer 3 aggregate interface and use the qos apply policy command to reapply the QoS policy to the Layer 3 aggregate interface. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
QOS_CONGESTION_DETECTED
|
Message text |
Congestion is detected on an interface of chip [INT 32] in slot [INT 32]. |
|
Variable fields |
$1: Chip number. $2: Slot number of the card. |
|
Severity level |
3 (Error) |
|
Example |
QACL/3/QOS_CONGESTION_DETECTED: -MDC=1-Slot=3; Congestion is detected on an interface of chip 0 in slot 3. |
|
Impact |
The interface cannot forward traffic. |
|
Cause |
This message is generated when congestion is detected on an interface. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
QOS_CPUQUE_BLOCK
|
Message text |
The CPU protocol queue ([UINT32]) is blocked. |
|
Variable fields |
$1: CPU output queue ID in the range of 0 to 127. |
|
Severity level |
3 (Error) |
|
Example |
QACL/3/QOS_CPUQUE_BLOCK: -MDC=1-Slot=4; The CPU protocol queue (112) is blocked. |
|
Impact |
Protocol packets to the CPU cannot be sent out. |
|
Cause |
Hardware errors occur. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
QOS_CPUQUE_DROP
|
Message text |
The CPU protocol queue ([UINT32]) is congested. |
|
Variable fields |
$1: CPU output queue ID in the range of 0 to 127. |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/QOS_CPUQUE_DROP: -MDC=1-Slot=4; The CPU protocol queue (112) is congested. |
|
Impact |
Protocol packets to the CPU are dropped. |
|
Cause |
The command is executed, and the rate of protocol packets to the CPU exceeds the rate limit value. |
|
Recommended action |
1. Increase the rate limit value. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
NETSTREAM_SAMPLER_NORES
|
Message text |
Not enough sampler resources for NetStream. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/NETSTREAM_SAMPLER_NORES:-MDC=1-Slot=4; Not enough sampler resources for NetStream. |
|
Impact |
NetStream collects statistics on all traffic, consuming a large number of hardware resources and causing high CPU usage. |
|
Cause |
This message is generated when you configure a sampler for NetStream and sampler resources are insufficient. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
QOS_WFQ_NORES
|
Message text |
Not enough WFQ resources to modify the weight value of queue [INT 32] in a queue scheduling profile. |
|
Variable fields |
$1: Queue ID. |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/QOS_WFQ_NORES : -MDC=1-Slot=9; Not enough WFQ resources to modify the weight value of queue [INT 32] in a queue scheduling profile. |
|
Impact |
The system failed to modify the WFQ weight value of a queue in a queue scheduling profile. |
|
Cause |
WFQ resources are insufficient. |
|
Recommended action |
1. Use the undo queue command to delete unnecessary WFQ settings to release WFQ resources and use the queue command to reconfigure the weight value. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
QMPROFILE_QUEUE_NORES
|
Message text |
Not enough Limit resources to modify the max-bandwidth value of queue [INT 32] in a queue scheduling profile. |
|
Variable fields |
$1: Queue ID. |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/QMPROFILE_QUEUE_NORES : -MDC=1-Slot=9; Not enough Limit resources to modify the max-bandwidth value of queue [INT 32] in a queue scheduling profile. |
|
Impact |
The system failed to modify the maximum bandwidth value of a queue in a queue scheduling profile. |
|
Cause |
Rate limiting resources are insufficient. |
|
Recommended action |
1. Use the undo queue and undo qos gts commands to delete unnecessary maximum bandwidth settings and queue-based GTS settings. Execute the queue command to modify the maximum bandwidth. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
MAXBAND_EXCEED_10G
|
Message text |
Not support to modify the max-bandwidth value of queue [INT 32] in a queue scheduling profile. |
|
Variable fields |
$1: Queue ID. |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/MAXBAND_EXCEED_10G : -MDC=1-Slot=9; Not support to modify the max-bandwidth value of queue [INT 32] in a queue scheduling profile. |
|
Impact |
The system failed to modify the maximum bandwidth value of a queue in a queue scheduling profile. |
|
Cause |
The maximum bandwidth in a queue scheduling profile is beyond the capabilities of the device. |
|
Recommended action |
1. Modify the maximum bandwidth to a value smaller than 10 Gbps. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
QOS_SHAPING_NORES
|
Message text |
The rate limiting configuration on interface [STRING] didn't work as expected due to insufficient hardware resources. |
|
Variable fields |
$1: Layer 3 aggregate interface name. |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/QOS_SHAPING_NORES:-MDC=1-Slot=4; The rate limiting configuration on interface RAGG1 didn't work as expected due to insufficient hardware resources. |
|
Impact |
The rate limiting configuration on a Layer 3 aggregate interface does not take effect. |
|
Cause |
The member ports of the aggregate interface change between Selected state and Unselected state when hardware resources are insufficient: You can identify the state of a member port through the Port Status field in the display link-aggregation verbose command output. If a member port flaps, it might change between Selected state and Unselected state. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
QOS_AGGPORT_SLICE_NORES
|
Message text |
The network-slice (id [INT 32])) bandwidth configuration on interface [STRING] didn't work as expected due to insufficient hardware resources. |
|
Variable fields |
$1: Network slice ID. $2: Layer 3 aggregate interface name. |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/QOS_SHAPING_NORE: -MDC=1-Slot=4; The network-slice(id 1) bandwidth configuration on interface RAGG1 didn't work as expected due to insufficient hardware resources. |
|
Impact |
The network-slice bandwidth configuration on a Layer 3 aggregate interface does not take effect. |
|
Cause |
The bandwidth of the Layer 3 aggregate interface changes, and hardware resources are insufficient. If the state of a member port changes or a member port joins or leaves a Layer 3 aggregation group, the bandwidth of the Layer 3 aggregate interface changes. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
QOS_SLICE_RELEASE_NORES
|
Message text |
The network-slice bandwidth configuration didn't work as expected due to insufficient hardware resources. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/QOS_SHAPING_NORE: -MDC=1-Slot=4; The network-slice bandwidth configuration didn't work as expected due to insufficient hardware resources. |
|
Impact |
The network-slice bandwidth configuration didn't work as expected |
|
Cause |
Hardware resources are insufficient. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
QOS_PSID_NORES
|
Message text |
Due to insufficient hardware resources, the outgoing traffic for the newly added member port of a Layer 3 aggregation group was sent out of another Selected port. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/QOS_PSID_NORES:-MDC=1-Slot=4; Due to insufficient hardware resources, the outgoing traffic for the newly added member port of Layer 3 aggregation group was sent out of another member port. |
|
Impact |
Congestion might occur on other member ports. |
|
Cause |
A new member port is added to a Layer 3 aggregation group with eight member ports, and hardware resources are insufficient. |
|
Recommended action |
1. Use the undo port link-aggregation group command to remove one or more Unselected ports from the Layer 3 aggregation group. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
ATM_QUEUE_NORES
|
Message text |
Not enough hardware queue resources for ATM interfaces. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/ATM_QUEUE_NORES:-MDC=1-Slot=4; Not enough hardware queue resources for ATM interfaces. |
|
Impact |
Failed to create a PVC or switch the PVC service type on an ATM interface. |
|
Cause |
Hardware queue resources are insufficient on the card. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
MOD_MINBANDPCT_NOTSPT
|
Message text |
Pattern 1: Failed to modify the minimum guaranteed bandwidth in percentage for queue [INT 32] in a queue scheduling profile applied to the [STRING] direction of [STRING]. Pattern 2: Failed to modify the minimum guaranteed bandwidth in percentage for queue [INT 32] in a queue scheduling profile applied to the [STRING] direction. |
|
Variable fields |
Pattern 1: $1: Queue ID. $2: Direction. $3: Subinterface name. Pattern 2: $1: Queue ID. $2: Direction. |
|
Severity level |
4 (Warning) |
|
Example |
QOS/4/MOD_MINBANDPCT_NOTSPT: Failed to modify the minimum guaranteed bandwidth in percentage for queue 1 in a queue scheduling profile applied to the inbound direction of Ten-GigabitEthernet 3/0/1.1. |
|
Impact |
The modification fails. |
|
Cause |
This message is generated when you modify the minimum guaranteed bandwidth of a queue in a queue scheduling profile already applied from an absolute value to a percentage value. |
|
Recommended action |
1. Use the queue command to modify the minimum guaranteed bandwidth also as an absolute value. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
MPLSTE_RSVBAND_NORSC
|
Message text |
Hardware resources not enough. Can't deploy [string]'s MPLS TE bandwidth configuration to [string] when [string] is added to [string]. |
|
Variable fields |
$1: Name of a Layer 3 aggregate interface. $2: Name of a member port for a Layer 3 aggregate interface. $3: Name of a member port for a Layer 3 aggregate interface. $4: Name of a Layer 3 aggregate interface. |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/ MPLSTE_RSVBAND_NORSC: -MDC=1; Hardware resources not enough. Can't deploy Route-Aggregation1's MPLS TE bandwidth configuration to GigabitEthernet0/0/9 when GigabitEthernet0/0/9 is added to Route-Aggregation1. |
|
Impact |
The MPLS TE bandwidth fails to take effect on the new member port. |
|
Cause |
Hardware entry resources are insufficient on the module. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
QMPROFILE_GROUP_NORES
|
Message text |
Not enough rate limit resources to modify the maximum bandwidth value of group [INT 32] in a queue scheduling profile. |
|
Variable fields |
$1: Group ID. |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/QMPROFILE_GROUP_NORES: -MDC=1-Slot=4; Not enough rate limit resources to modify the maximum bandwidth value of group 1 in a queue scheduling profile. |
|
Impact |
Failed to modify the maximum bandwidth value of a group in a queue scheduling profile. |
|
Cause |
Rate limit resources are insufficient. |
|
Recommended action |
1. Use the undo queue and undo qos gts commands to delete unnecessary queue scheduling and GTS settings to release resources. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
QOS_QMPROFILE_RESTORE_FAIL
|
Message text |
Failed to restore the configuration of queue scheduling profile [STRING] on interface [STRING], because [STRING]. |
|
Variable fields |
$1: Queue scheduling profile name. $2: Interface name. $3: Failure cause: ¡ the minimum bandwidth exceeds the interface bandwidth. |
|
Severity level |
4 (Warning) |
|
Example |
QOS/4/QOS_QMPROFILE_RESTORE_FAIL: Failed to restore the configuration of queue scheduling profile b on interface GigabitEthernet3/0/1, because the minimum bandwidth exceeds the interface bandwidth. |
|
Impact |
Failed to restore the configuration of a queue scheduling profile on an interface. |
|
Cause |
The minimum bandwidth exceeds the interface bandwidth.. |
|
Recommended action |
1. Use the undo qos apply qmprofile command to remove the queue scheduling profile from the interface. Use the queue command to modify the minimum bandwidth in the queue scheduling profile or use the bandwidth command to modify the interface bandwidth, and apply the queue scheduling profile again. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
QOS_QUEUE_NORMAL
|
Message text |
The interface [STRING]'s queue congestion state is restored to normal. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 (Warning) |
|
Example |
%Oct 25 15:02:01:751 2021 H3C QACL/4/QOS_QUEUE_NORMAL: -MDC=1-Slot=6; The interface Ten-GigabitEthernet6/2/8's queue congestion state is restored to normal. |
|
Impact |
None. |
|
Cause |
The interface queue state restored from congested to normal. |
|
Recommended action |
No action is required. |
AGGP_MPLSTERSV_NORSC
|
Message text |
The MPLS TE reservable bandwidth configuration on Layer 3 aggregate interface [STRING] didn't work as expected due to insufficient hardware resources. |
|
Variable fields |
$1: Layer 3 aggregate interface number. |
|
Severity level |
6 (Informational) |
|
Example |
QACL/6/AGGP_MPLSTERSV_NORSC:-MDC=1-Slot=4; The MPLS TE reservable bandwidth configuration on Layer 3 aggregate interface RAGG1000 didn't work as expected due to insufficient hardware resources. |
|
Impact |
The MPLS TE reservable bandwidth configuration on a Layer 3 aggregate interface does not take effect. |
|
Cause |
The member ports of the aggregate interface change between Selected state and Unselected state when hardware resources are insufficient: You can identify the state of a member port through the Port Status field in the display link-aggregation verbose command output. If a member port flaps, it might change between Selected state and Unselected state. |
|
Recommended action |
1. Use the mpls te max-reservable-bandwidth command to reconfigure MPLS TE reservable bandwidth settings on the Layer 3 aggregate interface. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
INTF_QUEUE_BLOCK
|
Message text |
All queues of interface [STRING] are blocked. |
|
Variable fields |
$1: Interface name |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/INTF_QUEUE_BLOCK: -MDC=1-Slot=2; All queues of interface Ten-GigabitEthernet 2/2/3 are blocked. |
|
Impact |
The interface cannot forward packets. |
|
Cause |
The rate limit value is small. This message is generated when the number of forwarded packets on each queue remains unchanged but the number of dropped packets increases between two polls. The system polls packet statistics on queues at 500-millisecond intervals. |
|
Recommended action |
1. Increase the rate limiting value on the interface. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
MOD_QUEUEMAXBANDPCT_NOTSPT
|
Message text |
Pattern 1: Failed to modify the maximum allowed bandwidth as a percentage for queue [INT 32] in a queue scheduling profile already applied. Pattern 2: Failed to modify the maximum allowed bandwidth as a percentage for queue [INT 32] in a queue scheduling profile already applied to the [STRING] direction of [STRING]. |
|
Variable fields |
Pattern 1: $1: Queue ID. Pattern 2: $1: Queue ID. $2: Outbound direction or inbound direction. $3: Interface name or interface index. |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/MOD_QUEUEMAXBANDPCT_NOTSPT: -MDC=1-Slot=9; Failed to modify the maximum allowed bandwidth as a percentage for queue 1 in a queue scheduling profile already applied. |
|
Impact |
The modification fails. |
|
Cause |
Pattern 1: This message is generated when you modify the maximum allowed queue bandwidth for queue scheduling profile already applied from an absolute value to a percentage value. Pattern 2: The interface does not support setting the maximum allowed bandwidth as a percentage for a queue in a queue scheduling profile. |
|
Recommended action |
1. Use the queue command to modify the maximum allowed bandwidth also as an absolute value. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
MOD_GROUPMAXBANDPCT_NOTSPT
|
Message text |
Pattern 1: Failed to modify the maximum allowed bandwidth as a percentage for group [INT 32] in a queue scheduling profile already applied. Pattern 2: Failed to modify the maximum allowed bandwidth as a percentage for group [INT 32] in a queue scheduling profile already applied to the [STRING] direction of [STRING]. |
|
Variable fields |
Pattern 1: $1: Group number. Pattern 2: $1: Group number. $2: Outbound direction or inbound direction. $3: Interface name or interface index. |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/ MOD_GROUPMAXBANDPCT_NOTSPT: -MDC=1-Slot=9; Failed to modify the maximum allowed bandwidth as a percentage for group 1 in a queue scheduling profile already applied. |
|
Impact |
The modification fails. |
|
Cause |
Pattern 1: This message is generated when you modified the maximum allowed group bandwidth for a queue scheduling profile already applied from an absolute value to a percentage value. Pattern 2: The interface does not support setting the maximum allowed bandwidth as a percentage for a group in a queue scheduling profile. |
|
Recommended action |
1. Use the group command to modify the maximum allowed bandwidth also as an absolute value. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
MPLSTE_CHANNEL_CONFLICT
|
Message text |
The MPLS TE configuration failed to take effect because it conflicts with the channel bandwidth configuration or network-slice configuration. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/MPLSTE_CHANNEL_CONFLICT: -MDC=1-Slot=3; The MPLS TE configuration failed to take effect because it conflicts with the channel bandwidth configuration or network-slice configuration. |
|
Impact |
The MPLS TE configuration failed to take effect. |
|
Cause |
The MPLS TE configurations conflict with the channel bandwidth or network slice bandwidth configuration on the same interface. |
|
Recommended action |
1. Use the undo mpls te max-reservable-bandwidth command to delete MPLS TE configurations on the interface. 2. Use the undo mode channel-bandwidth and undo slice-id flex-channel commands to delete channel bandwidth and network slice bandwidth configurations on the interface. |
QOS_WEIGHT_EXCEED
|
Message text |
Failed to modify the weight value of queue [INT 32] in a queue scheduling profile already applied because the modified value exceeds the maximum value 1023. |
|
Variable fields |
$1: Queue ID. |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/QOS_WEIGHT_EXCEED: -MDC=1-Slot=9; Failed to modify the weight value of queue 1 in a queue scheduling profile already applied because the modified value exceeds the maximum value 1023. |
|
Impact |
Failed to modify the weight value of a queue in a queue scheduling profile already applied. |
|
Cause |
This message is generated when the modified weight value of a queue in a queue scheduling profile already applied exceeds 1023. The weight value range for a queue scheduling profile is 0 to 310. When deploying a weight value to a 100GE port, the system multiplies the value by 10, which might cause the weight value to exceed the upper limit (1023). |
|
Recommended action |
1. Modify the weight value of the queue to a value smaller than 1023. If the queue scheduling profile is applied to a 100 GE interface, the weight value cannot be greater than 102. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
QOS_WREDPF_NOTSPT
|
Message text |
Failed to specify or change a WRED profile for queue $1 in a queue scheduling profile authorized to online users. |
|
Variable fields |
$1: ID for a queue in a queue scheduling profile. |
|
Severity level |
4 (Warning) |
|
Example |
QOS/4/QOS_WREDPF_NOTSPT: Failed to specify or change a WRED profile for queue 3 in a queue scheduling profile authorized to online users. |
|
Impact |
Failed to specify or change a WRED profile for a queue in a queue scheduling profile authorized to online users. |
|
Cause |
This message is generated when you add or modify a WRED profile for a queue in a queue scheduling profile authorized to IPoE or PPPoE users. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
BPA_INBOUND_NORES
|
Message text |
No resources for inbound BGP policy accounting. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/BPA_INBOUND_NORES: -MDC=1-Slot=2; No resources for inbound BGP policy accounting. |
|
Impact |
Inbound BGP policy accounting does not take effect. |
|
Cause |
Resources were exhausted for inbound BGP policy accounting. |
|
Recommended action |
1. Use the undo bgp-policy accounting command to disable inbound BGP policy accounting on the other interfaces. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
BPAIN_ALLOC_FAIL
|
Message text |
Failed to allocate resources to inbound BGP policy accounting. |
|
Variable fields |
N/A |
|
Severity level |
3 |
|
Example |
QACL/3/BPAIN_ALLOC_FAIL: -MDC=1-Slot=2; Failed to allocate resources to inbound BGP policy accounting. |
|
Impact |
Inbound BGP policy accounting does not take effect. |
|
Cause |
This message is generated when the system fails to allocate resources for inbound BGP policy accounting for reasons other than resource exhaustion. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
BPA_OUTBOUND_NORES
|
Message text |
No resources for outbound BGP policy accounting. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
QACL/3/ BPA_OUTBOUND_NORES: -MDC=1-Slot=2; Failed to allocate resources to outbound BGP policy accounting. |
|
Impact |
Outbound BGP policy accounting does not take effect. |
|
Cause |
Resources were exhausted for outbound BGP policy accounting. |
|
Recommended action |
1. Use the undo bgp-policy accounting command to disable outbound BGP policy accounting on the other interfaces. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
BPAOUT_ALLOC_FAIL
|
Message text |
Failed to allocate resources to outbound BGP policy accounting. |
|
Variable fields |
N/A |
|
Severity level |
3 |
|
Example |
QACL/3/BPAOUT_ALLOC_FAIL: -MDC=1-Slot=2; Failed to allocate resources to outbound BGP policy accounting. |
|
Impact |
Outbound BGP policy accounting does not take effect. |
|
Cause |
This message is generated when the system fails to allocate resources for outbound BGP policy accounting for reasons other than resource exhaustion. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
INTF_BPAOUT_NOTSPT
|
Message text |
Failed to configure outbound BGP policy accounting on [STRING] because the configuration on the interface is different from that on other interfaces. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/INTF_BPAOUT_NOTSPT: -MDC=1-Slot=7; Failed to configure outbound BGP policy accounting on Route-Aggregation1024.1 because the configuration on the interface is different from that on other interfaces. |
|
Impact |
The outbound BGP policy accounting configuration on the interface does not take effect. |
|
Cause |
The outbound BGP policy accounting configuration on the interface is different from the configuration on the other interfaces on the following cards: |
|
Recommended action |
1. Use the undo bgp-policy accounting command to delete the outbound BGP policy accounting configuration on the interface and use the bgp-policy accounting command to re-enable BGP policy accounting. Make sure the outbound BGP policy accounting configuration on the interface is consistent with the configuration on the other interfaces on the same card. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
INTF_BPAOUT_CONFLICT
|
Message text |
Failed to configure BGP policy accounting on [STRING] because of configuration conflicts. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/INTF_BPAOUT_CONFLICT: -MDC=1-Slot=7; Failed to configure BGP policy accounting on Route-Aggregation1024.1 because of configuration conflicts. |
|
Impact |
The BGP policy accounting configuration on the interface does not take effect. |
|
Cause |
The BGP policy accounting configuration conflicts with the other statistics collection configurations on the interface, for example, the ac statistics enable or ip subscriber l2vpn-leased command. |
|
Recommended action |
1. Execute the undo ac statistics enable or undo ip subscriber l2vpn-leased command, and then enable BGP policy accounting . 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
QOS_BLOCK_REBOOT
|
Message text |
Pattern 1: The interface [STRING] is blocked, and slot [INT32] is being rebooted. Pattern 2: The interface [STRING] is blocked, and slot [INT32] in chassis [INT32] is being rebooted. Pattern 3: The interface [STRING] is blocked, slot [INT32] is being powered off. |
|
Variable fields |
Pattern 1: $1: Interface name. $2: Slot number. Pattern 2: $1: Interface name. $2: Slot number. $3: Chassis number. Pattern 3: $1: Interface name. $2: Slot number. |
|
Severity level |
2 |
|
Example |
QACL/2/QOS_BLOCK_REBOOT: -MDC=1-Slot=2; The interface Ten-GigabitEthernet 2/2/3 is blocked, and slot 2 is being rebooted. |
|
Impact |
All services on the card are interrupted. |
|
Cause |
Queues on the interface are detected as blocked in multiple consecutive detection periods. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
QOS_QMPROFILE_NOTSPT
|
Message text |
Pattern 1: Failed to modify the scheduling parameters for queue [INT 32] in a queue scheduling profile applied to the [STRING] direction of [STRING]. Pattern 2: Failed to modify the scheduling parameters for queue [INT 32] in a queue scheduling profile applied to the [STRING] direction. Pattern 3: Failed to apply the qmprofile to the [STRING] direction of [STRING], because some settings in the queue scheduling profile are not supported. |
|
Variable fields |
Pattern 1: $1: Queue ID. $2: Outbound direction or inbound direction. $3: Interface name or interface index. Pattern 2: $1: Queue ID. $2: Outbound direction or inbound direction. Pattern 3: $1: Outbound direction or inbound direction. $2: Interface name or interface index. |
|
Severity level |
4 (Warning) |
|
Example |
QACL/4/QOS_QMPROFILE_NOTSPT: Failed to modify the scheduling parameters for queue 1 in a queue scheduling profile applied to the inbound direction of Ten-GigabitEthernet 2/1/1 |
|
Impact |
Pattern 1 and pattern 2: The system fails to modify the scheduling parameters for queues in a queue scheduling profile, the previous configuration remains in effect. Pattern 3: The queue scheduling profile does not take effect. |
|
Cause |
Pattern 1 and pattern 2: The scheduling parameters for a queue in a queue scheduling profile already applied to an interface or user cannot be modified. Pattern 3: The scheduling parameters for a queue in a queue scheduling profile already applied to an interface are no longer supported because the interface bandwidth changes. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
QOS messages
This section contains QoS messages.
EDSG_CONFIG_CONFLICT
|
Message text |
Failed to activate EDSG service policy [UINT32] on user [UINT32]. The EDSG service policy conflicts with existing configurations in the [STRING] direction. |
|
Variable fields |
$1: EDSG service policy ID. $2: User ID. $3: Direction. |
|
Severity level |
3 |
|
Example |
QOS/3/EDSG_CONFIG_CONFLICT: Failed to activate EDSG service policy 1 on user 0x30000072. The EDSG service policy conflicts with existing configurations in the outbound direction. |
|
Explanation |
The system failed to activate an EDSG service policy on a user, because the EDSG service policy conflicts with the following configurations: · Queue scheduling profile, GTS, or the queue specified for session packets in user profile view. · HQoS configuration in interface view. |
|
Recommended action |
Modify the configuration that conflicts with the EDSG service policy. |
EDSG_EXCEED_LIMIT
|
Message text |
Failed to activate EDSG service policy [UINT32] on user [UINT32]. The EDSG service policy ID is out of range. |
|
Variable fields |
$1: EDSG service policy ID. $2: User ID. |
|
Severity level |
3 |
|
Example |
QOS/3/EDSG_EXCEED_LIMIT: Failed to activate EDSG service policy 1 on user 0x30000072. The EDSG service policy ID is out of range. |
|
Explanation |
The system failed to activate an EDSG service policy on a user, because the EDSG service policy ID is out of range. |
|
Recommended action |
1. Check whether multiple EDSG service policies can be activated on one user. ¡ If only one EDSG service policy can be activated on one user, the EDSG service policy ID must be 1. ¡ If multiple (for example, N) EDSG service policies can be activated on one user, the value range for the policy ID is 1 to N. 2. Modify the EDSG service policy ID to an ID supported by the device. |
EDSG_LRMODE_CONFLICT
|
Message text |
Failed to activate EDSG service policy [UINT32] on user [UINT32]. The rate limit mode for the EDSG service policy is different from the rate limit mode for an existing EDSG service policy. |
|
Variable fields |
$1: EDSG service policy ID. $2: User ID. |
|
Severity level |
3 |
|
Example |
QOS/3/EDSG_LRMODE_CONFLICT: Failed to activate EDSG service policy 1 on user 0x30000072. The rate limit mode for the EDSG service policy is different from the rate limit mode for an existing EDSG service policy. |
|
Explanation |
The system failed to activate an EDSG service policy on a user, because the rate limit mode for the EDSG service policy is different from the rate limit mode for an existing EDSG service policy. |
|
Recommended action |
Modify the rate limit mode for the EDSG service policy. |
EDSG_MODE_CONFLICT
|
Message text |
Failed to activate EDSG service policy [UINT32] on user [UINT32]. The status of the separate rate limiting function for the EDSG service policy is different from the status of this function for an existing EDSG service policy. |
|
Variable fields |
$1: EDSG service policy ID. $2: User ID. |
|
Severity level |
3 |
|
Example |
QOS/3/EDSG_EXCEED_LIMIT: Failed to activate EDSG service policy 1 on user 0x30000072. The status of the separate rate limiting function for the EDSG service policy is different from the status of this function for an existing EDSG service policy. |
|
Explanation |
The system failed to activate an EDSG service policy on a user, because the status of the separate rate limiting function for the EDSG service policy is different from the status of this function for an existing EDSG service policy. |
|
Recommended action |
No action is required. |
EDSG_NOT_SUPPORT
|
Message text |
Failed to activate EDSG service policy [UINT32] on user [UINT32]. The EDSG service policy is not supported. |
|
Variable fields |
$1: EDSG service policy ID. $2: User ID. |
|
Severity level |
3 |
|
Example |
QOS/3/EDSG_NOT_SUPPORT: Failed to activate EDSG service policy 1 on user 0x30000072. The EDSG service policy is not supported. |
|
Explanation |
The system failed to activate an EDSG service policy on a user, because the EDSG service policy is not supported. |
|
Recommended action |
Modify the configuration to enable the user to come online from an interface that supports the EDSG service policy. |
QOS_CAR_APPLYIF_FAIL
|
Message text |
[STRING]; Failed to apply the [STRING] CAR in [STRING] profile [STRING] to interface [STRING]. Reason: [STRING]. |
|
Variable fields |
$1: Interface information. $2: Application direction: inbound or outbound. $3: Profile type, which is user. $4: Profile name. $5: Interface name. $6: Failure cause: · The CAR is not supported. · The resources are insufficient. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_CAR_APPLYIF_FAIL: Port=GigabitEthernet1/0/1; Failed to apply the inbound CAR in user profile a to interface GigabitEthernet1/0/1. Reason: The resources are insufficient. |
|
Explanation |
The system failed to perform one of the following actions: · Apply the CAR settings when applying a user profile to an interface. · Add or modify CAR settings in a user profile already applied to an interface. |
|
Recommended action |
Delete or modify the CAR settings in the user profile. |
QOS_CAR_APPLYUSER_FAIL
|
Message text |
[STRING]; Failed to apply the [STRING] CAR in [STRING] profile [STRING] to the user. Reason: [STRING]. |
|
Variable fields |
$1: User identity. $2: Application direction. $3: Profile type. $4: Profile name. $5: Failure cause. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_CAR_APPLYUSER_FAIL: -MAC=1111-2222-3333-IP=192.168.1.2-SVLAN=100-VPN=”N/A”-Port=GigabitEthernet5/1/5; Failed to apply the inbound CAR in user profile a to the user. Reason: The resources are insufficient. |
|
Explanation |
The system failed to perform one of the following actions: · Apply a CAR policy when a user came online. · Modify a configured CAR policy or configure a new CAR policy when a user is online. |
|
Recommended action |
Delete the CAR policy from the profile or modify the parameters of the CAR policy. |
QOS_CBWFQ_REMOVED
|
Message text |
CBWFQ is removed from [STRING]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
3 |
|
Example |
QOS/3/QOS_CBWFQ_REMOVED: CBWFQ is removed from GigabitEthernet4/0/1. |
|
Explanation |
CBWFQ was removed from an interface because the maximum bandwidth or speed configured on the interface was below the bandwidth or speed required for CBWFQ. |
|
Recommended action |
Increase the bandwidth or speed and apply the removed CBWFQ again. |
QOS_CHANNEL_APPLYIF_FAIL
|
Message text |
[STRING]; Failed to apply QoS channel bandwidth setting to the outbound direction of interface [STRING]. [STRING]. |
|
Variable fields |
$1: User identity. $2: Interface name. $3: Failure cause: ¡ The channel bandwidth function conflicts with the exclusive bandwidth configuration. ¡ The channel bandwidth function conflicts with HQoS. ¡ The channel bandwidth function conflicts with TE—The channel bandwidth function conflicts with the reserved bandwidth for MPLS TE. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_CHANNEL_APPLYIF_FAIL: -MAC=1111-2222-3333-IP=192.168.1.2-SVLAN=100-VPN=”N/A”-Port=GigabitEthernet5/1/1.1; Failed to apply QoS channel bandwidth setting to the outbound direction of interface GigabitEthernet5/1/1.1. The channel bandwidth function conflicts with the exclusive bandwidth configuration. |
|
Explanation |
This message is generated when the channel bandwidth fails to take effect on a subinterface. |
|
Recommended action |
Modify the channel bandwidth configuration according to the failure cause. |
QOS_COPP_ALARM
|
Message text |
Packets to the control plane dropped due to rate violation. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_COPP_ALARM_ACTIVE: Packets to the control plane dropped due to rate violation. |
|
Explanation |
Packets to the control plane are dropped due to the rate limit is exceeded. |
|
Recommended action |
Check whether an attack occurs in the network. |
QOS_COPP_ALARM_CLEAR
|
Message text |
No packets to the control plane dropped. |
|
Severity level |
5 |
|
Example |
QOS/4/QOS_COPP_ALARM_CLEAR: No packets to the control plane dropped. |
|
Explanation |
No packets to the control plane are dropped in a minute. |
|
Recommended action |
No action is required. |
QOS_DIFFSERV_CFG_FAIL
|
Message text |
Failed to configure the MPLS Diffserv mode in VPN instance [STRING]. Reason: [STRING]. |
|
Variable fields |
$1: VPN instance name. $2: Failure cause: ¡ The card does not support MPLS Diffserv mode. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_DIFFSERV_CFG_FAIL: -MDC=1-Chassis=1-Slot=5; Failed to configure the MPLS Diffserv mode in VPN instance vpn1. Reason: The card does not support MPLS Diffserv mode. |
|
Explanation |
The system failed to configure the MPLS Diffserv mode in a VPN instance. |
|
Recommended action |
No action is required. |
QOS_GTS_APPLYIF_FAIL
|
Message text |
[STRING]; Failed to apply the [STRING] GTS in [STRING] profile [STRING] to interface [STRING]. Reason: [STRING]. |
|
Variable fields |
$1: User identity. $2: Application direction. $3: Profile type, which is user. $4: Profile name. $5: Interface name. $6: Failure cause: · The resources are insufficient. · The configuration in the user profile to be applied conflicts with the existing configuration on the interface. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_GTS_APPLYIF_FAIL: -MAC=1111-2222-3333-IP=192.168.1.2/16-CVLAN=100-Port=GigabitEthernet5/1/5; Failed to apply the inbound GTS in user profile u1 to interface GigabitEthernet5/1/5. Reason: The resources are insufficient. |
|
Explanation |
The system failed to perform one of the following actions: · Apply the GTS settings when applying a user profile to an interface. · Add or modify GTS settings in a user profile already applied to an interface. |
|
Recommended action |
Delete or modify the GTS settings in the user profile. |
QOS_GTS_APPLYINT_FAIL
|
Message text |
Failed to apply the gts configuration to the interface [STRING]. [STRING] |
|
Variable fields |
$1: Interface name. $2: Failure cause. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_GTS_APPLYINT_FAIL; Failed to apply the gts configuration to the interface Route-Aggregation1. The operation is not supported. |
|
Explanation |
The interface does not support GTS configuration. |
|
Recommended action |
None. |
QOS_GTS_APPLYUSER_FAIL
|
Message text |
[STRING]; Failed to apply the [STRING] GTS to the traffic of user profile a in [STRING] in [STRING] profile [STRING] to the user. Reason: [STRING]. |
|
Variable fields |
$1: User identity. $2: Application direction. $3: Application scope. $4: Profile type. $5: User profile name. $6: Failure cause: ¡ The resources are insufficient. ¡ The GTS configuration conflicts with the CAR configuration in an EDSG service policy. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_GTS_APPLYUSER_FAIL: -MAC=1111-2222-3333-IP=192.168.1.2/16-CVLAN=100-Port=GigabitEthernet5/1/5; Failed to apply the inbound GTS to the traffic of session group profile a in queue 0. Reason: The GTS configuration conflicts with the CAR configuration in an EDSG service policy. |
|
Explanation |
The system failed to apply a GTS action to a user profile due to insufficient resources, or failed to apply a GTS action to a session group profile because the GTS configuration conflicts with the CAR configuration in an EDSG service policy. |
|
Recommended action |
Delete the GTS configuration from the user profile or session group profile or modify the parameters of the GTS configuration. |
QOS_ITACAR_APPLYUSER_FAIL
|
Message text |
[STRING]; Failed to apply the ITA CAR at level [STRING] to the user. Reason: [STRING]. |
|
Variable fields |
$1: User identity. $2: ITA CAR level. $3: Failure cause. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_ITACAR_APPLYUSER_FAIL: -MAC=1111-2222-3333-IP=192.168.1.2/16-SVLAN=100-Port=GigabitEthernet5/1/5; Failed to apply the ITA CAR at level 7 to the user. Reason: The ITA CAR is not supported. |
|
Explanation |
The system failed to apply or modify traffic policing parameters in the ITA CAR policy at level 7. |
|
Recommended action |
Cancel the ITA CAR policy or modify the traffic policing parameters. |
QOS_LR_APPLYIF_CONFIGFAIL
|
Message text |
Failed to apply the rate limiting configuration to the [STRING] direction of the interface [STRING]. [STRING]. |
|
Variable fields |
$1: Traffic direction. $2: Interface name. $3: Failure cause. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_LR_APPLYIF_CONFIGFAIL: Failed to apply the rate limiting configuration to the outbound direction of the interface Bridge-Aggregation 1. The operation is not supported. |
|
Explanation |
The system failed to apply the rate limiting configuration on a card. |
|
Recommended action |
Modify the rate limiting configuration according to the failure cause. |
QOS_LR_APPLYUSER_FAIL
|
Message text |
STRING]; Failed to apply the [STRING] rate limit to the traffic of user profile [STRING] in all queues. Reason: [STRING] |
|
Variable fields |
$1: User identity. $2: Application direction. $3: Profile name. $4: Failure cause: ¡ The resources are insufficient. ¡ The rate limit is not supported. ¡ The rate limit configuration conflicts with the CAR configuration in a EDSG service policy. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_LR_APPLYUSER_FAIL: -MDC=1-Slot=3; -MAC=0010-9400-1f38-VPN=N/A-SVLAN=4008-CVLAN=992-Port=Route-Aggregation1024.4093; Failed to apply the outbound rate limit to the traffic of user profile u1 in all queues. Reason: The resources are insufficient. |
|
Explanation |
The system failed to apply the qos user-queue command configuration to a user profile, because the configuration is not supported. Or The system failed to apply a queue scheduling profile to a session group profile, because the qos user-queue command conflicts with the CAR configuration in an EDSG service policy. |
|
Recommended action |
Remove the qos user-queue command configuration from the user profile or modify the qos user-queue command configuration. |
QOS_NOT_ENOUGH_BANDWIDTH
|
Message text |
Policy [STRING] requested bandwidth [UINT32](kbps). Only [UINT32](kbps) is available on [STRING]. |
|
Variable fields |
$1: Policy name. $2: Required bandwidth for CBWFQ. $3: Available bandwidth on an interface. $4: Interface name. |
|
Severity level |
3 |
|
Example |
QOS/3/QOS_NOT_ENOUGH_BANDWIDTH: Policy d requested bandwidth 10000(kbps). Only 80(kbps) is available on GigabitEthernet4/0/1. |
|
Explanation |
Configuring CBWFQ on an interface failed because the maximum bandwidth on the interface was less than the bandwidth required for CBWFQ. |
|
Recommended action |
Increase the maximum bandwidth configured for the interface or set lower bandwidth required for CBWFQ. |
QOS_POLICY_APPLYCOPP_CBFAIL
|
Message text |
Failed to apply classifier-behavior [STRING] in policy [STRING] to the [STRING] direction of control plane slot [UINT32]. [STRING]. |
|
Variable fields |
$1: Name of a classifier-behavior association. $2: Policy name. $3: Application direction. $4: Slot number. $5: Failure cause: ¡ The behavior is empty. ¡ Only one rate-limiting action is supported in one behavior to be applied to the control plane. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_POLICY_APPLYCOPP_CBFAIL: Failed to apply classifier-behavior d in policy b to the inbound direction of control plane slot 3. The behavior is empty. |
|
Explanation |
The system failed to perform one of the following actions: · Apply a classifier-behavior association to a specific direction of a control plane. · Update a classifier-behavior association applied to a specific direction of a control plane. |
|
Recommended action |
Modify the configuration of the QoS policy according to the failure cause. |
QOS_POLICY_APPLYCOPP_FAIL
|
Message text |
Failed to apply or refresh QoS policy [STRING] to the [STRING] direction of control plane slot [UINT32]. [STRING]. |
|
Variable fields |
$1: Policy name. $2: Traffic direction. $3: Slot number. $4: Failure cause. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_POLICY_APPLYCOPP_FAIL: Failed to apply or refresh QoS policy b to the inbound direction of control plane slot 3. The operation is not supported. |
|
Explanation |
The system failed to perform one of the following actions: · Apply a QoS policy to a specific direction of a control plane. · Update a QoS policy applied to a specific direction of a control plane. |
|
Recommended action |
Modify the configuration of the QoS policy according to the failure cause. |
QOS_POLICY_APPLYGLOBAL_CBFAIL
|
Message text |
Failed to apply classifier-behavior [STRING] in policy [STRING] to the [STRING] direction globally. [STRING]. |
|
Variable fields |
$1: Name of a classifier-behavior association. $2: Policy name. $3: Traffic direction. $4: Failure cause. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_POLICY_APPLYGLOBAL_CBFAIL: Failed to apply classifier-behavior a in policy b to the outbound direction globally. The behavior is empty. |
|
Explanation |
The system failed to perform one of the following actions: · Apply a classifier-behavior association to a specific direction globally. · Update a classifier-behavior association applied to a specific direction globally. |
|
Recommended action |
Modify the configuration of the QoS policy according to the failure cause. |
QOS_POLICY_APPLYGLOBAL_FAIL
|
Message text |
Failed to apply or refresh QoS policy [STRING] to the [STRING] direction globally. [STRING]. |
|
Variable fields |
$1: Policy name. $2: Traffic direction. $3: Failure cause. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_POLICY_APPLYGLOBAL_FAIL: Failed to apply or refresh QoS policy b to the inbound direction globally. The operation is not supported. |
|
Explanation |
The system failed to perform one of the following actions: · Apply a QoS policy to a specific direction globally. · Update a QoS policy applied to a specific direction globally. |
|
Recommended action |
Modify the configuration of the QoS policy according to the failure cause. |
QOS_POLICY_APPLYIF_CBFAIL
|
Message text |
Failed to apply classifier-behavior [STRING] in policy [STRING] to the [STRING] direction of interface [STRING]. [STRING]. |
|
Variable fields |
$1: Name of a classifier-behavior association. $2: Policy name. $3: Traffic direction. $4: Interface name. $5: Failure cause: · The behavior is empty. · Only one service class marking action is supported for the same EXP value on the same interface and the service class value can't be modified except that the old value has been deleted. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_POLICY_APPLYIF_CBFAIL: Failed to apply classifier-behavior b in policy b to the inbound direction of interface Ethernet3/1/2. The behavior is empty. |
|
Explanation |
The system failed to perform one of the following actions: · Apply a classifier-behavior association to a specific direction of an interface. · Update a classifier-behavior association applied to a specific direction of an interface. |
|
Recommended action |
Modify the configuration of the QoS policy according to the failure cause. |
QOS_POLICY_APPLYIF_FAIL
|
Message text |
Failed to apply or refresh QoS policy [STRING] to the [STRING] direction of interface [STRING]. [STRING]. |
|
Variable fields |
$1: Policy name. $2: Traffic direction. $3: Interface name. $4: Failure cause. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_POLICY_APPLYIF_FAIL: Failed to apply or refresh QoS policy b to the inbound direction of interface Ethernet3/1/2. The operation is not supported. |
|
Explanation |
The system failed to perform one of the following actions: · Apply a QoS policy to a specific direction of an interface. · Update a QoS policy applied to a specific direction of an interface. |
|
Recommended action |
Modify the configuration of the QoS policy according to the failure cause. |
QOS_POLICY_APPLYUSER_FAIL
|
Message text |
[STRING]; Failed to apply the [STRING] QoS policy [STRING] in user profile [STRING] to the user.Reason: [STRING]. |
|
Variable fields |
$1: User identity. $2: Application direction. $3: QoS policy name. $4: User profile name. $5: Failure cause. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_POLICY_APPLYUSER_FAIL: -MAC=1111-2222-3333-IP=192.168.1.2/16-CVLAN=100-Port=GigabitEthernet5/1/5; Failed to apply the inbound QoS policy p in user profile a to the user.Reason: The QoS policy is not supported. |
|
Explanation |
The system failed to perform one of the following actions: · Issue the settings of a QoS policy when a user came online. · Modify an applied QoS policy or apply a new QoS policy when a user is online. |
|
Recommended action |
Remove the QoS policy from the user profile or modify the parameters of the QoS policy. |
QOS_POLICY_APPLYVLAN_CBFAIL
|
Message text |
Failed to apply classifier-behavior [STRING] in policy [STRING] to the [STRING] direction of VLAN [UINT32]. [STRING]. |
|
Variable fields |
$1: Name of a classifier-behavior association. $2: Policy name. $3: Application direction. $4: VLAN ID. $5: Failure cause. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_POLICY_APPLYVLAN_CBFAIL: Failed to apply classifier-behavior b in policy b to the inbound direction of VLAN 2. The behavior is empty. |
|
Explanation |
The system failed to perform one of the following actions: · Apply a classifier-behavior association to a specific direction of a VLAN. · Update a classifier-behavior association applied to a specific direction of a VLAN. |
|
Recommended action |
Modify the configuration of the QoS policy according to the failure cause. |
QOS_POLICY_APPLYVLAN_FAIL
|
Message text |
Failed to apply or refresh QoS policy [STRING] to the [STRING] direction of VLAN [UINT32]. [STRING]. |
|
Variable fields |
$1: Policy name. $2: Application direction. $3: VLAN ID. $4: Failure cause. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_POLICY_APPLYVLAN_FAIL: Failed to apply or refresh QoS policy b to the inbound direction of VLAN 2. The operation is not supported. |
|
Explanation |
The system failed to perform one of the following actions: · Apply a QoS policy to a specific direction of a VLAN. · Update a QoS policy applied to a specific direction of a VLAN. |
|
Recommended action |
Modify the configuration of the QoS policy according to the failure cause. |
QOS_PRIORITY_APPLYUSER_FAIL
|
Message text |
Failed to identify the [STRING] priority of the user. Reason: [STRING]. |
|
Variable fields |
$1: Traffic direction. $2: Failure cause. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_PRIORITY_APPLYUSER_FAIL: Failed to identify the inbound priority of the user. Reason: The priority type is not supported. |
|
Explanation |
The system failed to modify the priority of incoming packets or enqueue packets according to the RADIUS-assigned user priority. |
|
Recommended action |
On the RADIUS server, disable the RADIUS server from assigning the user priority or modify the user priority to be assigned by the RADIUS server. |
QOS_PROFILE_AUTHOR_FAIL
|
Message text |
[STRING]; Failed to authorize the QoS configuration to the user. Reason: [STRING] |
|
Variable fields |
$1: User identity. $2: Failure cause: ¡ The session group profile conflicts with the user profile configured with user queue settings. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_PROFILE_AUTH_FAIL: -MAC=1111-2222-3333-IP=192.168.1.2-SVLAN=100-VPN=”N/A”-Port=GigabitEthernet5/1/5; Failed to authorize the QoS configuration to the user. Reason: The session group profile conflicts with the user profile configured with user queue settings. |
|
Explanation |
The system failed to authorize the user profile or session group profile to online users because the session group profile conflicts with the user profile configured with user queue settings. |
|
Recommended action |
1. Use the display access-user command to determine the inactive profile. 2. Modify the user profile or session group profile settings to prevent authorize both the user profile and session group profile to online users. |
QOS_PROFILE_NOTEXIST
|
Message text |
[STRING]; The [STRING] profile [STRING] doesn't exist. |
|
Variable fields |
$1: User identity. $2: Profile type: ¡ user ¡ session group $3: Profile name. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_PROFILE_NOTEXIST: -MAC=1111-2222-3333-IP=192.168.1.2-SVLAN=100-VPN=”N/A”-Port=GigabitEthernet5/1/5; The user profile a doesn't exist. |
|
Explanation |
This message is generated when an authorized user profile or session group profile doesn't exist. |
|
Recommended action |
Create the user profile or session group profile. |
QOS_QMPROFILE_APPLYIF_FAIL
|
Message text |
[STRING]; Failed to apply the [STRING] queue scheduling profile [STRING] in [STRING] profile [STRING] to the interface [STRING]. Reason: [STRING]. |
|
Variable fields |
$1: User identity. $2: Application direction: inbound or outbound. $3: Queue scheduling profile name. $3: Profile type, which is user. $4: Profile name. $5: Interface name. $6: Failure cause: · The resources are insufficient. · The configuration in the user profile to be applied conflicts with the existing configuration on the interface. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_QMPROFILE_APPLYIF_FAIL: -MAC=1111-2222-3333-IP=192.168.1.2/16-SVLAN=100-Port=GigabitEthernet5/1/5; Failed to apply the inbound queue scheduling profile b in user profile a to interface GigabitEthernet5/1/5. Reason: The queue scheduling profile is not supported. QOS/4/QOS_QMPROFILE_APPLYIF_FAIL: -MAC=1111-2222-3333-IP=192.168.1.2/16-CVLAN=100-Port=GigabitEthernet5/1/5; Failed to apply the inbound queue scheduling profile b in user profile a to interface GigabitEthernet5/1/5. Reason: The configuration in the user profile to be applied conflicts with the existing configuration on the interface. |
|
Explanation |
The system failed to perform one of the following actions: · Apply the queue scheduling profile settings when applying a user profile to an interface. · Add or modify queue scheduling profile settings in a user profile already applied to an interface. |
|
Recommended action |
Delete or modify the queue scheduling profile settings in the user profile. |
QOS_QMPROFILE_APPLYINT_FAIL
|
Message text |
Failed to apply the queue management profile to the [STRING] direction of interface [STRING]. [STRING] |
|
Variable fields |
$1: Traffic direction: inbound or outbound. $2: Interface name. $3: Failure cause: · The operation is not supported. · Resources are insufficient. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_QMPROFILE_APPLYINT_FAIL: Failed to apply the queue management profile to the outbound direction of interface Route-Aggregation1. The operation is not supported. |
|
Explanation |
The interface does not support queue scheduling profiles. |
|
Recommended action |
Delete some ACLs to release resources if resources are insufficient. |
QOS_QMPROFILE_APPLYUSER_FAIL
|
Message text |
[STRING]; Failed to apply queue management profile [STRING] in profile [STRING] to the user. Reason: [STRING]. |
|
Variable fields |
$1: User identity. $2: Queue scheduling profile name. $3: User profile type. $4: User profile name. $5: Failure cause. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_QMPROFILE_APPLYUSER_FAIL: -MAC=1111-2222-3333-IP=192.168.1.2/16-SVLAN=100-Port=GigabitEthernet5/1/5; Failed to apply queue scheduling profile b in session group profile a to the user. Reason: The queue scheduling profile is not supported. QOS/4/QOS_QMPROFILE_APPLYUSER_FAIL: -MAC=1111-2222-3333-IP=192.168.1.2/16-CVLAN=100-Port=GigabitEthernet5/1/5; Failed to apply queue scheduling profile b in session group profile a to the user. Reason: The queue scheduling profile configuration conflicts with the CAR configuration in an EDSG service policy. |
|
Explanation |
The system failed to apply a queue scheduling profile to a user profile, because the queue scheduling profile is not supported. Or The system failed to apply a queue scheduling profile to a session group profile, because the queue scheduling profile configuration conflicts with the CAR configuration in an EDSG service policy. |
|
Recommended action |
Remove the queue scheduling profile from the session group profile or modify the parameters of the queue scheduling profile. |
QOS_QMPROFILE_MODIFYQUEUE_FAIL
|
Message text |
Failed to configure queue [UINT32] in queue management profile [STRING]. [STRING]. |
|
Variable fields |
$1: Queue ID. $2: Profile name. $3: Failure cause. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_QMPROFILE_MODIFYQUEUE_FAIL: Failed to configure queue 1 in queue management profile myqueue. The value is out of range. |
|
Explanation |
The system failed to modify a queue in a queue scheduling profile successfully applied to an interface because the new parameter was beyond port capabilities. |
|
Recommended action |
Remove the queue scheduling profile from the interface, and then modify the parameters for the queue. |
QOS_QMPROFILE_RESTORE_FAIL
|
Message text |
Failed to restore the configuration of queue scheduling profile [STRING] on interface [STRING], because [STRING]. |
|
Variable fields |
$1: Queue scheduling profile name. $2: Interface name. $3: Failure cause: ¡ The minimum guaranteed bandwidth exceeds the interface bandwidth. ¡ The queue-based GTS configuration conflicts with the maximum bandwidth setting in the queue scheduling profile. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_QMPROFILE_RESTORE_FAIL: -MDC=1; Failed to restore the configuration of queue scheduling profile abc on interface GigabitEthernet3/0/3, because the minimum guaranteed bandwidth exceeds the interface bandwidth. |
|
Explanation |
The message is generated when a card is inserted after the queue-based GTS and queue scheduling profile settings are configured. |
|
Recommended action |
Modify or delete improper settings. |
QOS_WEIGHT _APPLYUSER_FAIL
|
Message text |
[STRING]; Failed to apply the [STRING] weight in [STRING] profile [STRING] to the user. Reason: [STRING]. |
|
Variable fields |
$1: User identity. $2: Direction. $3: User profile type. $4: User profile name. $5: Failure cause. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_WEIGHT_APPLYUSER_FAIL: -MAC=1111-2222-3333-IP=192.168.1.2-SVLAN=100-VPN=”N/A”-Port=GigabitEthernet5/1/5; Failed to apply the outbound weight in user profile a to the user. Reason: The resources are insufficient. QOS/4/QOS_WEIGHT_APPLYUSER_FAIL: -MAC=1111-2222-3333-IP=192.168.1.2-SVLAN=100-VPN=”N/A”-Port=GigabitEthernet5/1/5; Failed to apply the outbound weight in user profile a to the user. Reason: The weight configuration conflicts with the CAR configuration in an EDSG service policy. |
|
Explanation |
The system failed to apply or dynamically modify the weight value due to insufficient resources. Or The system failed to dynamically modify the weight value, because the weight configuration conflicts with the CAR configuration in an EDSG service policy. |
|
Recommended action |
Delete or modify the weight value. |
QOS_WRED_APPLYINT_FAIL
|
Message text |
Failed to apply WRED profile to interface [STRING]. Not enough hardware resources available. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
QOS/4/QOS_WRED_APPLYINT_FAIL: Failed to apply WRED profile to interface GigabitEthernet 1/0/1. Not enough hardware resources available. |
|
Explanation |
The system failed to apply a WRED profile to an interface due to insufficient hardware resources. |
|
Recommended action |
Delete the WRED profile that failed to be applied, configure a proper WRED profile, and apply it to the interface again. |
RADIUS messages
This section contains RADIUS messages.
RADIUS_ACCT_CACHE_DISCARD
|
Message text |
Dropped buffered stop-accounting packets or stop-accounting packets to be buffered, because the memory usage reached the minor alarm threshold: MemoryUsage=[UINT32], PacketCacheRatio=[UINT32]. |
|
Variable fields |
$1: Current message usage. $2: The number of buffered stop-accounting packets. |
|
Severity level |
4 |
|
Example |
RADIUS/4/RADIUS_ACCT_CACHE_DISCARD :Dropped buffered stop-accounting packets or stop-accounting packets to be buffered, because the memory usage reached the minor alarm threshold: MemoryUsage=[95%], CachePackets=[100]. |
|
Explanation |
The device dropped buffered stop-accounting packets or stop-accounting packets to be buffered, because the memory usage reached the minor alarm threshold. |
|
Recommended action |
This message indicates an inadequacy of system resources. To resolve this issue: · Execute the display memory command to verify memory usage on the device. If high memory usage persists, resolve the memory issue promptly. · Verify that the links between the device and the RADIUS server are operating correctly to decrease the number of buffered RADIUS packets. |
RADIUS_ACCT_CACHE_LOWER_THRES
|
Message text |
The ratio of the number of buffered stop-accounting packets to the max number has dropped below the lower threshold: MaxCachePackets=[UINT32], LowerThreshold=[UINT32]. |
|
Variable fields |
$1: The maximum number of stop-accounting packets that can be buffered. $2: The lower threshold for the ratio of buffered stop-accounting packets to the maximum number of stop-accounting packets. The upper-threshold-exceeded alarm is cleared when the ratio of buffered stop-accounting packets to the maximum number of stop-accounting packets drops below this threshold. |
|
Severity level |
5 |
|
Example |
RADIUS/5/RADIUS_ACCT_CACHE_LOWER_THRES :The ratio of the number of buffered stop-accounting packets to the max number has dropped below the lower threshold: MaxCachePackets=[256], LowerThreshold=[30%]. |
|
Explanation |
This message occurs when the ratio of buffered stop-accounting packets to the maximum number of stop-accounting packets drops below the lower threshold. |
|
Recommended action |
No action is required. |
RADIUS_ACCT_CACHE_UPPER_THRES
|
Message text |
The ratio of the number of buffered stop-accounting packets to the max number has reached the upper threshold: MaxCachePackets=[UINT32], UpperThreshold=[UINT32]. |
|
Variable fields |
$1: The maximum number of stop-accounting packets that can be buffered. $2: The upper threshold for the ratio of buffered stop-accounting packets to the maximum number of stop-accounting packets. The upper-threshold-exceeded alarm is generated when the ratio of buffered stop-accounting packets to the maximum number of stop-accounting packets reaches or exceeds this threshold. |
|
Severity level |
4 |
|
Example |
RADIUS/4/RADIUS_ACCT_CACHE_UPPER_THRES :The ratio of the number of buffered stop-accounting packets to the max number has reached the upper threshold: MaxCachePackets=[256], UpperThreshold=[90%]. |
|
Explanation |
This message occurs if the stop-accounting buffering ratio reaches the upper threshold for the first time or after having dropped below the lower threshold. |
|
Recommended action |
Verify that the links between the device and the RADIUS server are operating correctly. |
RADIUS_ACCT_SERVER_DOWN
|
Message text |
RADIUS accounting server was blocked: Server IP=[STRING], port=[UINT32], VPN instance=[STRING]. |
|
Variable fields |
$1: IP address of the accounting server. $2: Port number of the accounting server. $3: VPN instance name. This field displays public if the server belongs to the public network. |
|
Severity level |
4 |
|
Example |
RADIUS/4/RADIUS_ACCT_SERVER_DOWN: RADIUS accounting server was blocked: Server IP=1.1.1.1, port=1812, VPN instance=public. |
|
Explanation |
An accounting server became blocked. |
|
Recommended action |
1. Verify that the accounting server has started up. 2. Ping the accounting server to verify that the server is reachable. If the server is not reachable, check the link for connectivity issues and resolve the issues. 3. Collect logs and diagnostic logs, and then contact H3C Support. |
RADIUS_ACCT_SERVER_UP
|
Message text |
RADIUS accounting server became active: Server IP=[STRING], port=[UINT32], VPN instance=[STRING]. |
|
Variable fields |
$1: IP address of the accounting server. $2: Port number of the accounting server. $3: VPN instance name. This field displays public if the server belongs to the public network. |
|
Severity level |
6 |
|
Example |
RADIUS/6/RADIUS_ACCT_SERVER_UP: RADIUS accounting server became active: Server IP=1.1.1.1, port=1812, VPN instance=public. |
|
Explanation |
An accounting server became active. |
|
Recommended action |
No action is required. |
RADIUS_AUTH_FAILURE
|
Message text |
User [STRING] from [STRING] failed authentication. |
|
Variable fields |
$1: Username. $2: IP address. |
|
Severity level |
5 |
|
Example |
RADIUS/5/RADIUS_AUTH_FAILURE: User abc@system from 192.168.0.22 failed authentication. |
|
Explanation |
An authentication request was rejected by the RADIUS server. |
|
Recommended action |
No action is required. |
RADIUS_AUTH_SERVER_DOWN
|
Message text |
RADIUS authentication server was blocked: Server IP=[STRING], port=[UINT32], VPN instance=[STRING]. |
|
Variable fields |
$1: IP address of the authentication server. $2: Port number of the authentication server. $3: VPN instance name. This field displays public if the server belongs to the public network. |
|
Severity level |
4 |
|
Example |
RADIUS/4/RADIUS_AUTH_SERVER_DOWN: RADIUS authentication server was blocked: Server IP= 1.1.1.1, port=1812, VPN instance=public. |
|
Explanation |
An authentication server became blocked. |
|
Recommended action |
1. Verify that the authentication server has started up. 2. Ping the authentication server to verify that the server is reachable. If the server is not reachable, check the link for connectivity issues and resolve the issues. 3. Collect logs and diagnostic logs, and then contact H3C Support. |
RADIUS_AUTH_SERVER_UP
|
Message text |
RADIUS authentication server became active: Server IP=[STRING], port=[UINT32], VPN instance=[STRING]. |
|
Variable fields |
$1: IP address of the authentication server. $2: Port number of the authentication server. $3: VPN instance name. This field displays public if the server belongs to the public network. |
|
Severity level |
6 |
|
Example |
RADIUS/6/RADIUS_AUTH_SERVER_UP: RADIUS authentication server became active: Server IP=1.1.1.1, port=1812, VPN instance=public. |
|
Explanation |
An authentication server became active. |
|
Recommended action |
No action is required. |
RADIUS_AUTH_SUCCESS
|
Message text |
User [STRING] from [STRING] was authenticated successfully. |
|
Variable fields |
$1: Username. $2: IP address. |
|
Severity level |
6 |
|
Example |
RADIUS/6/RADIUS_AUTH_SUCCESS: User abc@system from 192.168.0.22 was authenticated successfully. |
|
Explanation |
An authentication request was accepted by the RADIUS server. |
|
Recommended action |
No action is required. |
RADIUS_DELETE_HOST_FAIL
|
Message text |
Failed to delete servers in scheme [STRING]. |
|
Variable fields |
$1: Scheme name. |
|
Severity level |
4 |
|
Example |
RADIUS/4/RADIUS_DELETE_HOST_FAIL: Failed to delete servers in scheme abc. |
|
Explanation |
Failed to delete servers from a RADIUS scheme. |
|
Recommended action |
No action is required. |
RESMON
This section contains resource monitoring messages.
RESMON_MINOR
|
Message text |
-Resource=[STRING]-Total=[STRING]-Used=[STRING]-Free=[STRING]; Free resource decreased to or below minor threshold [STRING]. [STRING]. |
|
Variable fields |
$1: Resource type. $2: Total amount. $3: Used amount. $4: Available amount. $5: Minor resource depletion threshold. $6: Resource usage description. Some types of resources do not have description information. |
|
Severity level |
4 |
|
Example |
RESMON/4/RESMON_MINOR: -Resource=AA-Total=100%-Used=83%-Free=17%; Free resource decreased to or below minor threshold 20%. |
|
Explanation |
When the available resource amount decreases to or below the minor resource depletion threshold, the resource type enters minor alarm state and the device outputs this log message periodically. |
|
Recommended action |
Configure the device based on the resource type so the device allocates the type of resources reasonably. |
RESMON_MINOR_RECOVERY
|
Message text |
-Resource=[STRING]-Total=[STRING]-Used=[STRING]-Free=[STRING]; Free resource increased above minor threshold [STRING]. [STRING]. |
|
Variable fields |
$1: Resource type. $2: Total amount. $3: Used amount. $4: Available amount. $5: Minor resource depletion threshold. $6: Resource usage description. Some types of resources do not have description information. |
|
Severity level |
5 |
|
Example |
RESMON/5/RESMON_MINOR_RECOVER: -Resource=AA-Total=100%-Used=77%-Free=23%; Free resource increased above minor threshold 20%. |
|
Explanation |
When the available resource amount increases above the minor resource depletion threshold, the resource type enters recovered state. The device removes the minor resource depletion alarm and outputs this log message. |
|
Recommended action |
No action is required. |
RESMON_SEVERE
|
Message text |
-Resource=[STRING]-Total=[STRING]-Used=[STRING]-Free=[STRING]; Free resource decreased to or below severe threshold [STRING]. [STRING]. |
|
Variable fields |
$1: Resource type. $2: Total amount. $3: Used amount. $4: Available amount. $5: Severe resource depletion threshold. $6: Resource usage description. Some types of resources do not have description information. |
|
Severity level |
3 |
|
Example |
RESMON/3/RESMON_SEVERE: -Resource=AA-Total=100%-Used=93%-Free=7%; Free resource decreased to or below severe threshold 10%. |
|
Explanation |
When the available resource amount decreases to or below the severe resource depletion threshold, the resource type enters severe alarm state and the device outputs this log message periodically. |
|
Recommended action |
Configure the device based on the resource type so the device allocates the type of resources reasonably. |
RESMON_SEVERE_RECOVERY
|
Message text |
-Resource=[STRING]-Total=[STRING]-Used=[STRING]-Free=[STRING]; Free resource increased above severe threshold [STRING]. [STRING]. |
|
Variable fields |
$1: Resource type. $2: Total amount. $3: Used amount. $4: Available amount. $5: Severe resource depletion threshold. $6: Resource usage description. Some types of resources do not have description information. |
|
Severity level |
5 |
|
Example |
RESMON/5/RESMON_SEVERE_RECOVER: -Resource=AA-Total=100%-Used=83%-Free=17%; Free resource increased above severe threshold 10%. |
|
Explanation |
When the available resource amount increases above the severe resource depletion threshold, the device removes the severe resource depletion alarm and outputs this log message. |
|
Recommended action |
No action is required. |
RESMON_USEDUP
|
Message text |
-Resource=[STRING]-Total=[STRING]-Used=[STRING]-Free=[STRING]; Resources used up. [STRING]. |
|
Variable fields |
$1: Resource type. $2: Total amount. $3: Used amount. $4: Available amount. $5: Resource usage description. Some types of resources do not have description information. |
|
Severity level |
2 |
|
Example |
RESMON/2/RESMON_USEDUP: -Resource=vlaninterface-Total=2048-Used=2048-Free=0; Resources used up. |
|
Explanation |
When the available resource amount decreases to zero, the device outputs this log message periodically. |
|
Recommended action |
To ensure correct operation of the relevant services, immediately clear data or entries of the resource type that are not used. |
RESMON_USEDUP_RECOVERY
|
Message text |
-Resource=[STRING]-Total=[STRING]-Used=[STRING]-Free=[STRING]; The amount of free resources increased from zero to a non-zero value. [STRING]. |
|
Variable fields |
$1: Resource type. $2: Total amount, which can be 100% or an integer for an absolute value. $3: Used amount, a percentage or an integer for an absolute value. $4: Available amount, a percentage or an integer for an absolute value. $5: Additional resource usage information. This field might be null. |
|
Severity level |
5 |
|
Example |
RESMON/5/RESMON_USEDUP_RECOVER: -Resource=vlaninterface-Total=2048-Used=2047-Free=1; The amount of free resources increased from zero to a non-zero value. |
|
Explanation |
When the available resource amount increases from zero, the device outputs this log message. |
|
Recommended action |
No action is required. |
RIP messages
This section contains RIP messages.
RIP_MEM_ALERT
|
Message text |
RIP Process received system memory alert [STRING] event. |
|
Variable fields |
$1: Type of the memory alarm. |
|
Severity level |
5 |
|
Example |
RIP/5/RIP_MEM_ALERT: RIP Process received system memory alert start event. |
|
Explanation |
RIP received a memory alarm. |
|
Recommended action |
Check the system memory and release memory for the modules that occupy too many memory resources. |
RIPNG messages
This section contains RIPng messages.
RIPNG_MEM_ALERT
|
Message text |
RIPng Process received system memory alert [STRING] event. |
|
Variable fields |
$1: Type of the memory alarm. |
|
Severity level |
5 |
|
Example |
RIPNG/5/RIPNG_MEM_ALERT: RIPNG Process received system memory alert start event. |
|
Explanation |
RIPng received a memory alarm. |
|
Recommended action |
Check the system memory and release memory for the modules that occupy too many memory resources. |
RM messages
This section contains RM messages.
RM_ACRT_REACH_LIMIT
|
Message text |
Max active [STRING] routes [UINT32] reached in URT of [STRING] |
|
Variable fields |
$1: IPv4 or IPv6. $2: Maximum number of active routes. $3: VPN instance name. |
|
Severity level |
4 |
|
Example |
RM/4/RM_ACRT_REACH_LIMIT: Max active IPv4 routes 100000 reached in URT of VPN1 |
|
Explanation |
The number of active routes reached the upper limit in the unicast routing table of a VPN instance. |
|
Recommended action |
Remove unused active routes. |
RM_ACRT_REACH_THRESVALUE
|
Message text |
Threshold value [UINT32] of max active [STRING] routes reached in URT of [STRING] |
|
Variable fields |
$1: Threshold of the maximum number of active routes in percentage. $2: IPv4 or IPv6. $3: VPN instance name. |
|
Severity level |
4 |
|
Example |
RM/4/RM_ACRT_REACH_THRESVALUE: Threshold value 50% of max active IPv4 routes reached in URT of vpn1 |
|
Explanation |
The percentage of the maximum number of active routes was reached in the unicast routing table of a VPN instance. |
|
Recommended action |
Modify the threshold value or the route limit configuration. |
RM_SID_ROUTE_CONFLICT_ACTIVE
|
Message text |
Conflict between an SRv6 local SID and a route.(SID=[STRING]/[UINT32]) |
|
Variable fields |
$1: SRv6 SID value. $2: Prefix length of the SRv6 SID. |
|
Severity level |
4 |
|
Example |
RM/4/RM_SID_ROUTE_CONFLICT_ACTIVE: -MDC=1; Conflict between an SRv6 local SID and a route.(SID=100::22/128) |
|
Explanation |
A conflict occurred between the SRv6 SID in the SRv6 local SID forwarding table and that in a route entry. |
|
Recommended action |
Check the routing and SRv6 SID settings, and edit the settings if they are not appropriate. |
RM_SID_ROUTE_CONFLICT_CLEAR
|
Message text |
The conflict between the SRv6 local SID and a route was removed. (SID=[STRING]/[UINT32]) |
|
Variable fields |
$1: SRv6 SID value. $2: Prefix length of the SRv6 SID. |
|
Severity level |
4 |
|
Example |
RM/4/RM_SID_ROUTE_CONFLICT_CLEAR: -MDC=1; The conflict between the SRv6 local SID and a route was removed.(SID=100::22/128) |
|
Explanation |
The conflict between the SRv6 SID in the SRv6 local SID forwarding table and that in a route entry was removed. |
|
Recommended action |
No action is required. |
RM_THRESHLD_VALUE_REACH
|
Message text |
Threshold value [UINT32] of active [STRING] routes reached in URT of [STRING] |
|
Variable fields |
$1: Maximum number of active routes. $2: IPv4 or IPv6. $3: VPN instance name. |
|
Severity level |
4 |
|
Example |
RM/4/RM_THRESHLD_VALUE_REACH: Threshold value 10000 of active IPv4 routes reached in URT of vpn1 |
|
Explanation |
The number of active routes reached the threshold in the unicast routing table of a VPN instance. |
|
Recommended action |
Modify the route limit configuration. |
RM_TOTAL_THRESHLD_VALUE_CLEAR
|
Message text |
Threshold value [UINT32] of active [STRING] routes fell below the limit in all URTs. |
|
Variable fields |
$1: Maximum number of active routes. $2: IPv4 or IPv6. |
|
Severity level |
4 |
|
Example |
RM/4/RM_TOTAL_THRESHLD_VALUE_CLEAR: Threshold value 1000 of active IPv4 routes fell below the limit in all URTs. |
|
Explanation |
The total number of active routes in the public network and all VPN instances dropped below the alarm threshold. |
|
Recommended action |
No action is required. |
RM_TOTAL_THRESHLD_VALUE_REACH
|
Message text |
Threshold value [UINT32] reached for active [STRING] routes in all URTs. |
|
Variable fields |
$1: Maximum number of active routes. $2: IPv4 or IPv6. |
|
Severity level |
4 |
|
Example |
RM/4/ RM_TOTAL_THRESHLD_VALUE_REACH: Threshold value 1000 reached for active IPv4 routes in all URTs. |
|
Explanation |
The total number of active routes in the public network and all VPN instances reached the alarm threshold. |
|
Recommended action |
Check the routing table and take relevant actions, for example, configure a routing policy to reduce the number of route entries. |
RSVP messages
This section contains RSVP messages.
RSVP_FRR_SWITCH
|
Message text |
|
|
Variable fields |
$1: Information about the protected tunnel. $2: Session status. This field also displays the FRR bypass tunnel information if an FRR bypass tunnel exists. · ready—Bound to an FRR bypass tunnel. No FRR has occurred. · used—Bound to an FRR bypass tunnel. An FRR has occurred. · disabled—Unbound from the FRR bypass tunnel. |
|
Severity level |
5 |
|
Example |
|
|
Explanation |
This log is generated when FRR protection is enabled or disabled, or an FRR has occurred. |
|
Recommended action |
No action is required. |
RSVP_P2MP_FRR_SWITCH
|
Message text |
Session ([STRING]): FRR is [STRING]. |
|
Variable fields |
$1: Information about the protected tunnel. $2: Session status. This field also displays the FRR bypass tunnel information if an FRR bypass tunnel exists. · ready—Bound to an FRR bypass tunnel. No FRR has occurred. · used—Bound to an FRR bypass tunnel. an FRR has occurred. · disabled—Unbound from the FRR bypass tunnel. |
|
Severity level |
5 |
|
Example |
RSVP/5/RSVP_P2MP_FRR_SWITCH: P2MP session (DIP 2.2.2.2, SIP 1.1.1.1, P2MPID 0x1010101, TID 3, LSPID 5): FRR is ready. Bypass tunnel is Tunnel5. |
|
Explanation |
This log is generated when FRR protection is enabled or disabled, or an FRR has occurred. |
|
Recommended action |
No action is required. |
RTM messages
This section contains RTM messages.
RTM_ENVIRONMENT
|
Message text |
Can't find environment variable [STRING]. |
|
Variable fields |
$1: Name of an environment variable. |
|
Severity level |
4 |
|
Example |
RTM/4/RTM_ENVIRONMENT: Can't find environment variable TestEnv. |
|
Explanation |
The system failed to execute a CLI-defined policy because it did not find an environment variable to be replaced. |
|
Recommended action |
Define the environment variable before using it. |
RTM_TCL_NOT_EXIST
|
Message text |
Failed to execute Tcl-defined policy [STRING] because the policy's Tcl script file was not found. |
|
Variable fields |
$1: Name of a Tcl-defined policy. |
|
Severity level |
4 |
|
Example |
RTM/4/RTM_TCL_NOT_EXIST: Failed to execute Tcl-defined policy aaa because the policy's Tcl script file was not found. |
|
Explanation |
The system did not find the Tcl script file for the policy while executing the policy. |
|
Recommended action |
1. Check that the Tcl script file exists. 2. Reconfigure the policy. |
RTM_TCL_MODIFY
|
Message text |
Failed to execute Tcl-defined policy [STRING] because the policy's Tcl script file had been modified. |
|
Variable fields |
$1: Name of a Tcl-defined policy. |
|
Severity level |
4 |
|
Example |
RTM/4/RTM_TCL_MODIFY: Failed to execute Tcl-defined policy aaa because the policy's Tcl script file had been modified. |
|
Explanation |
The Tcl script file for the policy was modified. |
|
Recommended action |
Reconfigure the policy, or modify the Tcl script to be the same as it was when it was bound with the policy. |
RTM_TCL_LOAD_FAILED
|
Message text |
Failed to load the Tcl script file of policy [STRING]. |
|
Variable fields |
$1: Name of a Tcl-defined policy. |
|
Severity level |
4 |
|
Example |
RTM/4/RTM_TCL_LOAD_FAILED: Failed to load the Tcl script file of policy [STRING]. |
|
Explanation |
The system failed to load the Tcl script file for the policy to memory. |
|
Recommended action |
No action is required. |
RXTX messages
This section contains RXTX messages.
PRO_OVER_SPEEDLIMIT_ATK
|
Message text |
The [STRING] protocol packet input rate is greater than the speed limit, dropped packets: [UINT32]. |
|
Variable fields |
$1: Protocol name. $2: Number of packets dropped. |
|
Severity level |
4 (Warning) |
|
Example |
RXTX/4/PRO_OVER_SPEEDLIMIT_ATK: The ARP protocol packet input rate is greater than the speed limit, dropped packets: 100. |
|
Impact |
Users go offline or the system gets stuck. |
|
Cause |
The input rate of abnormal protocol packets such as attack or oversize packets exceeds the speed limit. |
|
Recommended action |
· If the input rate of FTP, HTTP, IPGW, IP-IPoE, or TFTP protocol packets, perform the following operations: a. Execute the user-defined protocol-group command to adjust the speed limit. b. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. · If the input rate of other protocol packets exceeds the speed limit, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
PRO_QUEUE_CONGEST_ATK
PRO_WHITELIST_QUEUE_CONGEST_ATK
|
Message text |
The [STRING] allowlist protocol dropped packets due to queue congestion: [UINT32]. |
|
Variable fields |
$1: Protocol name. $2: Number of packets dropped. |
|
Severity level |
4 (Warning) |
|
Example |
RXTX/4/PRO_WHITELIST_QUEUE_CONGEST_ATK: The BGP allowlist protocol dropped packets due to queue congestion: 100. |
|
Impact |
Users go offline or the system gets stuck. |
|
Cause |
Protocol packets in the allowlist are dropped due to untimely processing of queue congestion. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
SAVA messages
This section contains SAVA messages.
SAVA_SET_DRV_FAILED
|
Message text |
Failed to set the driver for enabling IPv6 SAVA on interface [STRING]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
5 |
|
Example |
SAVA/5/SAVA_SET_DRV_FAILED: Failed to set the driver for enabling IPv6 SAVA on interface GigabitEthernet1/0/1. |
|
Explanation |
The device failed to issue the command of enabling IPv6 SAVA on an interface to the driver. |
|
Recommended action |
Re-execute the ipv6 sava enable command to enable IPv6 SAVA on the interface. |
SAVA_SET_DRV_NO_RESOURCE
|
Message text |
Insufficient resources to set the driver for enabling IPv6 SAVA on interface [STRING]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
5 |
|
Example |
SAVA/5/SAVA_SET_DRV_NO_RESOURCE: Insufficient resources to set the driver for enabling IPv6 SAVA on interface GigabitEthernet1/0/1. |
|
Explanation |
The device failed to issue the command of enabling IPv6 SAVA on an interface to the driver due to insufficient resources. |
|
Recommended action |
Re-execute the ipv6 sava enable command to enable IPv6 SAVA on the interface. |
SAVA_SPOOFING_DETECTED
|
Message text |
Spoofing packet detected: Spoofing packet detected : source IP 2000::1, destination IP 3000::2, protocol 6, source port 200, destination port 3000 on interface GigabitEthernet1/0/1. |
|
Variable fields |
$1: Spoofed source IPv6 address. $2: Destination IP address. $3: IP packet protocol number. $4: Source port number. $5: Destination port number. $6: Interface name. |
|
Severity level |
6 |
|
Example |
SAVA/6/SAVA_SPOOFING_DETECTED: Spoofing packet detected : source IP 2000::1, destination IP 3000::2, protocol 6, source port 200, destination port 3000 on interface GigabitEthernet1/0/1. |
|
Explanation |
The device detected a source IPv6 address spoofing attack. An illegal host used the IP address of a legal user. |
|
Recommended action |
Verify that the packet source is legal. |
SCMD messages
This section contains SCMD messages.
PROCESS_ABNORMAL
|
Message text |
The process [STRING] exited abnormally. ServiceName=[STRING], ExitCode=[STRING], KillSignal=[STRING], StartTime=[STRING], StopTime=[STRING]. |
|
Variable fields |
$1: Process name. $2: Service name defined in the script. $3: Process exit code. If the process was closed by a signal, this field displays NA. $4: Signal that closed the process. If the process was not closed by a signal, this field displays NA. $5: Time when the process was created. $6: Time when the process was closed. |
|
Severity level |
4 |
|
Example |
SCMD/4/PROCESS_ABNORMAL: The process diagd exited abnormally. ServiceName=DIAG, ExitCode=1, KillSignal=NA, StartTime=2019-03-06 14:18:06, StopTime=2019-03-06 14:35:25. |
|
Explanation |
A service exited abnormally. You can use the process parameters for troubleshooting. |
|
Recommended action |
1. Use the display process command to identify whether the process exists. If the process exists, the process is recovered. 2. If the process is not recovered, collect the following information: a. Execute the view /var/log/trace.log > trace.log command in probe view, and upload the trace.log file saved in the storage media of the device to a PC through FTP or TFTP (in binary mode). b. Contact H3C Support. Do not reboot the device so H3C Support can help you locate the problem. 3. If the process has been recovered, but reasons need to be located, go to step 601. |
PROCESS_ACTIVEFAILED
|
Message text |
The standby process [STRING] failed to switch to the active process due to uncompleted synchronization, and was restarted. |
|
Variable fields |
$1: Process name. |
|
Severity level |
4 |
|
Example |
SCMD/4/PROCESS_ACTIVEFAILED: The standby process diagd failed to switch to the active process due to uncompleted synchronization, and was restarted. |
|
Explanation |
The standby process failed to switch to the active process because the active process exited abnormally when the standby process has not completed synchronization. The standby process was restarted. |
|
Recommended action |
No action is required. |
PROCESS_CORERECORD
|
Message text |
Exceptions occurred with process [STRING]. A core dump file was generated. |
|
Variable fields |
$1: Process name. |
|
Severity level |
4 |
|
Example |
SCMD/4/PROCESS_CORERECORD: Exceptions occurred with process diagd. A core dump file was generated. |
|
Explanation |
Exceptions occurred with the process and a core dump file was generated. The core dump file contains information relevant to the process exceptions. You can use the file for troubleshooting. |
|
Recommended action |
1. Execute the display exception context command to collect process exception information, and save the information to a file. 2. Execute the display exception filepath command to display the core file. 3. Upload the core file and the file that stores the process exception information to a PC through FTP or TFTP (in binary mode). 4. Contact H3C Support. Do not reboot the device so H3C Support can help you locate the problem. |
SCM_ABNORMAL_REBOOT
|
Message text |
Pattern 1: The process [STRING] can't be restored. Reboot now. Pattern 2: The process [STRING] can't be restored. Reboot [STRING] now. |
|
Variable fields |
Pattern 1: $1: Process name. Pattern 1: $1: Process name. $2: Chassis number and slot number or slot number. |
|
Severity level |
3 |
|
Example |
SCMD/3/SCM_ABNORMAL_REBOOT: The process ipbased can't be restored. Reboot slot 2 now. |
|
Explanation |
Pattern 1: The process exited abnormally during the device startup. If the process cannot recover after multiple automatic restart attempts, the device will restart automatically. Pattern 2: The process exited abnormally during the startup of a specified slot. If the process cannot recover after multiple automatic restart attempts, the specified slot will restart automatically. |
|
Recommended action |
1. Use the display process command to verify that the process has restored after the card restarts. 2. If the problem persists, contact H3C Support. |
SCM_ABNORMAL_REBOOTMDC
|
Message text |
The process [STRING] in [STRING] [UINT16] can't be restored. Reboot [STRING] [UINT16] now. |
|
Variable fields |
$1: Process name. $2: Object type, MDC or context. $3: ID of the MDC or context. $4: Object type, MDC or context. $5: ID of the MDC or context. |
|
Severity level |
3 |
|
Example |
SCMD/3/SCM_ABNORMAL_REBOOTMDC: The process ipbased in MDC 2 can't be restored. Reboot MDC 2 now. |
|
Explanation |
The process exited abnormally during the startup of the MDC on the active MPU or the context on the main security engine in the security engine group. If the process cannot restore after multiple automatic restart attempts, the MDC or context will restart automatically. This message will be output in MDC 1 or Context 1. |
|
Recommended action |
1. Use the display process command to verify that the process has restored after the card restarts. 2. If the problem persists, contact H3C Support. |
SCM_ABORT_RESTORE
|
Message text |
|
|
Variable fields |
$1: Process name. |
|
Severity level |
3 |
|
Example |
SCMD/3/SCM_ABORT_RESTORE: The process ipbased can't be restored, abort it. |
|
Explanation |
The process exited abnormally during the system operation. If the process cannot restore after multiple automatic restart attempts, the device will not restore the process. |
|
Recommended action |
1. Use the display process log command in any view to display the details about process exit. 2. Restart the card or the MDC where the process is located. 3. Provide the output from the display process log command to H3C Support. |
SCM_INSMOD_ADDON_TOOLONG
|
Message text |
Failed to finish loading [STRING] in [UINT32] minutes. |
|
Variable fields |
$1: Kernel file name. $2: File loading duration. |
|
Severity level |
4 |
|
Example |
SCMD/4/SCM_INSMOD_ADDON_TOOLONG: Failed to finish loading addon.ko in 30 minutes. |
|
Explanation |
Kernel file loading timed out during device startup. |
|
Recommended action |
1. Restart the card. 2. Contact H3C Support. |
SCM_KERNEL_INIT_TOOLONG
|
Message text |
Kernel init in sequence [STRING] function [STRING] failed to finish in [UINT32] minutes. |
|
Variable fields |
$1: Kernel event phase. $2: Address of the function corresponding to the kernel event. $3: Time duration. |
|
Severity level |
4 |
|
Example |
SCMD/4/SCM_KERNEL_INIT_TOOLONG: Kernel init in sequence 0x25e7 function 0x6645ffe2 failed to finish in 15 minutes. |
|
Explanation |
A function at a phase during kernel initialization ran too long. |
|
Recommended action |
1. Restart the card. 2. Contact H3C Support. |
SCM_PROCESS_STARTING_TOOLONG
|
Message text |
The process [STRING] on [STRING] [UINT16] has not finished starting in [UINT32] hours. |
|
Variable fields |
$1: Process name. $2: Object type, MDC or context. This field is not displayed if the device does not support MDC or context. $3: ID of the MDC or context. This field is not displayed if the device does not support MDC or context. $4: Time duration. |
|
Severity level |
4 |
|
Example |
SCMD/4/ SCM_PROCESS_STARTING_TOOLONG: The process ipbased on MDC 2 has not finished starting in 1 hours. |
|
Explanation |
The process initialization takes a long time and has not been finished. Too many processes have been configured or the process is abnormal. |
|
Recommended action |
1. Wait 6 hours and then verify that the process has been started. 2. Restart the card/MDC/context, and then use the display process command to verify that the process has restored. 3. Contact H3C Support. |
SCM_PROCESS_STILL_STARTING
|
Message text |
The process [STRING] on [STRING] [UINT16] is still starting for [UINT32] minutes. |
|
Variable fields |
$1: Process name. $2: Object type, MDC or context. This field is not displayed if the device does not support MDC or context. $3: ID of the MDC or context. This field is not displayed if the device does not support MDC or context. $4: Time duration. |
|
Severity level |
6 |
|
Example |
SCMD/6/SCM_PROCESS_STILL_STARTING: The process ipbased on MDC 2 is still starting for 20 minutes. |
|
Explanation |
A process is always in startup state. |
|
Recommended action |
No action is required. |
SCM_SKIP_PROCESS
|
Message text |
The process [STRING] was skipped because it failed to start within 6 hours. |
|
Variable fields |
$1: Process name. |
|
Severity level |
4 |
|
Example |
SCMD/4/SCM_SKIP_PROCESS: The process ipbased was skipped because it failed to start within 6 hours. |
|
Explanation |
A process has not completed its startup within six hours during the card/MDC/context startup, skip this process and go on with the startup. |
|
Recommended action |
1. Restart the card/MDC/context. 2. Use the display process command to verify that the process has restored. 3. Provide the output from the display process log command to H3C Support. |
SCM_SKIP_PROCESS
|
Message text |
The process [STRING] on [STRING] [UINT16] was skipped because it failed to start within 6 hours. |
|
Variable fields |
$1: Process name. $2: Object type, MDC or context. This field is not displayed if the device does not support MDC or context. $3: ID of the MDC or context. This field is not displayed if the device does not support MDC or context. |
|
Severity level |
3 |
|
Example |
SCMD/3/SCM_SKIP_PROCESS: The process ipbased on MDC 2 was skipped because it failed to start within 6 hours. |
|
Explanation |
A process failed to start within 6 hours. The device will skip this process and continue to start. |
|
Recommended action |
1. Restart the card/MDC/context, and then use the display process command to verify that the process has restored. 2. Contact H3C Support. |
SCRLSP messages
This section contains static CRLSP messages.
SCRLSP_LABEL_DUPLICATE
|
Message text |
Incoming label [INT32] for static CRLSP [STRING] is duplicate. |
|
Variable fields |
$1: Incoming label value. $2: Static CRLSP name. |
|
Severity level |
4 |
|
Example |
SCRLSP/4/SCRLSP_LABEL_DUPLICATE: Incoming label 1024 for static CRLSP aaa is duplicate. |
|
Explanation |
The incoming label of a static CRLSP was occupied by another configuration, for example, by a static PW or by a static LSP. This message is generated when one of the following events occurs: · When MPLS is enabled, configure a static CRLSP with an incoming label which is occupied by another configuration. · Enable MPLS when a static CRLSP whose incoming label is occupied by another configuration already exists. |
|
Recommended action |
Remove this static CRLSP, and reconfigure it with another incoming label. |
SESSION messages
This section contains session messages.
SESSION_DRV_EXCEED
|
Message text |
The number of session entries ([UINT32]) supported by hardware already reached. |
|
Variable fields |
$1: The maximum number of session entries supported by hardware. |
|
Severity level |
2 |
|
Example |
SESSION/2/SESSION_DRV_EXCEED: The number of session entries (65535) supported by hardware already reached. |
|
Explanation |
This message is sent when the maximum number of session entries supported by hardware is reached. |
|
Recommended action |
No action is required. |
SESSION_DRV_RECOVERY
|
Message text |
Session resources supported by hardware had been released. |
|
Variable fields |
None. |
|
Severity level |
2 |
|
Example |
SESSION/2/SESSION_DRV_RECOVERY: Session resources supported by hardware had been released. |
|
Explanation |
This message is sent when the device recovers from the session entry exhaustion condition. |
|
Recommended action |
No action is required. |
SESSION_IPV4_FLOW
|
Message text |
Protocol(1001)=[STRING];SrcIPAddr(1003)=[IPADDR];SrcPort(1004)=[UINT16];NATSrcIPAddr(1005)=[IPADDR];NATSrcPort(1006)=[UINT16];DstIPAddr(1007)=[IPADDR];DstPort(1008)=[UINT16];NATDstIPAddr(1009)=[IPADDR];NATDstPort(1010)=[UINT16];InitPktCount(1044)=[UINT32];InitByteCount(1046)=[UINT32];RplyPktCount(1045)=[UINT32];RplyByteCount(1047)=[UINT32];RcvVPNInstance(1042)=[STRING];SndVPNInstance(1043)=[STRING];RcvDSLiteTunnelPeer(1040)=[STRING];SndDSLiteTunnelPeer(1041)=[STRING];BeginTime_e(1013)=[STRING];EndTime_e(1014)=[STRING];Event(1048)=([UNIT16])[STRING]; |
|
Variable fields |
$1: Protocol type. $2: Source IP address. $3: Source port number. $4: Source IP address after translation. $5: Source port number after translation.. $6: Destination IP address. $7: Destination port number. $8: Destination IP address after translation. $9: Destination port number after translation. $10: Total number of inbound packets. $11: Total number of inbound bytes. $12: Total number of outbound packets. $13: Total number of outbound bytes. $14: Source VPN instance name. $15: Destination VPN instance name. $16: Source DS-Lite tunnel. $17: Destination DS-Lite tunnel. $18: Time when the session is created. $19: Time when the session is removed. $20: Event type. $20: Event description: ¡ Session created. ¡ Active flow threshold. ¡ Normal over. ¡ Aged for timeout. ¡ Aged for reset or config-change. ¡ Other. |
|
Severity level |
6 |
|
Example |
SESSION/6/SESSION_IPV4_FLOW: Protocol(1001)=UDP;SrcIPAddr(1003)=10.10.10.1;SrcPort(1004)=1024;NATSrcIPAddr(1005)=10.10.10.1;NATSrcPort(1006)=1024;DstIPAddr(1007)=20.20.20.1;DstPort(1008)=21;NATDstIPAddr(1009)=20.20.20.1;NATDstPort(1010)=21;InitPktCount(1044)=1;InitByteCount(1046)=50;RplyPktCount(1045)=0;RplyByteCount(1047)=0;RcvVPNInstance(1042)=;SndVPNInstance(1043)=;RcvDSLiteTunnelPeer(1040)=;SndDSLiteTunnelPeer(1041)=;BeginTime_e(1013)=03182024082546;EndTime_e(1014)=;Event(1048)=(8)Session created; |
|
Explanation |
This message is sent in one of the following conditions: · An IPv4 session is created or removed. · Periodically during an IPv4 session. · The traffic-based or time-based threshold of an IPv4 session is reached. |
|
Recommended action |
No action is required. |
SESSION_IPV6_FLOW
|
Message text |
Protocol(1001)=[STRING];SrcIPv6Addr(1036)=[IPADDR];SrcPort(1004)=[UINT16];DstIPv6Addr(1037)=[IPADDR];DstPort(1008)=[UINT16];InitPktCount(1044)=[UINT32];InitByteCount(1046)=[UINT32];RplyPktCount(1045)=[UINT32];RplyByteCount(1047)=[UINT32];RcvVPNInstance(1042)=[STRING];SndVPNInstance(1043)=[STRING];BeginTime_e(1013)=[STRING];EndTime_e(1014)=[STRING];Event(1048)=([UNIT16])[STRING]; |
|
Variable fields |
$1: Protocol type. $2: Source IPv6 address. $3: Source port number. $4: Destination IP address. $5: Destination port number. $6: Total number of inbound packets. $7: Total number of inbound bytes. $8: Total number of outbound packets. $9: Total number of outbound bytes. $10: Source VPN instance name. $11: Destination VPN instance name. $12: Time when the session is created. $13: Time when the session is removed. $14: Event type. $15: Event description: ¡ Session created. ¡ Active flow threshold. ¡ Normal over. ¡ Aged for timeout. ¡ Aged for reset or config-change. ¡ Other. |
|
Severity level |
6 |
|
Example |
SESSION/6/SESSION_IPV6_FLOW: Protocol(1001)=UDP;SrcIPv6Addr(1036)=2001::2;SrcPort(1004)=1024;DstIPv6Addr(1037)=3001::2;DstPort(1008)=53;InitPktCount(1044)=1;InitByteCount(1046)=110;RplyPktCount(1047)=0;RplyByteCount(1047)=0;RcvVPNInstance(1042)=;SndVPNInstance(1043)=;BeginTime_e(1013)=03182024082901;EndTime_e(1014)=;Event(1048)=(8)Session created; |
|
Explanation |
This message is sent in one of the following conditions: · An IPv6 session is created or removed. · Periodically during an IPv6 session. · The traffic-based or time-based threshold of an IPv6 session is reached. |
|
Recommended action |
No action is required. |
SHELL messages
This section contains shell messages.
SHELL_CMD
|
Message text |
-Line=[STRING]-IPAddr=[STRING]-User=[STRING]; Command is [STRING] |
|
Variable fields |
$1: User line type and number. If there is not user line information, this field displays **. $2: IP address. If there is not IP address information, this field displays **. $3: Username. If there is not username information, this field displays **. $4: Command string. |
|
Severity level |
6 |
|
Example |
SHELL/6/SHELL_CMD: -Line=aux0-IPAddr=**-User=**; Command is quit |
|
Explanation |
A command was executed. |
|
Recommended action |
No action is required. |
SHELL_CMD_CONFIRM
|
Message text |
Confirm option of command [STRING] is [STRING]. |
|
Variable fields |
$1: Command string. $2: Confirm option. |
|
Severity level |
6 |
|
Example |
SHELL/6/SHELL_CMD_CONFIRM: Confirm option of command save is no. |
|
Explanation |
A user selected a confirmation option for a command. |
|
Recommended action |
No action is required. |
SHELL_CMD_EXECUTEFAIL
|
Message text |
-User=[STRING]-IPAddr=[STRING]; Command [STRING] in view [STRING] failed to be executed. |
|
Variable fields |
$1: Username. $2: IP address. $3: Command string. $4: Command view. |
|
Severity level |
4 |
|
Example |
SHELL/4/SHELL_CMD_EXECUTEFAIL: -User=**-IPAddr=192.168.62.138; Command save in view system failed to be executed. |
|
Explanation |
A command deployed by a background program failed to be executed. |
|
Recommended action |
No action is required. |
SHELL_CMD_INPUT
|
Message text |
|
|
Variable fields |
$1: Command string. $2: String entered by the user. |
|
Severity level |
6 |
|
Example |
SHELL/6/SHELL_CMD_INPUT: Input string for the save command is startup.cfg. SHELL/6/SHELL_CMD_INPUT: Input string for the save command is CTRL_C. SHELL/6/SHELL_CMD_INPUT: Input string for the save command is the Enter key. |
|
Explanation |
A user responded to the input requirement of a command. |
|
Recommended action |
No action is required. |
SHELL_CMD_INPUT_TIMEOUT
|
Message text |
Operation timed out: Getting input for the [STRING] command. |
|
Variable fields |
$1: Command string. |
|
Severity level |
6 |
|
Example |
SHELL/6/SHELL_CMD_INPUT_TIMEOUT: Operation timed out: Getting input for the fdisk command. |
|
Explanation |
The user did not respond to the input requirement of a command before the timeout timer expired. |
|
Recommended action |
No action is required. |
SHELL_CMD_LOCKEDBYOTHER
|
Message text |
SHELL/6/SHELL_CMD_LOCKEDBYOTHER: The system has been locked by [STRING]. |
|
Variable fields |
$1: Session type. |
|
Severity level |
6 |
|
Example |
SHELL/6/SHELL_CMD_LOCKEDBYOTHER: The system has been locked by NETCONF. |
|
Explanation |
Another user locked the configuration. You cannot configure the device. |
|
Recommended action |
Wait for the user to unlock the configuration. |
SHELL_CMD_MATCHFAIL
|
Message text |
-User=[STRING]-IPAddr=[STRING]; Command [STRING] in view [STRING] failed to be matched. |
|
Variable fields |
$1: Username. $2: IP address. $3: Command string. $4: Command view. |
|
Severity level |
4 |
|
Example |
SHELL/4/SHELL_CMD_MATCHFAIL: -User=**-IPAddr=192.168.62.138; Command description 10 in view system failed to be matched. |
|
Explanation |
The command string has errors, or the view does not support the command. |
|
Recommended action |
Enter the correct command string. Make sure the command is supported in the view. |
SHELL_CMDDENY
|
Message text |
-Line=[STRING]-IPAddr=[STRING]-User=[STRING]; Command=[STRING] is denied. |
|
Variable fields |
$1: User line type and number. If there is not user line information, this field displays **. $2: IP address. If there is not IP address information, this field displays **. $3: Username. If there is not username information, this field displays **. $4: Command string. |
|
Severity level |
5 |
|
Example |
SHELL/5/SHELL_CMDDENY: -Line=vty0-IPAddr=192.168.62.138-User=**; Command vlan 10 is permission denied. |
|
Explanation |
The user did not have the right to execute the command. |
|
Recommended action |
No action is required. |
SHELL_CMDFAIL
|
Message text |
The [STRING] command failed to restore the configuration. |
|
Variable fields |
$1: Command string. |
|
Severity level |
6 |
|
Example |
SHELL/6/SHELL_CMDFAIL: The “vlan 1024” command failed to restore the configuration. |
|
Explanation |
A command was not restored during a configuration rollback from a .cfg file. |
|
Recommended action |
No action is required. |
SHELL_COMMIT_FAIL
|
Message text |
-Line=[STRING]-IPAddr=[STRING]-User=[STRING]; Failed to commit the target configuration. |
|
Variable fields |
$1: User line type and number. If there is not user line information, this field displays **. $2: IP address. If there is not IP address information, this field displays **. $3: Username. If there is not username information, this field displays **. |
|
Severity level |
4 |
|
Example |
SHELL/4/SHELL_COMMIT_FAIL: -Line=aux0-IPAddr=**-User=**; Failed to commit the target configuration. |
|
Explanation |
A target configuration commit operation failed in private or exclusive mode. |
|
Recommended action |
No action is required. |
SHELL_COMMIT_ROLLBACK
|
Message text |
The configuration commit delay is overtime, a configuration rollback will be performed. |
|
Variable fields |
N/A |
|
Severity level |
5 |
|
Example |
SHELL/5/SHELL_COMMIT_ROLLBACK: The configuration commit delay is overtime, a configuration rollback will be performed. |
|
Explanation |
The configuration commit delay timer expired. A configuration rollback will occur. |
|
Recommended action |
Stop configuring the device and wait for the rollback to finish. |
SHELL_COMMIT_ROLLBACKDONE
|
Message text |
The configuration rollback has been performed. |
|
Variable fields |
N/A |
|
Severity level |
5 |
|
Example |
SHELL/5/SHELL_COMMIT_ROLLBACKDONE: The configuration rollback has been performed. |
|
Explanation |
The configuration rollback was finished. |
|
Recommended action |
No action is required. |
SHELL_COMMIT_ROLLBACKFAIL
|
Message text |
Failed to roll back the configuration from the uncommitted changes. |
|
Variable fields |
N/A |
|
Severity level |
5 |
|
Example |
SHELL/5/ SHELL_COMMIT_ROLLBACKFAIL: Failed to roll back the configuration from the uncommitted changes. |
|
Explanation |
A configuration rollback occurred after the configuration commit delay timer expired but the rollback failed. |
|
Recommended action |
Roll back the configuration as required. |
SHELL_COMMIT_SUCCESS
|
Message text |
-Line=[STRING]-IPAddr=[STRING]-User=[STRING]; Target configuration successfully committed. |
|
Variable fields |
$1: User line type and number. If there is not user line information, this field displays **. $2: IP address. If there is not IP address information, this field displays **. $3: Username. If there is not username information, this field displays **. |
|
Severity level |
5 |
|
Example |
SHELL/5/SHELL_COMMIT_SUCCESS: -Line=aux0-IPAddr=**-User=**; Target configuration successfully committed. |
|
Explanation |
A target configuration commit operation succeeded in private or exclusive mode. |
|
Recommended action |
No action is required. |
SHELL_CRITICAL_CMDFAIL
|
Message text |
-User=[STRING]-IPAddr=[STRING]; Command=[STRING] . |
|
Variable fields |
$1: Username. $2: IP address. $3: Command string. |
|
Severity level |
6 |
|
Example |
SHELL/6/SHELL_CRITICAL_CMDFAIL: -User=admin-IPAddr=169.254.0.7; Command is save. |
|
Explanation |
A command failed to be executed. |
|
Recommended action |
No action is required. |
SHELL_LOGIN
|
Message text |
[STRING] logged in from [STRING]. |
|
Variable fields |
$1: Username. $2: User line type and number. |
|
Severity level |
5 |
|
Example |
SHELL/5/SHELL_LOGIN: Console logged in from console0. |
|
Explanation |
A user logged in. If the user logged in to the standby MPU, the user line type and number field displays local. |
|
Recommended action |
No action is required. |
SHELL_LOGOUT
|
Message text |
[STRING] logged out from [STRING]. |
|
Variable fields |
$1: Username. $2: User line type and number. |
|
Severity level |
5 |
|
Example |
SHELL/5/SHELL_LOGOUT: Console logged out from console0. |
|
Explanation |
A user logged out. If the user logged out from the standby MPU, the user line type and number field displays local. |
|
Recommended action |
No action is required. |
SHELL_SAVE_FAILED
|
Message text |
Failed to save running configuration to configuration file for configuration rollback. |
|
Variable fields |
N/A |
|
Severity level |
5 |
|
Example |
SHELL/5/SHELL_SAVE_FAILED: Failed to save running configuration to configuration file for configuration rollback. |
|
Explanation |
The system failed to save the running configuration to the configuration file and does not support a rollback. The system saves the running configuration to the configuration file in the following situations: · The commit command is executed. · The commit command is not executed before the timer set by using the commit confirmed command expires. |
|
Recommended action |
If necessary, roll back the configuration manually. |
SHELL_SAVE_SUCCESS
|
Message text |
Saved running configuration to configuration file for configuration rollback. |
|
Variable fields |
N/A |
|
Severity level |
5 |
|
Example |
SHELL/5/SHELL_SAVE_SUCCESS: Saved running configuration to configuration file for configuration rollback. |
|
Explanation |
The system saved the running configuration to the configuration file successfully and is ready for a rollback. The system saves the running configuration to the configuration file in the following situations: · The commit command is executed. · The commit command is not executed before the timer set by using the commit confirmed command expires. |
|
Recommended action |
No action is required. |
SHELL_SAVEPOINT_EXIST
|
Message text |
The running configuration at this rollback point is the same as the configuration at the previous rollback point. |
|
Variable fields |
N/A |
|
Severity level |
5 |
|
Example |
SHELL/5/SHELL_SAVEPOINT_EXIST: The running configuration at this rollback point is the same as the configuration at the previous rollback point. |
|
Explanation |
The specified two rollback points have the same configuration. |
|
Recommended action |
No action is required. |
SHELL_SAVEPOINT_FAILED
|
Message text |
Failed to create a new rollback point. |
|
Variable fields |
N/A |
|
Severity level |
5 |
|
Example |
SHELL/5/SHELL_SAVEPOINT_FAILED: Failed to create a new rollback point. |
|
Explanation |
An attempt to create a new rollback point failed. |
|
Recommended action |
To save the rollback point, manually roll back to the rollback point, verify that the file system has sufficient space, and execute the commit command again. |
SHELL_SAVEPOINT_FAILED
|
Message text |
Created a new rollback point. |
|
Variable fields |
N/A |
|
Severity level |
5 |
|
Example |
SHELL/5/SHELL_SAVEPOINT_SUCCESS: Created a new rollback point. |
|
Explanation |
An attempt to create a new rollback point succeeded. |
|
Recommended action |
No action is required. |
SLSP messages
This section contains static LSP messages.
SLSP_LABEL_DUPLICATE
|
Message text |
Incoming label [INT32] for static LSP [STRING] is duplicate. |
|
Variable fields |
$1: Incoming label value. $2: Static LSP name. |
|
Severity level |
4 |
|
Example |
SLSP/4/SLSP_LABEL_DUPLICATE: Incoming label 1024 for static LSP aaa is duplicate. |
|
Explanation |
The incoming label of a static LSP was occupied by another configuration, for example, by a static PW or by a static CRLSP. This message is generated when one of the following events occurs: · When MPLS is enabled, configure a static LSP with an incoming label which is occupied by another configuration. · Enable MPLS when a static LSP whose incoming label is occupied by another configuration already exists. |
|
Recommended action |
Remove this static LSP, and reconfigure it with another incoming label. |
SMA messages
This section contains State Machine Based Anti-Spoofing (SMA) messages.
SMA_ANTI_CONNECT_ESTABLISHED
|
Message text |
Established a [STRING]. connection at level [STRING]. |
|
Variable fields |
$1: Connection type. $2: Level of the address domain to which the ACS belongs. |
|
Severity level |
5 |
|
Example |
SMA_ANTI/5/SMA_ANTI_CONNECT_ESTABLISHED: Established a TCP connection at level 2. |
|
Explanation |
The ACS and the AER established a connection successfully. |
|
Recommended action |
No action is required. |
SMA_ANTI_CONNECT_FAILED
|
Message text |
Terminated the [STRING]. connection at ACS level [STRING]. between AER and ACS. |
|
Variable fields |
$1: Connection type. $2: Level of the address domain to which the ACS belongs. |
|
Severity level |
4 |
|
Example |
SMA_ANTI/4/SMA_ANTI_CONNECT_FAILED: Terminated the SSL connection at ACS level 2 between the AER and ACS. |
|
Explanation |
The connection between the ACS and the AER was terminated. |
|
Recommended action |
Verify that the ACS and AER are configured correctly and the network connectivity between the ACS and the AER is normal. |
SNMP messages
This section contains SNMP messages.
SNMP_ACL_RESTRICTION
|
Message text |
SNMP [STRING] from [STRING] is rejected due to ACL restriction. |
|
Variable fields |
$1: SNMP community/usm-user/group. $2: IP address of the NMS. |
|
Severity level |
3 |
|
Example |
SNMP/3/SNMP_ACL_RESTRICTION: SNMP community public from 192.168.1.100 is rejected due to ACL restrictions. |
|
Explanation |
SNMP packets are denied because of ACL restrictions. |
|
Recommended action |
Check the ACL configuration on the SNMP agent, and check if the agent was attacked. |
SNMP_AUTHEN_FAILURES
|
Message text |
[UINT32] SNMP authentication failures in the most recent 60s. |
|
Variable fields |
$1: Number of SNMP authentication failures in the most recent 60s. |
|
Severity level |
4 |
|
Example |
SNMP/4/SNMP_AUTHEN_FAILURES: 17 SNMP authentication failures in the most recent 60s. |
|
Explanation |
When SNMP authentication fails for the first time, the system outputs an SNMP_AUTHENTICATION_FAILURE log and starts a 60-second timer. When the device receives multiple SNMP requests within the 60 seconds, and all these requests fail to be authenticated, the agent will count the total number of SNMP authentication failures within the 60 seconds and output this log. This prevents frequent output of SNMP authentication failure logs in case of many authentication failures in a short time. |
|
Recommended action |
No action is required. |
SNMP_AUTHENTICATION_FAILURE
|
Message text |
|
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
SNMP/4/SNMP_AUTHENTICATION_FAILURE: Failed to authenticate SNMP message. |
|
Explanation |
An NMS failed to be authenticated by the agent. |
|
Recommended action |
No action is required. |
SNMP_GET
|
Message text |
-seqNO=[UINT32]-srcIP=[STRING]-op=GET-node=[STRING]-value=[STRING]; The agent received a message. |
|
Variable fields |
$1: Sequence number of an SNMP operation log. $2: IP address of the NMS. $3: MIB object name and OID. $4: Value field of the request packet. |
|
Severity level |
6 |
|
Example |
SNMP/6/SNMP_GET: -seqNO=1-srcIP=192.168.28.28-op=GET-node=sysLocation(1.3.6.1.2.1.1.6.0)-value=; The agent received a message. |
|
Explanation |
SNMP received a Get request from an NMS. The system logs SNMP operations only when SNMP logging is enabled. |
|
Recommended action |
No action is required. |
SNMP_INFORM_LOST
|
Message text |
Inform failed to reach NMS through [STRING]: Inform [STRING][STRING]. |
|
Variable fields |
$1: NMS IP address and UDP port number. $2: Inform name and OID $3: Variable bindings of the inform. ¡ If no MIB object exists, only inform name and OID are displayed. ¡ If MIB objects are included, " with " are displayed before the MIB object and OID. MIB objects are separated by semicolons (;). |
|
Severity level |
3 |
|
Example |
SNMP/3/SNMP_INFORM_LOST: Inform failed to reach NMS through 192.168.111.222(163): Inform coldStart(1.3.6.1.6.3.1.1.5.1). |
|
Explanation |
The NMS is not reachable, or the device sent an inform to the NMS but did not receive a response from the NMS. If the inform carries multiple variable bindings and is too long, the system automatically fragments the inform and adds "-PART=xx" before each fragment to indicate the sequence number of the fragment. |
|
Recommended action |
Verify that the NMS is reachable to the device. |
SNMP_NOTIFY
|
Message text |
Notification [STRING][STRING]. |
|
Variable fields |
$1: Notification name and OID. $2: Variable bindings of the notification. ¡ If no MIB object exists, only notification name and OID are displayed. ¡ If MIB objects are included, " with " are displayed before the MIB object and OID. MIB objects are separated by semicolons (;). |
|
Severity level |
6 |
|
Example |
Notification not fragmented: SNMP/6/SNMP_NOTIFY: Notification hh3cLogIn(1.3.6.1.4.1.25506.2.2.1.1.3.0.1) with hh3cTerminalUserName(1.3.6.1.4.1.25506.2.2.1.1.2.1.0)=;hh3cTerminalSource(1.3.6.1.4.1.25506.2.2.1.1.2.2.0)=Console. Notification fragmented: SNMP/6/SNMP_NOTIFY: -MDC=1; -PART=1; Notification syslogMsgNotification(1.3.6.1.2.1.192.0.1) with syslogMsgFacility(1.3.6.1.2.1.192.1.2.1.2.1)=23;syslogMsgSeverity(1.3.6.1.2.1.192.1.2.1.3.1)=6;syslogMsgVersion(1.3.6.1.2.1.192.1.2.1.4.1)=1;syslogMsgTimeStamp(1.3.6.1.2.1.192.1.2.1.5.1)=07-e2-04-12-12-26-35-00-00-00-2d-00-00[hex];syslogMsgHostName(1.3.6.1.2.1.192.1.2.1.6.1)=H3C;syslogMsgAppName(1.3.6.1.2.1.192.1.2.1.7.1)=SHELL;syslogMsgProcID(1.3.6.1.2.1.192.1.2.1.8.1)=-;syslogMsgMsgID(1.3.6.1.2.1.192.1.2.1.9.1)=SHELL_CMD;syslogMsgSDParams(1.3.6.1.2.1.192.1.2.1.10.1)=4;syslogMsgMsg(1.3.6.1.2.1.192.1.2.1.11.1)= Command is snmp-agent trap enable syslog;syslogMsgSDParamValue(1.3.6.1.2.1.192.1.3.1.4.1.1.12.83.121.115.76.111.99.64.50.53.53.48.54.3.77.68.67)=1;syslogMsgSDParamValue(1.3.6.1.2.1.192.1.3.1.4.1.2.12.65.112.112.76.111.99.64.50.53.53.48.54.4.76.105.110.101)=con0. SNMP/6/SNMP_NOTIFY: -MDC=1; -PART=2; Notification syslogMsgNotification(1.3.6.1.2.1.192.0.1) with syslogMsgSDParamValue(1.3.6.1.2.1.192.1.3.1.4.1.3.12.65.112.112.76.111.99.64.50.53.53.48.54.6.73.80.65.100.100.114)=**;syslogMsgSDParamValue(1.3.6.1.2.1.192.1.3.1.4.1.4.12.65.112.112.76.111.99.64.50.53.53.48.54.4.85.115.101.114)=**. |
|
Explanation |
The SNMP agent sent a notification. This message displays the notification content. If the notification carries multiple variable bindings and is too long, the system automatically fragments the notification and adds "-PART=xx" before each fragment to indicate the sequence number of the fragment. |
|
Recommended action |
No action is required. |
SNMP_SET
|
Message text |
-seqNO=[UINT32]-srcIP=[STRING]-op=SET-errorIndex=[UINT32]-errorStatus=[STRING]-node=[STRING]-value=[STRING]; The agent received a message. |
|
Variable fields |
$1: Sequence number of an SNMP operation log. $2: IP address of the NMS. $3: Error index of the Set operation. $4: Error status of the Set operation. $5: MIB object name and OID. $6: Value of the MIB object changed by the Set operation. |
|
Severity level |
6 |
|
Example |
SNMP/6/SNMP_SET: -seqNO=3-srcIP=192.168.28.28-op=SET-errorIndex=0-errorStatus=noError-node=sysLocation(1.3.6.1.2.1.1.6.0)-value=Hangzhou China; The agent received a message. |
|
Explanation |
SNMP received a Set request from an NMS. The system logs SNMP operations only when SNMP logging is enabled. |
|
Recommended action |
No action is required. |
SNMP_USM_NOTINTIMEWINDOW
|
Message text |
-User=[STRING]-IPAddr=[STRING]; SNMPv3 message is not in the time window. |
|
Variable fields |
$1: Username. $2: IP address of the NMS. |
|
Severity level |
4 |
|
Example |
SNMP/4/SNMP_USM_NOTINTIMEWINDOW: -User=admin-IPAddr=169.254.0.7; SNMPv3 message is not in the time window. |
|
Explanation |
The SNMPv3 message is not in the time window. |
|
Recommended action |
No action is required. |
SNMP_IPLOCK
|
Message text |
The source IP was locked for [UINT] seconds because of the failure of login through SNMP.(SourceIP=[STRING], VPN=[STRING]) |
|
Variable fields |
$1: Locking period. The value is 8, 16, 32, or 300, in seconds. $2: IP address of the NMS that failed to establish an SNMP connection to the device. $3: VPN instance ID. |
|
Severity level |
4 |
|
Example |
SNMP/4/SNMP_IPLOCK: The source IP was locked for 8 seconds because of the failure of login through SNMP.(SourceIP=192.168.1.0, VPN=0) |
|
Explanation |
If an NMS fails to establish an SNMP connection to the device after the SNMP blacklist feature is enabled, the device adds the IP address of the NMS to the SNMP blacklist, locks the IP address, and outputs this message. This message describes the IP address of the locked NMS, the VPN to which the NMS belongs, and the locking period. During the locking period, the device does not process SNMP requests from the IP address, and the IP address cannot establish an SNMP connection to the device. |
|
Recommended action |
No action is required. |
SNMP_IPUNLOCK
|
Message text |
The source IP was unlocked(SourceIP=[STRING], VPN=[STRING]) |
|
Variable fields |
$1: IP address of the NMS that failed to establish an SNMP connection to the device. $2: VPN instance ID. |
|
Severity level |
5 |
|
Example |
SNMP/5/SNMP_IPUNLOCK: The source IP was unlocked(SourceIP=192.168.1.0, VPN=0). |
|
Explanation |
If a locked NMS establishes an SNMP connection to the device after the locking period expires, the device unlocks the NMS, removes the IP address of the NMS from the blacklist, and outputs this message. |
|
Recommended action |
No action is required. |
SNMP_IPLOCKSTAT
|
Message text |
In the last 5 minutes, [UINT32] IP addresses were locked. (IPList=(IP=[STRING])) |
|
Variable fields |
$1: Number of locked IP addresses in the last 5 minutes. $2: Locked IP addresses. |
|
Severity level |
4 |
|
Example |
SNMP/4/SNMP_IPLOCKSTAT: In the last 5 minutes,2 IP addresses were locked.(IPList=(IP=192.168.73.43),( IP=192.168.73.44)) |
|
Explanation |
When the IP addresses locked by the SNMP blacklist exceeds 3, the device does not output a message for each newly locked IP address but a statistical message every 5 minutes. This statistical message reports the number of IP addresses locked in the last 5 minutes and lists the locked IP addresses. |
|
Recommended action |
No action is required. |
SNMP_IPUNLOCKSTAT
|
Message text |
In the last 5 minutes, [UINT32] IP addresses were unlocked. (IPList=(IP=[STRING])) |
|
Variable fields |
$1: Number of unlocked IP addresses in the last 5 minutes. $2: Unlocked IP addresses. |
|
Severity level |
5 |
|
Example |
SNMP/5/SNMP_IPUNLOCKSTAT: In the last 5 minutes, 2 IP addresses were unlocked.(IPList=(IP=192.168.73.43),( IP=192.168.73.44)) |
|
Explanation |
This message reports the number of IP addresses unlocked from the SNMP blacklist in the last 5 minutes and lists the unlocked IP addresses. |
|
Recommended action |
No action is required. |
SNMP_USER_DENYLIST
|
Message text |
$1 added into the username denylist. |
|
Variable fields |
$1: SNMPv3 username. |
|
Severity level |
4 |
|
Example |
SNMP/4/SNMP_USER_DENYLIST: aaa added into the username denylist. |
|
Explanation |
If the number of consecutive authentication failures of an SNMPv3 user that attempts to access the device exceed the maximum limit within the specified period of time, the system will add the user to the SNMPv3 user denylist and outputs this message. An SNMPv3 user in the denylist is not allowed to access the device. |
|
Recommended action |
1. Determine whether the device is under an SNMP attack. 2. If the device is under an SNMP attack, prevent the attack or keep the username in the denylist. 3. If the device is not under an SNMP attack, but the SNMPv3 username is added to the denylist mistakenly, execute the snmp-agent denylist user activate command to release the user from the denylist. |
SNMP_USER_DENYLIST_RELEASE
|
Message text |
$1 released from the username denylist. |
|
Variable fields |
$1: SNMPv3 username. |
|
Severity level |
5 |
|
Example |
SNMP/5/SNMP_USER_DENYLIST_RELEASE: aaa released from the username denylist. |
|
Explanation |
This message is generated when an SNMPv3 user is released from the SNMPv3 user denylist. |
|
Recommended action |
No action is required. |
SRP
This section contains SR-MPLS TE policy messages.
SRP_BSID_CONFLICT
|
Message text |
Allocating a binding SID to an SR-TE policy failed. (Color [UINT32], Endpoint [STRING], BSID [UINT32], Reason [STRING], ConflictState [STRING]). |
|
Variable fields |
$1: Color value of the SR-MPLS TE policy. $2: End-point address of the SR-MPLS TE policy. $3: BSID of the SR-MPLS TE policy. $4: Reason why the BSID conflict occurred. Possible reasons include: · The binding SID of a manually configured SR-TE policy is the same as that of a different SR-TE policy delivered by BGP. · Different SR-TE policies dynamically delivered by BGP have the same binding SID. · Different manually configured SR-TE policies have the same binding SID. · Binding SID is out of the SRGB and SRLB ranges. $5: Conflict state. inConflict means that the BSID is in a conflict state. |
|
Severity level |
2 |
|
Example |
SRP/2/SRP_BSID_CONFLICT: Allocating a binding SID to an SR-TE policy fails.(Color 10, Endpoint 1.2.3.4, BSID 15000, Reason The binding SID of a manually configured SR-TE policy is the same as that of a different SR-TE policy delivered by BGP, ConflictState inConflict). |
|
Explanation |
The device detected a BSID conflict for an SR-MPLS TE policy. |
|
Recommended action |
1. Use the display segment-routing te policy command to identify the SR-MPLS TE policy that uses the conflicted BSID, and then change the BSID of that SR-MPLS TE policy. 2. If the issue persists, contact H3C Support. |
SRP_BSID_CONFLICT_CLEAR
|
Message text |
The binding SID allocation failure is resolved.(Color [UINT32], Endpoint [STRING], BSID [UINT32], Reason [STRING], ConflictState [STRING]). |
|
Variable fields |
$1: Color value of the SR-MPLS TE policy. $2: End-point address of the SR-MPLS TE policy. $3: BSID of the SR-MPLS TE policy. $4: Reason why the BSID conflict was resolved. · The binding SID that failed to be allocated was deleted. · The SR-TE policy with a binding SID allocation failure was deleted. · Binding SID allocation succeeded. $5: Current conflict state. conflictResolved means that the conflict has been resolved. |
|
Severity level |
2 |
|
Example |
SRP/2/SRP_BSID_CONFLICT_CLEAR: The binding SID allocation failure is resolved.( Color 10, Endpoint 1.2.3.4, BSID 16, Reason The binding SID that failed to be allocated was deleted., ConflictState conflictResolved). |
|
Explanation |
The BSID conflict for an SR-MPLS TE policy has been resolved, probably because the conflict BSID has been deleted or the SR-MPLS TE policy that uses the BSID has been deleted. |
|
Recommended action |
No action is required. |
SRP_PATH_STATE_DOWN
|
Message text |
SR-TE policy candidate path is down: Color [UINT32], EndPoint [STRING], Origin [STRING], Instance [UINT32], Originator [STRING], Discriminator[UINT32], Preference [UINT32], PreviousRole [STRING], Reason [STRING]. |
|
Variable fields |
$1: Color value of the SR-MPLS TE policy. $2: End-point address of the SR-MPLS TE policy. $3: Candidate path origin. Options include: · CLI—Manually configured. · BGP—Obtained from the BGP SR Policy route. · PCEP—Obtained through PCEP. $4: BGP instance number. This field is available only when the candidate path origin is BGP. $5: Head node of the candidate path, represented in the form of ASN Nodeaddress, where ASN is the AS number and Nodeaddress is the router ID of the BGP peer. This field is available only when the candidate path origin is BGP. $6: Discriminator of the candidate path. $7: Preference of the candidate path. $8: Role of the candidate path, Primary or Backup. $9: Reason why the candidate path went down. Possible reasons include: · Higher preference path exists. · Candidate path is shutdown. · Candidate path is deleted. · No valid SID lists. · Candidate path has empty SID lists. · SBFD session was down. · BFD session was down. · The color and endpoint were deleted. |
|
Severity level |
5 |
|
Example |
SRP/5/SRP_PATH_STATE_DOWN: SR-TE policy candidate path is down: Color 10, EndPoint 1.2.3.4, Origin BGP, Instance 0, Originator 10 1.1.1.1, Discriminator 100, Preference 100, PreviousRole Primary, Reason Higher preference path exists. |
|
Explanation |
The candidate path of an SR-MPLS TE policy went down. |
|
Recommended action |
Process according to the reason displayed, for example: · Verify that the SR-MPLS TE policy and SBFD settings are correct. · Make sure the network is not congested. |
SRP_POLICY_STATUS_CHG
|
Message text |
SR-TE policy (Color [UINT32], EndPoint [STRING]) status changed from [STRING] to [STRING]. Down Reason: [STRING]. |
|
Variable fields |
$1: Color value of the SR-MPLS TE policy. $2: End-point address of the SR-MPLS TE policy. $3: Old state, which can only be up. $4: New state, which can only be down. $5: Reason why the forwarding state of the SR-MPLS TE policy became down. Possible reasons include: · SBFD session was down. · Administratively down. · No candidate paths. · No valid candidate paths. · No valid SID lists. · The color and endpoint were deleted. |
|
Severity level |
4 |
|
Example |
SRP/4/SRP_POLICY_STATUS_CHG: SR-TE policy Color 10 EndPont 1.2.3.4 status changed from up to down. Down Reason: The color and end-point were deleted. |
|
Explanation |
The forwarding state of an SR-MPLS TE policy changed from up to down. |
|
Recommended action |
Process according to the reason displayed, for example: · Verify that the SR-MPLS TE policy, SBFD, or BFD settings are correct. · Make sure the network is not congested. |
SRP_SEGLIST_STATE_DOWN
|
Message text |
SR-TE policy SID list forwarding state down event: Color [UINT32], EndPoint [STRING], Origin [STRING], Instance [UINT32], Originator [STRING], Discriminator [UINT32], SegListID [UINT32], Reason [STRING]. |
|
Variable fields |
$1: Color value of the SR-MPLS TE policy. $2: End-point address of the SR-MPLS TE policy. $3: Candidate path origin. Options include: · CLI—Manually configured. · BGP—Obtained from the BGP SR Policy route. · PCEP—Obtained through PCEP. $4: BGP instance number. This field is available only when the candidate path origin is BGP. $5: Head node of the candidate path, represented in the form of ASN Nodeaddress, where ASN is the AS number and Nodeaddress is the router ID of the BGP peer. This field is available only when the candidate path origin is BGP. $6: Discriminator of the SID list. $7: Index of the SID list. $8: Reason why the forwarding state of the SID list became down. Possible reasons include: · Segment list was unavailable. · SBFD session was down. · BFD session was down. |
|
Severity level |
5 |
|
Example |
SRP/5/SRP_SEGLIST_STATE_DOWN: SR-TE policy SID list forwarding state down event: Color 10, EndPoint 1.1.1.1, Origin BGP, Instance 0, Originator 10 2.2.2.2, Discriminator 100, SegListID 1, Reason Segment list was unavailable. |
|
Explanation |
The forwarding state of a SID list became down. |
|
Recommended action |
· Examine the link status of the forwarding path identified by the SID list. · Verify that the SBFD settings are correct. |
SRP_SEGLIST_STATE_DOWN_CLEAR
|
Message text |
SR-TE policy SID list forwarding down is resolved. (Color [UINT32], EndPoint [STRING], Origin [STRING], Instance [UINT32], Originator [STRING], Discriminator [UINT32], SegListID [UINT32]) |
|
Variable fields |
$1: Color value of the SR-MPLS TE policy. $2: End-point address of the SR-MPLS TE policy. $3: Candidate path origin. Options include: · CLI—Manually configured. · BGP—Obtained from the BGP SR Policy route. · PCEP—Obtained through PCEP. $4: BGP instance number. This field is available only when the candidate path origin is BGP. $5: Head node of the candidate path, represented in the form of ASN Nodeaddress, where ASN is the AS number and Nodeaddress is the router ID of the BGP peer. This field is available only when the candidate path origin is BGP. $6: Discriminator of the SID list. $7: Index of the SID list. |
|
Severity level |
5 |
|
Example |
SRP/5/SRP_SEGLIST_STATE_DOWN _CLEAR: SR-TE policy SID list forwarding down is resolved. (Color 10, EndPoint 1.1.1.1, Origin BGP, Instance 0, Originator 10 2.2.2.2, Discriminator 100, SegListID 1) |
|
Explanation |
The forwarding state of a SID list became up, and the down state alarm has been cleared. |
|
Recommended action |
No action is required. |
SRP_STATE_DOWN
|
Message text |
SR-TE policy (Color [UINT32], EndPoint [STRING]) forwarding state went down: [STRING]. |
|
Variable fields |
$1: Color value of the SR-MPLS TE policy. $2: End-point address of the SR-MPLS TE policy. $3: Reason when the SR-MPLS TE policy went down. Possible reasons include: · SBFD session was down. · No candidate paths. · No valid candidate paths. · No valid SID lists. · The color and endpoint were deleted. · Administratively down. |
|
Severity level |
2 |
|
Example |
SRP/2/SRP_STATE_DOWN: SR-TE policy (Color 10, EndPoint 1.1.1.1) forwarding state went down: No candidate paths. |
|
Explanation |
An SR-MPLS TE policy went down. |
|
Recommended action |
Process according to the reason displayed, for example: · Verify that the SR-MPLS TE policy and SBFD settings are correct. · Make sure the network is not congested. |
SRP_STATE_DOWN_CLEAR
|
Message text |
SR-TE policy (Color [UINT32], EndPoint [STRING]) down alarm was cleared. |
|
Variable fields |
$1: Color value of the SR-MPLS TE policy. $1: End-point address of the SR-MPLS TE policy. |
|
Severity level |
2 |
|
Example |
SRP/2/SRP_STATE_DOWN_CLEAR: SR-TE policy (Color 10, EndPoint 1.1.1.1) down alarm was cleared. |
|
Explanation |
The forwarding state of an SR-MPLS TE policy became up, and the down state alarm has been cleared. |
|
Recommended action |
No action is required. |
SRPM messages
This section contains SRPM messages.
SRPM_IC
|
Message text |
No enough resources. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
SRPM/4/ SRPM_IC: -MDC=1-Slot=4; No enough resources. |
|
Impact |
The SRPM feature might fail to take effect. |
|
Cause |
Resources were insufficient. |
|
Recommended action |
1. Delete unused configuration to release resources. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
SRPM_IC
|
Message text |
This module does not support SRPM. Please check your configuration. |
|
Variable fields |
N/A |
|
Severity level |
2 (Critical) |
|
Example |
SRPM/2/SRPM_IC: -MDC=1-Slot=4; This module does not support SRPM. Please check your configuration. |
|
Impact |
The SRPM feature cannot be used. |
|
Cause |
The module does not support SRPM. |
|
Recommended action |
1. Change the card: 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
SRPM messages
This section contains Segment Routing Performance Measurement (SRPM) messages.
SRPM_DRV
|
Message text |
Interface [STRING] failed to issue the configuration to the driver in the slot. |
|
Variable fields |
$1: Layer 3 interface/subinterface name. |
|
Severity level |
5 |
|
Example |
SRPM/5/SRPM_DRV: -MDC=1-Slot=1; Interface Route-Aggregation1 failed to issue the configuration to the driver in the slot. |
|
Explanation |
Failed to issue the srpm delay-profile link-based query enable or srpm delay-profile link-based response enable command configured on a Layer 3 Ethernet interface/subinterface or a Layer 3 aggregate interface/subinterface to the driver in the slot. The reason might be insufficient hardware resources of the slot associated with the Layer 3 Ethernet interface or aggregation group member port. |
|
Recommended action |
Contact H3C Support. |
SRPV6 messages
This section contains SRv6 TE policy messages.
SRPV6_BSID_CONFLICT
|
Message text |
Allocating a binding SID to an SRv6-TE policy failed. (Color [UINT32], Endpoint [STRING], BSID [STRING], Reason [STRING], ConflictState [STRING]). |
|
Variable fields |
$1: Color value of the SRv6 TE policy. $2: Destination node address of the SRv6 TE policy. $3: BSID of the SRv6 TE policy. $4: Reasons for BSID conflict: · The binding SID of a manually configured SRv6-TE policy is the same as that of a different SRv6-TE policy delivered by BGP. · Different SRv6-TE policies dynamically delivered by BGP have the same binding SID. · Different manually configured SRv6-TE policies have the same binding SID. · Binding SID allocation failed. $5: Conflict state. inConflict indicates that a conflict is ongoing. |
|
Severity level |
2 |
|
Example |
SRPV6/2/SRPV6_BSID_CONFLICT: Allocating a binding SID to an SRv6-TE Policy fails.(Color 10, Endpoint 10::10, BSID 10::10, Reason The binding SID of a manually configured SRv6-TE Policy is the same as that of a different SRv6-TE Policy delivered by BGP, ConflictState inConflict). |
|
Explanation |
An SRv6 TE policy BSID allocation conflict or failure occurred. |
|
Recommended action |
1. Specify the color value and destination node address for the display segment-routing ipv6 te policy command to obtain the SRv6 TE policy using the BSID. Then modify the BSID value for the SRv6 TE policy. 2. If the issue persists, contact H3C Support. |
SRPV6_BSID_CONFLICT_CLEAR
|
Message text |
The binding SID allocation failure is resolved.(Color [UINT32], Endpoint [STRING], BSID [STRING], Reason [STRING], ConflictState [STRING]). |
|
Variable fields |
$1: Color value of the SRv6 TE policy. $2: Destination node address of the SRv6 TE policy. $3: BSID of the SRv6 TE policy. $4: Reason that the BSID conflict was resolved: · The binding SID that failed to be allocated was deleted. · The SRv6-TE policy with a binding SID allocation failure was deleted. · Binding SID allocation succeeded. $5: Conflict state. conflictResolved indicates that the conflict has been resolved. |
|
Severity level |
2 |
|
Example |
SRPV6/2/SRPV6_BSID_CONFLICT_CLEAR: The binding SID allocation failure is resolved.( Color 10, Endpoint 10::10, BSID 10::10, Reason The binding SID that failed to be allocated was deleted., ConflictState conflictResolved). |
|
Explanation |
The SRv6 TE policy BSID conflict was resolved. For example, the conflicting BSID was deleted and reconfigured, or the associated SRv6 TE policy was deleted. |
|
Recommended action |
· No action is required. |
SRPV6_PATH_STATE_DOWN
|
Message text |
SRv6-TE policy candidate path is down: Color [UINT32], EndPoint [STRING], Origin [STRING], Instance [UINT32], Originator [STRING], Discriminator[UINT32], Preference [UINT32], PreviousRole [STRING], Reason [STRING]. |
|
Variable fields |
$1: Color value of the SRv6 TE policy. $2: Destination node address of the SRv6 TE policy. $3: Origin of the candidate path: · CLI: Manually configured. · BGP: Obtained through a BGP SRv6 policy route. · PCEP: Obtained through PCEP. $4: BGP instance number. This field is displayed only when the candidate path origin is BGP. $5: Head node of the candidate path, in the format of ASN Nodeaddress. ASN is the AS number, and Nodeaddress is the router ID of the BGP peer. This field is displayed only when the candidate path origin is BGP. $6: Candidate path identifier. $7: Candidate path priority. $8: Candidate path role: · Primary. · Backup. $9: Reason that the candidate path went down: · Higher preference path exists. · Candidate path is shutdown. · Candidate path is deleted. · No valid segment list. · Candidate path has empty segment list. · SBFD session was down. · The color and end-point were deleted. |
|
Severity level |
5 |
|
Example |
SRPV6/5/SRPV6_PATH_STATE_DOWN: SRv6-TE Policy candidate path is down: Color 10, EndPoint 10::10, Origin BGP, Instance 0, Originator 10 100::10, Discriminator 100, Preference 100, PreviousRole Primary, Reason Higher preference path exists. |
|
Explanation |
The SRv6 TE policy candidate path went down. |
|
Recommended action |
Resolve the issue based on the candidate path down reason. Examine the SRv6 TE policy configuration and SBFD configuration, and check for network congestion. |
SRPV6_POLICY_STATUS_CHG
|
Message text |
SRv6-TE policy (Color [UINT32], EndPoint [STRING]) status changed from [STRING] to [STRING]. Down Reason: [STRING]. |
|
Variable fields |
$1: Color value of the SRv6 TE policy. $2: Destination node address of the SRv6 TE policy. $3: Previous state, which can only be up. $4: New state, which can only be down. $5: Reason that the SRv6 TE policy forwarding state went down: · SBFD session was down. · BFD session was down. · Administratively down. · No candidate path. · No valid candidate path. · No valid segment list. · The color and end-point were deleted. |
|
Severity level |
4 |
|
Example |
SRPV6/4/SRPV6_POLICY_STATUS_CHG: SRv6-TE Policy Color 10 EndPoint 10::10 status changed from up to down. Down Reason: The color and end-point are deleted. |
|
Explanation |
The forwarding state of the SRv6 TE policy changed from up to down. |
|
Recommended action |
Resolve the issue based on the SRv6 TE policy forwarding state down reason. Examine the SRv6 TE policy, BFD, and SBFD configuration, and check for network congestion. |
SRPV6_RESOURCE_EXCEED
|
Message text |
The number of used SRv6-TE policy resources exceeded the upper threshold. (ReourceType [STRING], ResourceCurrentCount [UINT32], ResourceThresholdUpperLimit [UINT32]%, ResourceThresholdLowerLimit [UINT32]%, ResourceTotalCount [UINT32]). |
|
Variable fields |
$1: SRv6 TE policy resource type: · srv6Policy: Forwarding entry ID of the SRv6 TE policy. · srv6PolicySegmentList: Forwarding entry ID of the SID list. · srv6PolicyGroup: Forwarding entry ID of the SRv6 TE policy group. · srv6PolicyFwdPath: Forwarding path of the SRv6 TE policy. $2: Number of SRv6 TE policy resources. $3: Upper threshold for SRv6 TE policy resources. $4: Lower threshold for SRv6 TE policy resources. $5: Maximum SRv6 TE policy resources. |
|
Severity level |
4 |
|
Example |
SRPV6/4/SRPV6_RESOURCE_EXDCEED: The number of used SRv6-TE Policy resources exceeded the upper threshold. (ReourceType srv6Policy, ResourceCurrentCount 4096, ResourceThresholdUpperLimit 80%, ResourceThresholdLowerLimit 75%, ResourceTotalCount 4096). |
|
Explanation |
The number of SRv6 TE policy resources exceeded the upper threshold. |
|
Recommended action |
Examine the SRv6 TE policy resource usage anomaly by resource type, and then delete unused SRv6 TE policies or SRv6 TE policy groups to save resources. |
SRPV6_RESOURCE_EXCEED_CLEAR
|
Message text |
The number of used SRv6-TE policy resources fell below the lower threshold. (ReourceType [STRING], ResourceCurrentCount [UINT32], ResourceThresholdUpperLimit [UINT32]%, ResourceThresholdLowerLimit [UINT32]%, ResourceTotalCount [UINT32]). |
|
Variable fields |
$1: SRv6 TE policy resource type: · srv6Policy: Forwarding entry ID of the SRv6 TE policy. · srv6PolicySegmentList: Forwarding entry ID of the SID list. · srv6PolicyGroup: Forwarding entry ID of the SRv6 TE policy group. · srv6PolicyFwdPath: Forwarding path of the SRv6 TE policy. $2: Number of SRv6 TE policy resources. $3: Upper threshold for SRv6 TE policy resources. $4: Lower threshold for SRv6 TE policy resources. $5: Maximum SRv6 TE policy resources. |
|
Severity level |
4 |
|
Example |
SRPV6/4/SRPV6_RESOURCE_EXCEED_CLEAR: The number of used SRv6-TE Policy resources fell below the lower threshold. (ReourceType srv6Policy, ResourceCurrentCount 3072, ResourceThresholdUpperLimit 80%, ResourceThresholdLowerLimit 75%, ResourceTotalCount 4096). |
|
Explanation |
The number of SRv6 TE policy resources dropped below the lower threshold. |
|
Recommended action |
No action is required. |
SRPV6_SEGLIST_STATE_DOWN
|
Message text |
SRv6-TE policy seglist forwarding state down event: Color [UINT32], EndPoint [STRING], Origin [STRING], Instance [UINT32], Originator [STRING], Discriminator [UINT32], SegListID [UINT32], Reason [STRING]. |
|
Variable fields |
$1: Color value of the SRv6 TE policy. $2: Destination node address of the SRv6 TE policy. $3: Origin of the candidate path: · CLI: Manually configured. · BGP: Obtained through a BGP SRv6 policy route. · PCEP: Obtained through PCEP. $4: BGP instance number. This field is displayed only when the candidate path origin is BGP. $5: Head node of the candidate path, in the format of ASN Nodeaddress. ASN is the AS number, and Nodeaddress is the router ID of the BGP peer. This field is displayed only when the candidate path origin is BGP. $6: SID list identifier. $7: SID list index. $8: Reason that the SID list forwarding state went down: · Segment list was unavailable. · SBFD session was down. |
|
Severity level |
5 |
|
Example |
SRPV6/5/SRPV6_SEGLIST_STATE_DOWN: SRv6-TE Policy seglist forwarding state down event: Color 10, EndPoint 10::10, Origin BGP, Instance 0, Originator 10 100::10, Discriminator 100, SegListID 1, Reason Segment list was unavailable. |
|
Explanation |
The SID list forwarding state went down. |
|
Recommended action |
Examine the link status for the SID list forwarding path and the SBFD configuration. |
SRPV6_SEGLIST_STATE_DOWN_CLEAR
|
Message text |
SRv6-TE policy seglist forwarding down is resolved. (Color [UINT32], EndPoint [STRING], Origin [STRING], Instance [UINT32], Originator [STRING], Discriminator [UINT32], SegListID [UINT32]) |
|
Variable fields |
$1: Color value of the SRv6 TE policy. $2: Destination node address of the SRv6 TE policy. $3: Origin of the candidate path: · CLI: Manually configured. · BGP: Obtained through a BGP SRv6 policy route. · PCEP: Obtained through PCEP. $4: BGP instance number. This field is displayed only when the candidate path origin is BGP. $5: Head node of the candidate path, in the format of ASN Nodeaddress. ASN is the AS number, and Nodeaddress is the router ID of the BGP peer. This field is displayed only when the candidate path origin is BGP. $6: SID list identifier. $7: SID list index. |
|
Severity level |
5 |
|
Example |
SRPV6/5/SRPV6_ SEGLIST_STATE_DOWN _CLEAR: SRv6-TE Policy seglist forwarding down is resolved. (Color 10, EndPoint 10::10, Origin BGP, Instance 0, Originator 10 100::10, Discriminator 100, SegListID 1) |
|
Explanation |
The SID list forwarding state down alarm was cleared. The forwarding state for the SID list came up. |
|
Recommended action |
No action is required. |
SRPV6_STATE_DOWN
|
Message text |
SRv6-TE policy (Color [UINT32], EndPoint [STRING]) forwarding state went down: [STRING]. |
|
Variable fields |
$1: Color value of the SRv6 TE policy. $2: Destination node address of the SRv6 TE policy. $3: Reason that the SRv6 TE policy forwarding state went down: · SBFD session was down. · BFD session was down. · Administratively down. · No candidate path. · No valid candidate path. · No valid segment list. · The color and end-point were deleted. |
|
Severity level |
2 |
|
Example |
SRPV6/2/SRPV6_STATE_DOWN: SRv6-TE Policy forwarding (Color 10, EndPoint 10::10) state went down: SBFD session was down. |
|
Explanation |
The forwarding state of the SRv6 TE policy went down. |
|
Recommended action |
Resolve the issue based on the SRv6 TE policy forwarding state down reason. Examine the SRv6 TE policy configuration and BFD configuration, and check for network congestion. |
SRPV6_STATE_DOWN_CLEAR
|
Message text |
SRv6-TE policy (Color [UINT32], EndPoint [STRING]) down alarm was cleared. |
|
Variable fields |
$1: Color value of the SRv6 TE policy. $2: Destination node address of the SRv6 TE policy. |
|
Severity level |
2 |
|
Example |
SRPV6/2/SRPV6_STATE_DOWN_CLEAR: SRv6-TE Policy (Color 10, EndPoint 10 10::10) down alarm was cleared. |
|
Explanation |
The SRv6 TE policy forwarding state down alarm was cleared. The forwarding state for the SRv6 TE policy came up. |
|
Recommended action |
No action is required. |
SRv6 messages
This section contains SRv6 messages.
SRV6_NO_SUPPORT
|
Message text |
SRv6 is not supported in this slot. |
|
Severity level |
5 |
|
Example |
SRV6/5/SRV6_NO_SUPPORT: SRv6 is not supported in this slot. |
|
Explanation |
The slot does not support the SRv6 feature. |
|
Recommended action |
No action is required. |
SSHC messages
This section contains SSH client messages.
SSHC_ALGORITHM_MISMATCH
|
Message text |
Failed to log in to SSH server [STRING] because of [STRING] algorithm mismatch. |
|
Variable fields |
$1: IP address of the SSH server. $2: Type of the algorithm, including encryption, key exchange, message authentication code (MAC), and public key. |
|
Severity level |
6 |
|
Example |
SSHC/6/SSHC_ALGORITHM_MISMATCH: Failed to log in to SSH server 192.168.30.11 because of encryption algorithm mismatch. |
|
Explanation |
The SSH client failed to log in to the SSH server because they used different algorithms. |
|
Recommended action |
Make sure the SSH client and the SSH server use the same algorithm. |
SSHC_DISCONNECT
|
Message text |
Remote SSH server connection is down. (ServerAddress=[STRING], VPNInstanceName=[STRING], Reason=[STRING]). |
|
Variable fields |
$1: IP address of the SSH server. $2: VPN instance name. $3: Reason for disconnection from the SSH server. |
|
Severity level |
5 |
|
Example |
SSH/5/SSHC_DISCONNECT: Remote SSH server connection is down. (ServerAddress=1.1.1.1, VPNInstanceName=vpn1, Reason=The connection is closed by the server). |
|
Explanation |
The SSH client is disconnected from the SSH server. |
|
Recommended action |
No action is required. |
SSHC_INSECURE_LOGIN
|
Message text |
SSH client login is insecure. (ServerAddress=[STRING], VPNInstanceName=[STRING], Reason=[STRING]) |
|
Variable fields |
$1: IP address of the SSH server. $2: VPN instance name. $3: Reason for insecure login: · The SSH client used one of the following insecure encryption algorithms: ¡ des_cbc. ¡ 3des_cbc. ¡ aes128_cbc. ¡ aes256_cbc. ¡ md5. ¡ md5_96. ¡ sha1. ¡ sha1_96. · The SSH client used one of the following insecure HMAC algorithms: ¡ md5. ¡ md5_96. ¡ sha1. ¡ sha1_96. |
|
Severity level |
5 |
|
Example |
SSH/5/SSHC_INSECURE_LOGIN: SSH client login is insecure. (ServerAddress=1.1.1.1, VPNInstanceName=vpn1, Reason=Insecure encryption algorithm) |
|
Explanation |
The user on the SSH client successfully logged in to the SSH server by using an insecure encryption algorithm. |
|
Recommended action |
Take the corresponding action according to the reason for insecure login: · Use a secure encryption algorithm, for example, aes128_ctr or aes256_ctr. · Use a secure HMAC algorithm, for example, sha2_256. |
SSHC_LOGIN_FAIL
|
Message text |
SSH client login failed. (FailedReason=[STRING], UserName=[STRING], IPAddress=[STRING], VPNInstanceName=[STRING]). |
|
Variable fields |
$1: Reason for login failure: · Incorrect username or password. · No authentication public key (ECDSA, DSA, or RSA public key) exists on the SSH server. $2: Username. $3: SSH client address. $4: VPN instance name. |
|
Severity level |
5 |
|
Example |
SSH/5/SSHC_LOGIN_FAIL: SSH client login failed. (FailedReason=Password authentication failed, UserName=admin, IPAddress=1.1.1.1, VPNInstanceName=vpn1). |
|
Explanation |
The SSH client failed to log in. |
|
Recommended action |
Contact the administrator to obtain correct username and password or configure the authentication public key on the server. |
SSHC_REKEY_FAIL
|
Message text |
SSH client key renegotiation with server failed. (SessionID=[STRING], FailedReason=[STRING], RekeyReason=[STRING], ServerAddress=[STRING], VPNInstanceName=[STRING]) |
|
Variable fields |
$1: SSH session ID. $2: Reason for key renegotiation failure. $3: Reason for key renegotiation. $4: IP address of the SSH server. $5: VPN instance name. |
|
Severity level |
5 |
|
Example |
SSH/5/SSHC_REKEY_FAIL: SSH client key renegotiation with server. (SessionID=0, FailedReason=The server does not support the requested encryption algorithm, RekeyReason=The number of sent packets has reached the upper limit, ServerAddress=1.1.1.1, VPNInstanceName=vpn1) |
|
Explanation |
The SSH client failed to perform key renegotiation with the SSH server. |
|
Recommended action |
Collect logs and configuration information, and then contact the technical support. |
SSHC_REKEY_STATUS
|
Message text |
SSH client key renegotiation with server. (SessionID=[ STRING], RekeyReason=[STRING], Status=[STRING], ServerAddress=[STRING], VPNInstanceName=[STRING]) |
|
Variable fields |
$1: SSH session ID. $2: Reason for key renegotiation in the SSH session: · The number of packets sent or received by the SSH client has reached the upper limit. · The volume of data transferred by the SSH client has reached the upper limit. · The update interval of the session initiated by the SSH client has been reached. $3: Key renegotiation status. $4: IP address of the SSH server. $5: VPN instance name. |
|
Severity level |
5 |
|
Example |
SSH/5/SSHC_REKEY_STATUS: SSH client key renegotiation with server. (SessionID=[0], RekeyReason=The number of sent packets has reached the upper limit, Status=Begin, ServerAddress=1.1.1.1, VPNInstanceName=vpn1) |
|
Explanation |
The SSH client performed key renegotiation with the SSH server. |
|
Recommended action |
Collect logs and configuration information, and then contact the technical support. |
SSHS messages
This section contains SSH server messages.
SSHS_ACL_DENY
|
Message text |
The SSH Connection [IPADDR]([STRING]) request was denied according to ACL rules. |
|
Variable fields |
$1: IP address of the SSH client. $2: VPN instance to which the IP address of the SSH client belongs. |
|
Severity level |
5 |
|
Example |
SSHS/5/SSH_ACL_DENY: The SSH Connection 1.2.3.4(vpn1) request was denied according to ACL rules. |
|
Explanation |
The SSH server detected a login attempt from the invalid SSH client and denied the connection request of the client based on the SSH login control ACL. |
|
Recommended action |
No action is required. |
SSHS_ALGORITHM_MISMATCH
|
Message text |
SSH client [STRING] failed to log in because of [STRING] algorithm mismatch. |
|
Variable fields |
$1: IP address of the SSH client. $2: Type of the algorithm, including encryption, key exchange, message authentication code (MAC), and public key. |
|
Severity level |
6 |
|
Example |
SSHS/6/SSHS_ALGORITHM_MISMATCH: SSH client 192.168.30.117 failed to log in because of encryption algorithm mismatch. |
|
Explanation |
The SSH client failed to log in to the SSH server because they used different algorithms. |
|
Recommended action |
Make sure the SSH client and the SSH server use the same algorithm. |
SSHS_AUTH_EXCEED_RETRY_TIMES
|
Message text |
SSH user [STRING] (IP: [STRING]) failed to log in, because the number of authentication attempts exceeded the upper limit. |
|
Variable fields |
$1: User name. $2: IP address of the SSH client. |
|
Severity level |
6 |
|
Example |
SSHS/6/SSHS_AUTH_EXCEED_RETRY_TIMES: SSH user David (IP: 192.168.30.117) failed to log in, because the number of authentication attempts exceeded the upper limit. |
|
Explanation |
The number of authentication attempts by an SSH user reached the upper limit. |
|
Recommended action |
Prompt the SSH user to use the correct login data to try again. |
SSHS_AUTH_FAIL
|
Message text |
SSH user [STRING] (IP: [STRING]) didn't pass public key authentication for [STRING]. |
|
Variable fields |
$1: Username. $2: IP address of the SSH client. $3: Failure reasons: · Wrong public key algorithm. · Wrong public key. · Wrong digital signature. |
|
Severity level |
5 |
|
Example |
SSHS/5/SSHS_AUTH_FAIL: SSH user David (IP: 192.168.30.117) didn't pass public key authentication for wrong public key algorithm. |
|
Explanation |
An SSH user failed the publickey authentication. |
|
Recommended action |
Tell the SSH user to try to log in again. |
SSHS_AUTH_TIMEOUT
|
Message text |
Authentication timed out for [IPADDR]. |
|
Variable fields |
$1: IP address of the SSH client. |
|
Severity level |
6 |
|
Example |
SSHS/6/SSHS_AUTH_TIMEOUT: Authentication timed out for 1.1.1.1. |
|
Explanation |
The authentication timeout timer expired, and the SSH user failed the authentication. |
|
Recommended action |
Make sure the SSH user enters correct authentication information before the authentication timeout timer expires. |
SSHS_CONNECT
|
Message text |
SSH user [STRING] (IP: [STRING]) connected to the server successfully(ServiceType=[STRING], LocalAddress=[STRING], VPNInstanceName=[STRING]). |
|
Variable fields |
$1: Username. $2: IP address of the SSH client. $3: Service type. Options are Stelnet, SCP, SFTP, or NETCONF. $4: IP address of the SSH server. $5: VPN instance name. |
|
Severity level |
6 |
|
Example |
SSHS/6/SSHS_CONNECT: SSH user David (IP: 192.168.30.117) connected to the server successfully(ServiceType=Stelnet, LocalAddress=1.1.1.1, VPNInstanceName=vpn1). |
|
Explanation |
An SSH user logged in to the server successfully. |
|
Recommended action |
No action is required. |
SSHS_DECRYPT_FAIL
|
Message text |
The packet from [STRING] failed to be decrypted with [STRING]. |
|
Variable fields |
$1: IP address of the SSH client. $2: Encryption algorithm, such as AES256-CBC. |
|
Severity level |
5 |
|
Example |
SSHS/5/SSHS_DECRYPT_FAIL: The packet from 192.168.30.117 failed to be decrypted with aes256-cbc. |
|
Explanation |
A packet from an SSH client failed to be decrypted. |
|
Recommended action |
No action is required. |
SSHS_DISCONNECT
|
Message text |
SSH user [STRING] (IP: [STRING]) disconnected from the server. |
|
Variable fields |
$1: Username. $2: IP address of the SSH client. |
|
Severity level |
6 |
|
Example |
SSHS/6/SSHS_DISCONNECT: SSH user David (IP: 192.168.30.117) disconnected from the server. |
|
Explanation |
An SSH user logged out. |
|
Recommended action |
No action is required. |
SSHS_ENCRYPT_FAIL
|
Message text |
The packet to [STRING] failed to be encrypted with [STRING]. |
|
Variable fields |
$1: IP address of the SSH client. $2: Encryption algorithm, such as aes256-cbc. |
|
Severity level |
5 |
|
Example |
SSHS/5/SSHS_ENCRYPT_FAIL: The packet to 192.168.30.117 failed to be encrypted with aes256-cbc. |
|
Explanation |
A packet to an SSH client failed to be encrypted. |
|
Recommended action |
No action is required. |
SSHS_INSECURE_LOGIN
|
Message text |
SSH server login is insecure. (ServiceType=[STRING], UserName=[STRING], UserAddress=[STRING], VPNInstanceName=[STRING], Reason=[STRING]). |
|
Variable fields |
$1: Service type. Options are Stelnet, SCP, SFTP, or NETCONF. $2: Username. $3: IP address of the SSH client. $4: VPN instance name. $5: Reason for insecure login: · The SSH server used one of the following insecure encryption algorithms: ¡ des_cbc. ¡ 3des_cbc. ¡ aes128_cbc. ¡ aes192_cbc. ¡ aes256_cbc. ¡ md5. ¡ md5_96. ¡ sha1. ¡ sha1_96. · The SSH server used one of the following insecure HMAC algorithms: ¡ md5. ¡ md5_96. ¡ sha1. ¡ sha1_96. |
|
Severity level |
5 |
|
Example |
SSH/5/SSHS_INSECURE_LOGIN: SSH server login is insecure. (ServiceType=Stelnet, UserName=admin, UserAddress=1.1.1.2, VPNInstanceName=vpn1, Reason=Insecure encryption algorithm). |
|
Explanation |
The user on the SSH client successfully logged in to the SSH server by using an insecure algorithm. |
|
Recommended action |
Take the corresponding action according to the reason for insecure login: · Use a secure encryption algorithm. For example, aes128_ctr or aes256_ctr. · Use a secure HMAC algorithm. For example, sha2_256. |
SSHS_LOG
|
Message text |
Authentication failed for [STRING] from [STRING] port [INT32] because of invalid username or wrong password. |
|
Variable fields |
$1: IP address of the SSH client. $2: Username. $3: Port number. |
|
Severity level |
6 |
|
Example |
SSHS/6/SSHS_LOG: Authentication failed for David from 140.1.1.46 port 16266 because of invalid username or wrong password. |
|
Explanation |
An SSH user failed password authentication because the username or password was wrong. |
|
Recommended action |
No action is required. |
SSHS_MAC_ERROR
|
Message text |
SSH server received a packet with wrong message authentication code (MAC) from [STRING]. |
|
Variable fields |
$1: IP address of the SSH client. |
|
Severity level |
6 |
|
Example |
SSHS/6/SSHS_MAC_ERROR: SSH server received a packet with wrong message authentication code (MAC) from 192.168.30.117. |
|
Explanation |
The SSH server received a packet with a wrong MAC from a client. |
|
Recommended action |
No action is required. |
SSHS_REACH_SESSION_LIMIT
|
Message text |
SSH client [STRING] failed to log in. The current number of [STRING] sessions is [NUMBER]. The maximum number allowed is [NUMBER]. |
|
Variable fields |
$1: IP address of the SSH client. $2: SSH/Stelnet/SFTP/SCP/NETCONF over SSH. $3: Current number of SSH/Stelnet/SFTP/SCP/NETCONF over SSH sessions. $4: Maximum number of SSH/Stelnet/SFTP/SCP/NETCONF over SSH sessions allowed on the device. |
|
Severity level |
6 |
|
Example |
SSHS/6/SSHS_REACH_SESSION_LIMIT: SSH client 192.168.30.117 failed to log in. The current number of SSH sessions is 10. The maximum number allowed is 10. |
|
Explanation |
The number of SSH sessions reached the upper limit. |
|
Recommended action |
No action is required. |
SSHS_REACH_USER_LIMIT
|
Message text |
SSH client [STRING] failed to log in, because the number of users reached the upper limit. |
|
Variable fields |
$1: IP address of the SSH client. |
|
Severity level |
6 |
|
Example |
SSHS/6/SSHS_REACH_USER_LIMIT: SSH client 192.168.30.117 failed to log in, because the number of users reached the upper limit. |
|
Explanation |
The number of SSH users reached the upper limit. |
|
Recommended action |
No action is required. |
SSHS_REKEY_FAIL
|
Message text |
SSH server key renegotiation failed. (SessionID=[STRING], FailedReason=[STRING], RekeyReason=[STRING], UserAddress=[STRING], LocalAddress=[STRING], VPNInstanceName=[STRING]). |
|
Variable fields |
$1: SSH session ID. $2: Reason for key renegotiation failure: No public key exists on the SSH server. $3: Reason for key renegotiation. $4: IP address of the SSH client. $5: IP address of the SSH server. $6: VPN instance name. |
|
Severity level |
5 |
|
Example |
SSH/5/SSHS_REKEY_FAIL: SSH server key renegotiation is failed. (SessionID=0, FailedReason=The server does not support the requested encryption algorithm, RekeyReason=The number of sent packets has reached the upper limit, UserAddress=1.1.1.2, LocalAddress=1.1.1.1, VPNInstanceName=vpn1). |
|
Explanation |
The SSH server failed to perform key renegotiation with the SSH client. |
|
Recommended action |
Collect logs and configuration information, and then contact the technical support. |
SSHS_REKEY_STATUS
|
Message text |
SSH server key renegotiation with client. (SessionID=[STRING], RekeyReason=[STRING], Status=[STRING], UserAddress=[STRING], LocalAddress=[STRING], VPNInstanceName=[STRING]). |
|
Variable fields |
$1: SSH session ID. $2: Reason for key renegotiation in the session: · The number of packets sent or received by the SSH server has reached the upper limit. · The volume of data transferred by the SSH server has reached the upper limit. · The update interval of the session initiated by the SSH server has been reached. $3: Key renegotiation status. $4: IP address of the SSH client. $5: IP address of the SSH server. $6: VPN instance name. |
|
Severity level |
5 |
|
Example |
SSH/5/SSHS_REKEY_STATUS: SSH server key renegotiation with client. (SessionID=0, RekeyReason=The number of sent packets has reached the upper limit, Status=Begin, UserAddress=1.1.1.2, LocalAddress=1.1.1.1, VPNInstanceName=vpn1). |
|
Explanation |
The SSH server performed key renegotiation with the SSH client. |
|
Recommended action |
No action is required. |
SSHS_SCP_FILE_DOWNLOAD_FAIL
|
Message text |
The SCP server failed to send file [STRING] to a client. (UserName=[STRING], UserAddress=[STRING], LocalAddress=[STRING], VpnInstanceName=[STRING], Transfer length=[STRING]). |
|
Variable fields |
$1: File name. $2: Username. $3: IP address of the SCP client. $4: IP address of the SCP server. $5: VPN instance name. $6: File size, in bytes. |
|
Severity level |
5 |
|
Example |
SSH/5/SSHS_SCP_FILE_DOWNLOAD_FAIL: The SCP server failed to send the file aa to a client. (UserName=admin, UserAddress=1.1.1.2, LocalAddress=1.1.1.1, VpnInstanceName=vpn1, Transfer length=2048). |
|
Explanation |
The SCP server failed to send the file to the SCP client. |
|
Recommended action |
No action is required. |
SSHS_SCP_FILE_UPLOAD_FAIL
|
Message text |
The SCP server failed to receive file [STRING] from a client. (UserName=[STRING], UserAddress=[STRING], LocalAddress=[STRING], VpnInstanceName=[STRING], Transfer length=[STRING]). |
|
Variable fields |
$1: File name. $2: Username. $3: IP address of the SCP client. $4: IP address of the SCP server. $5: VPN instance name. $6: File size, in bytes. |
|
Severity level |
5 |
|
Example |
SSH/5/SSHS_SCP_FILE_UPLOAD_FAIL: The SCP server failed to receive file aa from a client. (UserName=admin, UserAddress=1.1.1.2, LocalAddress=1.1.1.1, VpnInstanceName=vpn1, Transfer length=2048). |
|
Explanation |
The SCP server failed to receive the file from the SCP client. |
|
Recommended action |
No action is required. |
SSHS_SCP_OPER
|
Message text |
User [STRING] at [IPADDR] requested operation: [STRING] (LocalAddress=[STRING], VpnInstanceName=[STRING]). |
|
Variable fields |
$1: Username. $2: IP address of the SCP client. $3: Requested file operations: · get file "name"—Downloads file name from the SCP server. · put file "name"—Uploads file name to the SCP server. $4: IP address of the SCP server. $5: VPN instance name. |
|
Severity level |
6 |
|
Example |
SSHS/6/SSHS_SCP_OPER: -MDC=1; User user1 at 1.1.1.1 requested operation: put file "aa"(LocalAddress=1.1.1.1, VpnInstanceName=vpn1). |
|
Explanation |
The SCP sever received an operation request from an SCP client. |
|
Recommended action |
No action is required. |
SSHS_SFTP_EXECUTED_REMOVE_OPER
|
Message text |
Executed REMOVE operation. (UserName=[STRING], UserAddress=[STRING], LocalAddress=[STRING], VPNInstanceName=[STRING], Filename=[STRING], Result=[STRING], Detail=[STRING]). |
|
Variable fields |
$1: Username. $2: IP address of the SFTP client. $3: IP address of the SFTP server. $4: VPN instance name. $5: File name. $6: Operation result. $7: Details for operation failure. This string is not displayed if the operation succeeded. Possible failure reasons include: · The entered path is incomplete or invalid. · The specified file name does not exist. · The specified file name is a directory name. |
|
Severity level |
5 |
|
Example |
SSH/5/SSHS_SFTP_EXECUTED_REMOVE_OPER: Executed REMOVE operation. (UserName=admin, UserAddress=1.1.1.2, LocalAddress=1.1.1.1, VPNInstanceName=vpn1, Filename=aa, Result=Failed, Detail=No such file or directory). |
|
Explanation |
Deleting specified file from the SFTP server succeeded or failed. |
|
Recommended action |
Take the corresponding action according to the details for operation failure: · Make sure the entered path is complete and valid. · Make sure the specified file name exists in the SFTP directory. · Make sure the specified file name is not a directory name. If the delete operation succeeded, no action is required. |
SSHS_SFTP_EXECUTED_RENAME_OPER
|
Message text |
Executed RENAME operation. (UserName=[STRING], UserAddress=[STRING], LocalAddress=[STRING], VPNInstanceName=[STRING], Old filename=[STRING], New filename=[STRING], Result=[STRING], Detail=[STRING]). |
|
Variable fields |
$1: Username. $2: IP address of the SFTP client. $3: IP address of the SFTP server. $4: VPN instance name. $5: Old file or directory name. $6: New file or directory name. $7: Operation result. $8: Details for operation failure. This string is not displayed if the operation succeeded. Possible failure reasons include: · The entered path is incomplete or invalid. · The new file or directory and the old file or directory are in different paths. |
|
Severity level |
5 |
|
Example |
SSH/5/SSHS_SFTP_EXECUTED_RENAME_OPER: Executed RENAME operation. (UserName=admin, UserAddress=1.1.1.2, LocalAddress=1.1.1.1, VPNInstanceName=vpn1, Old filename=aa, New filename=bb, Result=Failed, Detail=No such file or directory). |
|
Explanation |
Renaming specified file or directory from the SFTP server succeeded or failed. |
|
Recommended action |
Take the corresponding action according to the details for operation failure: · Make sure the entered path is complete and valid. · Make sure the new file or directory and the old file or directory are in the same path of the SFTP directory. If the rename operation succeeded, no action is required. |
SSHS_SFTP_EXECUTED_RMDIR_OPER
|
Message text |
Executed RMDIR operation. (UserName=[STRING], UserAddress=[STRING], LocalAddress=[STRING], VPNInstanceName=[STRING], DirectoryName=[STRING], Result=[STRING], Detail=[STRING]). |
|
Variable fields |
$1: Username. $2: IP address of the SFTP client. $3: IP address of the SFTP server. $4: VPN instance name. $5: Directory name. $6: Operation result. $7: Details for operation failure. The operation failed might because the entered path is incomplete or invalid. This string is not displayed if the operation succeeded. |
|
Severity level |
5 |
|
Example |
SSH/5/SSHS_SFTP_EXECUTED_RMDIR_OPER: Executed RMDIR Operation. (UserName=admin, UserAddress=1.1.1.2, LocalAddress=1.1.1.1, VPNInstanceName=vpn1, DirectoryName=aa, Result=Failed, Detail=No such file or directory). |
|
Explanation |
Deleting specified directory from the SFTP server succeeded or failed. |
|
Recommended action |
· If the operation fails, verify that the entered path is complete and valid. · If the delete operation succeeded, no action is required. |
SSHS_SFTP_OPER
|
Message text |
User [STRING] at [IPADDR] requested operation: [STRING]. |
|
Variable fields |
$1: Username. $2: IP address of the SFTP client. $3: Requested operations on a file or directory: · open dir "path"—Opens directory path. · open "file" (attribute code code) in MODE mode—Opens file file with attribute code code in MODE mode. · remove file "path"—Deletes file path. · mkdir "path" (attribute code code)—Creates a new directory path with attribute code code. · rmdir "path"—Deletes directory path. · rename old "old-name" to new "new-name"—Changes the name of a file or folder from old-name to new-name. |
|
Severity level |
6 |
|
Example |
SSHS/6/SSHS_SFTP_OPER: User user1 at 1.1.1.1 requested operation: open dir "flash:/". |
|
Explanation |
The SFTP sever received an operation request from an SFTP client. |
|
Recommended action |
No action is required. |
SSHS_SFTP_TRANS_FILE_FINISH
|
Message text |
Finished to transfer file. (FileName=[STRING], UserName=[STRING], UserAddress=[STRING, LocalAddress=[STRING], VpnInstanceName=[STRING], TransferLength=[STRING], ActionType=[STRING]). |
|
Variable fields |
$1: File name. $2: Username. $3: IP address of the SFTP client. $4: IP address of the SFTP server. $5: VPN instance name. $6: File size, in bytes. $7: File transfer operation type. |
|
Severity level |
5 |
|
Example |
SSH/5/SSHS_SFTP_TRANS_FILE_FINISH: Finished to transfer file. (FileName=aa, UserName=admin, UserAddress=1.1.1.2, LocalAddress=1.1.1.1, VpnInstanceName=vpn1, TransferLength=2048, ActionType=get). |
|
Explanation |
File transfer through SFTP finished. |
|
Recommended action |
No action is required. |
SSHS_SRV_UNAVAILABLE
|
Message text |
The [STRING] server is disabled or the [STRING] service type is not supported. |
|
Variable fields |
$1: Service type: Stelnet, SCP, SFTP, or NETCONF. |
|
Severity level |
6 |
|
Example |
SSHS/6/SSHS_SRV_UNAVAILABLE: The SCP server is disabled or the SCP service type is not supported. |
|
Explanation |
The server was disconnecting the connection because the Stelnet, SCP, SFTP, or NETCONF service is not available. |
|
Recommended action |
Verify that the Stelnet, SCP, SFTP, or NETCONF service is available and the user configuration is correct. |
SSHS_USER_LOGIN_FAIL
|
Message text |
The SSH user failed to login. (ServiceType=[STRING], FailedReason=[STRING], UserName=[STRING], UserAddress=[STRING], LocalAddress=[STRING], VPNInstanceName=[STRING]). |
|
Variable fields |
$1: Service type. Options are Stelnet, SCP, SFTP, or NETCONF. $2: Reason for login failure: · No key pairs (RSA, DSA, or ECDSA key pairs) exists on the SSH server. · Incorrect username or password. · SSH server is disabled. · The IP address of the SSH client is not permitted by the ACL for controlling SSH connections to the server. · The number of SSH users allowed on the SSH server has reached the upper limit. · The working directory for SSH users is not specified. · Algorithm mismatch. · Maximum number of authentication attempts is reached. · The SSH user failed to pass the public key authentication. · The SSH user's authentication timed out. · Maximum number of SSH sessions is reached. · Stelnet/SCP/SFTP/NETCONF over SSH service is unavailable. · Version mismatch between the SSH client and the SSH server. $3: Username. $4: IP address of the SSH client. $5: IP address of the SSH server. $6: VPN instance name. |
|
Severity level |
5 |
|
Example |
SSH/5/SSHS_USER_LOGIN_FAIL: The SSH user failed to login. (ServiceType=Stelnet, FailedReason=Wrong password, UserName=[admin], UserAddress=1.1.1.2, LocalAddress=1.1.1.1, VPNInstanceName=vpn1). |
|
Explanation |
The SSH user failed to log in. |
|
Recommended action |
Take the corresponding action according to the details for login failure: · Use the ssh user command to create an SSH user. · Create the RSA, DSA, or ECDSA key pairs on the SSH server. ¡ Use the display public-key local rsa public command to view the public keys of all local RSA public keys. If no RSA key pairs are configured, use the public-key local create rsa command to generate local RSA key pairs. ¡ Use the display public-key local ecdsa public command to view the public keys of all local ECDSA public keys. If no ECDSA key pairs are configured, use the public-key local create ecdsa command to generate local ECDSA key pairs. ¡ Use the display public-key local dsa public command to view the public keys of all local DSA public keys. If no DSA key pairs are configured, use the public-key local create dsa command to generate local DSA key pairs. · Use the correct username and password. · Enable the SSH server. · Make sure the IP address of the SSH client is permitted by the ACL or delete the ACL configurations. · Raise the upper limit for the number of SSH users allowed on the SSH server or release some established SSH connections. · Specify the working directory for SSH users. |
SSHS_VERSION_MISMATCH
|
Message text |
SSH client [STRING] failed to log in because of version mismatch. |
|
Variable fields |
$1: IP address of the SSH client. |
|
Severity level |
6 |
|
Example |
SSHS/6/SSHS_VERSION_MISMATCH: SSH client 192.168.30.117 failed to log in because of version mismatch. |
|
Explanation |
The SSH client failed to log in to the SSH server because they used different SSH versions. |
|
Recommended action |
Make sure the SSH client and the SSH server use the same SSH version. |
STM messages
This section contains IRF messages.
STM_AUTO_UPDATE_FAILED
|
Message text |
Pattern 1: Slot [UINT32] auto-update failed. Reason: [STRING]. Pattern 2: Chassis [UINT32] slot [UINT32] auto-update failed. Reason: [STRING]. |
|
Variable fields |
Pattern 1: $1: IRF member ID. $2: Failure reason: ¡ Timeout when loading—The IRF member device failed to complete loading software within the required time period. ¡ Wrong description when loading—The file description in the software image file does not match the current attributes of the software image. This issue might occur when the file does not exist or is corrupted. ¡ Disk full when writing to disk—The subordinate device does not have sufficient storage space. Pattern 2: $1: IRF member ID. $2: Slot number of an MPU. $3: Failure reason: ¡ Timeout when loading—The MPU failed to complete loading software within the required time period. ¡ Wrong description when loading—The file description in the software image file does not match the attributes of the software image. This issue might occur if the file does not exist or is corrupted. ¡ Disk full when writing to disk—The MPU does not have sufficient storage space. |
|
Severity level |
4 |
|
Example |
STM/4/STM_AUTO_UPDATE_FAILED: Slot 5 auto-update failed. Reason: Timeout when loading. |
|
Explanation |
Pattern 1: Software synchronization from the master failed on a subordinate device. Pattern 2: Software synchronization from the global active MPU failed on a standby MPU. |
|
Recommended action |
1. Remove the issue depending on the failure reason: ¡ If the failure reason is Timeout when loading, verify that all IRF links are up. ¡ If the failure reason is Wrong description when loading, download the software images again. ¡ If the failure reason is Disk full when writing to disk, delete unused files to free the storage space. 2. Upgrade software manually for the device or MPU to join the IRF fabric, and then connect the device to the IRF fabric. |
STM_AUTO_UPDATE_FINISHED
|
Message text |
Pattern 1: File loading finished on slot [UINT32]. Pattern 2: File loading finished on chassis [UINT32] slot [UINT32]. |
|
Variable fields |
Pattern 1: $1: IRF member ID. Pattern 2: $1: IRF member ID. $2: Slot number of an MPU. |
|
Severity level |
5 |
|
Example |
STM/5/STM_AUTO_UPDATE_FINISHED: File loading finished on slot 3. |
|
Explanation |
Pattern 1: The member device finished loading software images. Pattern 2: The MPU finished loading software images. |
|
Recommended action |
No action is required. |
STM_AUTO_UPDATING
|
Message text |
Pattern 1: Don't reboot the slot [UINT32]. It is loading files. Pattern 2: Don't reboot the chassis [UINT32] slot [UINT32]. It is loading files. |
|
Variable fields |
Pattern 1: $1: IRF member ID. Pattern 2: $1: IRF member ID. $2: Slot number of an MPU. |
|
Severity level |
5 |
|
Example |
STM/5/STM_AUTO_UPDATING: Don't reboot the slot 2. It is loading files. |
|
Explanation |
Pattern 1: The member device is loading software images. To avoid software upgrade failure, do not reboot the member device. Pattern 2: The MPU is loading software images. To avoid software upgrade failure, do not reboot the MPU. |
|
Recommended action |
No action is required. |
STM_LINK_DOWN
|
Message text |
IRF port [UINT32] went down. |
|
Variable fields |
$1: IRF port name. |
|
Severity level |
3 |
|
Example |
STM/3/STM_LINK_DOWN: IRF port 2 went down. |
|
Explanation |
This event occurs when all physical interfaces bound to an IRF port are down. |
|
Recommended action |
Check the physical interfaces bound to the IRF port. Make sure a minimum of one member physical interface is up. |
STM_LINK_TIMEOUT
|
Message text |
IRF port [UINT32] went down because the heartbeat timed out. |
|
Variable fields |
$1: IRF port name. |
|
Severity level |
2 |
|
Example |
STM/2/STM_LINK_TIMEOUT: IRF port 1 went down because the heartbeat timed out. |
|
Explanation |
The IRF port went down because of heartbeat timeout. |
|
Recommended action |
Check the IRF link for link failure. |
STM_LINK_UP
|
Message text |
IRF port [UINT32] came up. |
|
Variable fields |
$1: IRF port name. |
|
Severity level |
6 |
|
Example |
STM/6/STM_LINK_UP: IRF port 1 came up. |
|
Explanation |
An IRF port came up. |
|
Recommended action |
No action is required. |
STM_MERGE
|
Message text |
IRF merge occurred. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
STM/4/STM_MERGE: IRF merge occurred. |
|
Explanation |
IRF merge occurred. |
|
Recommended action |
No action is required. |
STM_MERGE_NEED_REBOOT
|
Message text |
IRF merge occurred. This IRF system needs a reboot. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
STM/4/STM_MERGE_NEED_REBOOT: IRF merge occurred. This IRF system needs a reboot. |
|
Explanation |
You must reboot the current IRF fabric for IRF merge, because it failed in the master election. |
|
Recommended action |
Log in to the IRF fabric, and use the reboot command to reboot the IRF fabric. |
STM_MERGE_NOT_NEED_REBOOT
|
Message text |
IRF merge occurred. This IRF system does not need to reboot. |
|
Variable fields |
N/A |
|
Severity level |
5 |
|
Example |
STM/5/STM_MERGE_NOT_NEED_REBOOT: IRF merge occurred. This IRF system does not need to reboot. |
|
Explanation |
You do not need to reboot the current IRF fabric for IRF merge, because it was elected the master. |
|
Recommended action |
Reboot the IRF fabric that has failed in the master election to finish the IRF merge. |
STM_SAMEMAC
|
Message text |
Failed to stack because of the same bridge MAC addresses. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
STM/4/STM_SAMEMAC: Failed to stack because of the same bridge MAC addresses. |
|
Explanation |
Failed to set up the IRF fabric because some member devices are using the same bridge MAC address. |
|
Recommended action |
1. Verify that IRF bridge MAC persistence is disabled on the member devices. To disable this feature, use the undo irf mac-address persistent command. 2. If the problem persists, contact H3C Support. |
STM_SOMER_CHECK
|
Message text |
Neighbor of IRF port [UINT32] cannot be stacked. |
|
Variable fields |
$1: IRF port name. |
|
Severity level |
3 |
|
Example |
STM/3/STM_SOMER_CHECK: Neighbor of IRF port 1 cannot be stacked. |
|
Explanation |
The neighbor connected to the IRF port cannot form an IRF fabric with the device. |
|
Recommended action |
Check the following items: · The device models can form an IRF fabric. · The IRF settings are correct. For more information, see the IRF configuration guide for the device. |
STP messages
This section contains STP messages.
STP_BPDU_PROTECTION
|
Message text |
BPDU-Protection port [STRING] received BPDUs. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
STP/4/STP_BPDU_PROTECTION: BPDU-Protection port GigabitEthernet1/0/1 received BPDUs. |
|
Explanation |
A BPDU-guard-enabled port received BPDUs. |
|
Recommended action |
Check whether the downstream device is a terminal and check for possible attacks from the downstream device or other devices. |
STP_BPDU_RECEIVE_EXPIRY
|
Message text |
Instance [UINT32]'s port [STRING] received no BPDU within the rcvdInfoWhile interval. Information of the port aged out. |
|
Variable fields |
$1: Instance ID. $2: Interface name. |
|
Severity level |
5 |
|
Example |
STP/5/STP_BPDU_RECEIVE_EXPIRY: Instance 0's port GigabitEthernet1/0/1 received no BPDU within the rcvdInfoWhile interval. Information of the port aged out. |
|
Explanation |
The state of a non-designated port changed because the port did not receive a BPDU within the max age. |
|
Recommended action |
Check the STP status of the upstream device and possible attacks from other devices. |
STP_CONSISTENCY_RESTORATION
|
Message text |
|
|
Variable fields |
$1: VLAN ID. $2: Interface name. |
|
Severity level |
6 |
|
Example |
STP/6/STP_CONSISTENCY_RESTORATION: Consistency restored on VLAN 10's port GigabitEthernet1/0/1. |
|
Explanation |
Port link type or PVID inconsistency was removed on a port. |
|
Recommended action |
No action is required. |
STP_DETECTED_TC
|
Message text |
[STRING] [UINT32]'s port [STRING] detected a topology change. |
|
Variable fields |
$1: Instance or VLAN. $2: Instance ID or VLAN ID. $3: Interface name. |
|
Severity level |
6 |
|
Example |
STP/6/STP_DETECTED_TC: Instance 0's port GigabitEthernet1/0/1 detected a topology change. |
|
Explanation |
The MSTP instance or VLAN to which a port belongs had a topology change, and the local end detected the change. |
|
Recommended action |
Identify the topology change cause and handle the issue. For example, if the change is caused by a link down event, recover the link. |
STP_DISABLE
|
Message text |
STP is now disabled on the device. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
STP/6/STP_DISABLE: STP is now disabled on the device. |
|
Explanation |
STP was globally disabled on the device. |
|
Recommended action |
No action is required. |
STP_DISCARDING
|
Message text |
Instance [UINT32]'s port [STRING] has been set to discarding state. |
|
Variable fields |
$1: Instance ID. $2: Interface name. |
|
Severity level |
6 |
|
Example |
STP/6/STP_DISCARDING: Instance 0's port GigabitEthernet1/0/1 has been set to discarding state. |
|
Explanation |
MSTP calculated the state of ports within an instance, and a port was set to the discarding state. |
|
Recommended action |
No action is required. |
STP_DISPUTE_RESTORATION
|
Message text |
[STRING] [UINT32]'s port [STRING] exited the dispute state. |
|
Variable fields |
$1: Instance or VLAN. $2: Instance ID or VLAN ID. $3: Interface name. |
|
Severity level |
6 |
|
Example |
STP/6/STP_DISPUTE_RESTORATION: Instance 0's port GigabitEthernet1/0/2 exited the dispute state. |
|
Explanation |
A port in the MSTI or VLAN was restored from the dispute state. |
|
Recommended action |
No action is required. |
STP_EDGEPORT_INACTIVE
|
Message text |
Port [STRING] became a non-edge port after receiving a BPDU. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
STP/4/STP_EDGEPORT_INACTIVE: Port GigabitEthernet1/0/1 became a non-edge port after receiving a BPDU. |
|
Explanation |
An edge port became a non-edge port after receiving STP BPDUs. |
|
Recommended action |
Check for forged BPDU attacks from malicious attackers. |
STP_ENABLE
|
Message text |
STP is now enabled on the device. |
|
Variable fields |
N/A |
|
Severity level |
6 |
|
Example |
STP/6/STP_ENABLE: STP is now enabled on the device. |
|
Explanation |
STP was globally enabled on the device. |
|
Recommended action |
No action is required. |
STP_FORWARDING
|
Message text |
Instance [UINT32]'s port [STRING] has been set to forwarding state. |
|
Variable fields |
$1: Instance ID. $2: Interface name. |
|
Severity level |
6 |
|
Example |
STP/6/STP_FORWARDING: Instance 0's port GigabitEthernet1/0/1 has been set to forwarding state. |
|
Explanation |
MSTP calculated the state of ports within an instance, and a port was set to the forwarding state. |
|
Recommended action |
No action is required. |
STP_LOOP_PROTECTION
|
Message text |
Instance [UINT32]'s LOOP-Protection port [STRING] failed to receive configuration BPDUs. |
|
Variable fields |
$1: Instance ID. $2: Interface name. |
|
Severity level |
4 |
|
Example |
STP/4/STP_LOOP_PROTECTION: Instance 0's LOOP-Protection port GigabitEthernet1/0/1 failed to receive configuration BPDUs. |
|
Explanation |
A loop-guard-enabled port failed to receive configuration BPDUs. |
|
Recommended action |
Check the STP status of the upstream device and possible attacks from other devices. |
STP_NOT_ROOT
|
Message text |
The current switch is no longer the root of instance [UINT32]. |
|
Variable fields |
$1: Instance ID. |
|
Severity level |
5 |
|
Example |
STP/5/STP_NOT_ROOT: The current switch is no longer the root of instance 0. |
|
Explanation |
The current switch is no longer the root bridge of an instance. It received a superior BPDU after it was configured as the root bridge. |
|
Recommended action |
Check the bridge priority configuration and possible attacks from other devices. |
STP_NOTIFIED_TC
|
Message text |
[STRING] [UINT32]'s port [STRING] was notified of a topology change. |
|
Variable fields |
$1: Instance or VLAN. $2: Instance ID or VLAN ID. $3: Interface name. |
|
Severity level |
6 |
|
Example |
STP/6/STP_NOTIFIED_TC: Instance 0's port GigabitEthernet1/0/1 was notified of a topology change. |
|
Explanation |
The neighboring device on a port notified the current device that a topology change occurred in the instance or VLAN to which the port belongs. |
|
Recommended action |
Identify the topology change cause and handle the issue. For example, if the change is caused by a link down event, recover the link. |
STP_PORT_TYPE_INCONSISTENCY
|
Message text |
Access port [STRING] in VLAN [UINT32] received PVST BPDUs from a trunk or hybrid port. |
|
Variable fields |
$1: Interface name. $2: VLAN ID. |
|
Severity level |
4 |
|
Example |
|
|
Explanation |
An access port received PVST BPDUs from a trunk or hybrid port. |
|
Recommended action |
Check the port link type setting on the ports. |
STP_PVID_INCONSISTENCY
|
Message text |
Port [STRING] with PVID [UINT32] received PVST BPDUs from a port with PVID [UINT32]. |
|
Variable fields |
$1: Interface name. $2: VLAN ID. $3: VLAN ID. |
|
Severity level |
4 |
|
Example |
|
|
Explanation |
A port received PVST BPDUs from a remote port with a different PVID. |
|
Recommended action |
Verify that the PVID is consistent on both ports. |
STP_PVST_BPDU_PROTECTION
|
Message text |
PVST BPDUs were received on port [STRING], which is enabled with PVST BPDU protection. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
|
|
Explanation |
In MSTP mode, a port enabled with PVST BPDU guard received PVST BPDUs. |
|
Recommended action |
Identify the device that sends the PVST BPDUs. |
STP_ROOT_PROTECTION
|
Message text |
Instance [UINT32]'s ROOT-Protection port [STRING] received superior BPDUs. |
|
Variable fields |
$1: Instance ID. $2: Interface name. |
|
Severity level |
4 |
|
Example |
STP/4/STP_ROOT_PROTECTION: Instance 0's ROOT-Protection port GigabitEthernet1/0/1 received superior BPDUs. |
|
Explanation |
A root-guard-enabled port received BPDUs that are superior to the BPDUs generated by itself. |
|
Recommended action |
Check the bridge priority configuration and possible attacks from other devices. |
STP_STG_NUM_DETECTION
|
Message text |
STG count [UINT32] is smaller than the MPU's STG count [UINT32]. |
|
Variable fields |
$1: Number of STGs on a card. $2: Number of STGs on the MPU. |
|
Severity level |
4 |
|
Example |
STP/4/STP_STG_NUM_DETECTION: STG count 64 is smaller than the MPU's STG count 65. |
|
Explanation |
The system detected that the STG count on a card was smaller than that on the MPU. |
|
Recommended action |
Make sure the number of spanning tree instances is not larger than the smallest card-specific STG count. For example, if the number of spanning tree instances is m and the smallest STG count among cards is n, m cannot be larger than n. |
STRUNK
This section contains smart trunk messages.
STRUNK_DROPPACKET_INCONSISTENCY
|
Message text |
Smart trunk [UINT32] dropped the S-Trunk protocol packet because [STRING]. |
|
Variable fields |
$1: Smart trunk ID. $2: Reason for dropping packets: · the source and destination IP addresses or VPN instance of S-Trunk protocol packets are not configured on the local device. · the packet's source or destination IP address does not match the local configuration. · the VPN instance of S-Trunk protocol packets is different from the local VPN instance. · the sequence number check failed. · key verification failed. |
|
Severity level |
4 |
|
Example |
STRUNK/4/STRUNK_DROPPACKET_INCONSISTENCY: Smart trunk 10 dropped the S-Trunk protocol packet because key verification failed. |
|
Explanation |
The configurations on the local and the peer devices are inconsistent. |
|
Recommended action |
1. Verify that the configurations are consistent on the local and the peer devices in the smart trunk. 2. If the configurations in the smart trunk are consistent, verify that the illegitimate packets are present. |
STRUNK_MEMBER_ROLE_CHANGE
|
Message text |
Smart trunk member role changed: Interface type=[STRING], interface number=[UINT32], previous role (trigger)=[STRING] ([STRING]), new role (trigger)=[STRING] ([STRING]) |
|
Variable fields |
$1: Member interface type in the smart trunk, including BAGG and RAGG. $2: Member interface number. $3: Previous role of the interface: · Primary. · Secondary. $4: Reason for previous role of the interface: · MANUAL_SECONDARY—The member interface is assigned the secondary role in the smart trunk. · MANUAL_PRIMARY—The member interface is assigned the primary role in the smart trunk. · STRUNK_INIT—The smart trunk is initializing. · AUTO_SECONDARY—The local device in the smart trunk is secondary. · AUTO_PRIMARY—The local device in the smart trunk is primary. · PEER_MEMBER_DOWN—The peer member interface is down. · PEER_MEMBER_UP—The peer member interface is up. $5: Current role of the interface: · Primary. · Secondary. $6: Reason for current role of the interface: · MANUAL_SECONDARY—The member interface is assigned the secondary role in the smart trunk. · MANUAL_PRIMARY—The member interface is assigned the primary role in the smart trunk. · STRUNK_INIT—The smart trunk is initializing. · AUTO_SECONDARY—The local device in the smart trunk is secondary. · AUTO_PRIMARY—The local device in the smart trunk is primary. · PEER_MEMBER_DOWN—The peer member interface is down. · PEER_MEMBER_UP—The peer member interface is up. |
|
Severity level |
5 |
|
Example |
STRUNK/5/STRUNK_MEMBER_ROLE_CHANGE: Smart trunk member role changed: Interface type=BAGG, interface number=1, previous role (trigger)=Secondary (STRUNK_INIT), new role (trigger)=Primary (MANUAL_PRIMARY). |
|
Explanation |
Smart trunk member interface role changed. |
|
Recommended action |
· Verify that the local or peer member device is operating correctly. · Verify that the local or peer member interface is down. |
STRUNK_PDUINTERVAL_MISMATCH
|
Message text |
Smart trunk [UINT32] has a packet transmission interval different than the peer device. |
|
Variable fields |
$1: Smart trunk ID. |
|
Severity level |
5 |
|
Example |
STRUNK/5/STRUNK_PDUINTERVAL_MISMATCH: Smart trunk 1 has a packet transmission interval different than the peer device. |
|
Explanation |
The interval on the local device for sending S-Trunk protocol packets is different from the peer in the smart trunk. One of the devices times out incorrectly. |
|
Recommended action |
Set the same interval for sending S-Trunk protocol packets in the smart trunk. |
STRUNK_RECEIVE_TIMEOUT
|
Message text |
Hello timeout timer expired on smart trunk [UINT32]. |
|
Variable fields |
$1: Smart trunk ID. |
|
Severity level |
4 |
|
Example |
STRUNK/4/STRUNK_RECEIVE_TIMEOUT: Hello timeout timer expired on smart trunk 1. |
|
Explanation |
The local device does not receive S-Trunk protocol packets from the peer before the timeout timer expires. |
|
Recommended action |
· Verify that the S-Trunk link is up. · Verify that the CPU is occupying too much resource. |
STRUNK_ROLE_CHANGE
|
Message text |
The role of the device changed in a smart trunk: Smart trunk ID=[UINT32], previous role (trigger)=[STRING] ([STRING]), new role (trigger)=[STRING] ([STRING]) |
|
Variable fields |
$1: Smart trunk ID. $2: Previous role in the smart trunk: · Init—Initialized. · Primary. · Secondary. $4: Reason for previous role in the smart trunk: · INIT—The smart trunk is initializing. · PRIORITY—The role in the smart trunk depends on the priority. · TIMEOUT—The local device becomes primary for not receiving S-Trunk protocol packets from the peer before the timeout timer expires. · PEER_TIMEOUT—The peer device becomes primary for not receiving S-Trunk protocol packets from the local before the timeout timer expires. · BFD_DOWN—The local device detects that the link is down between the local and the peer through BFD. · PEER_BFD_DOWN—The peer device detects that the link is down between the local and the peer through BFD. $5: Current role in the smart trunk: · Init—Initialized. · Primary. · Secondary. $6: Reason for current role in the smart trunk: · INIT—The smart trunk is initializing. · PRIORITY—The role of the smart trunk depends on the priority. · TIMEOUT—The local device becomes primary for not receiving S-Trunk protocol packets from the peer before the timeout timer expires. · PEER_TIMEOUT—The peer device becomes primary for not receiving S-Trunk protocol packets from the local before the timeout timer expires. · BFD_DOWN—The local device detects that the link is down between the local and the peer through BFD. · PEER_BFD_DOWN—The peer device detects that the link is down between the local and the peer through BFD. |
|
Severity level |
5 |
|
Example |
STRUNK/5/STRUNK_ROLE_CHANGE: The role of the device changed in a smart trunk: Smart trunk ID=1, previous role (trigger)=Init (INIT), new role (trigger)=Secondary (PRIORITY) |
|
Explanation |
The smart trunk role changed. |
|
Recommended action |
Verify that the link between the devices in the smart trunk is Layer 3 reachable. |
SWFA
This section contains SWFA messages.
FMEA_ERRPKT_DETECT
FMEA_JAM_DETECT
|
Message text |
Congestion is detected on an interface of chip [UINT32] in slot [UINT32]. |
|
Variable fields |
$1: Chip number. $2: Slot number of the card. |
|
Severity level |
3 (Error) |
|
Example |
SWFA/3/FMEA_JAM_DETECT: -MDC=1-Slot=10; Congestion is detected on an interface of chip 0 in slot 16. |
|
Impact |
Packet drop or erroneous packets are detected on the device. |
|
Explanation |
· The service module and the switching fabric module were not installed correctly. · An error occurred on the link between the service module and the switching fabric module. · A chip error occurred inside the service module or the switching fabric module. |
|
Recommended action |
1. Verify that the specified card is installed correctly. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
SEU
|
Message text |
Seu error detected on slot [UINT32] |
|
Variable fields |
$1: Slot number of the card. |
|
Severity level |
3 (Error) |
|
Example |
SWFA/3/SEU: -Slot=2; Seu error detected on slot 2 |
|
Impact |
The card cannot operate correctly. |
|
Explanation |
A chip error occurred on the card. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
SYSEVENT
This section contains system event messages.
EVENT_TIMEOUT
|
Message text |
Module [UINT32]'s processing for event [UINT32] timed out. Module [UINT32]'s processing for event [UINT32] on [STRING] timed out. |
|
Variable fields |
$1: Module ID. $2: Event ID. $3: MDC MDC-ID or Context Context-ID. |
|
Severity level |
6 |
|
Example |
SYSEVENT/6/EVENT_TIMEOUT: -MDC=1; Module 0x1140000's processing for event 0x20000010 timed out. SYSEVENT/6/EVENT_TIMEOUT: -Context=1; Module 0x33c0000's processing for event 0x20000010 on context 16 timed out. |
|
Explanation |
A module's processing for an event timed out on an MDC or context. Logs generated on non-default MDCs or contexts do not include the MDC MDC-ID or Context Context-ID. Logs generated on the default MDC or context include the following types: · Logs of the default MDC or context, which do not include the MDC MDC-ID or Context Context-ID. · Logs of non-default MDCs or contexts, which include their MDC MDC-ID or Context Context-ID. |
|
Recommended action |
No action is required. |
SYSLOG messages
This section contains syslog messages.
SYSLOG_FILE_BACKUP_FAILED
|
Message text |
Failed to back up the log file or security log file to a remote server: Username=[STRING], Protocol=[STRING], IP=[STRING], Port=[STRING], VPN=[STRING], Directory=[STRING], Filename prefix=[STRING]. |
|
Variable fields |
$1: Username for logging in to the remote server. $2: Protocol used in backing up log files. $3: IP address of the remote server. $4: Port number of the remote server. $5: VPN to which the remote server belongs. $6: Log file storage directory on the remote server. $7: Filename prefix used in saving log files to the remote server. |
|
Severity level |
5 |
|
Example |
SYSLOG/5/SYSLOG_FILE_BACKUP_FAILED: Failed to back up the log file or security log file to a remote server: Username=test, Protocol=ftp, IP=100::100, Port=21, VPN=N/A, Directory=/, Filename prefix=100-100. |
|
Explanation |
Failed to back up the log file to the remote server. |
|
Recommended action |
1. In any view, execute the display info-center file-server command to view the configuration of the remote server. If configuration errors are found: ¡ Execute the info-center file-server transport-type command to modify the backup parameters of the remote server. ¡ Execute the info-center file-server user command to modify the login username and password of the remote server. 2. Ping the remote server. If the ping fails, troubleshoot the network connection first. |
SYSLOG_FILE_DECOMPRESS_ERROR
|
Message text |
Failed to decompress [STRING]. |
|
Variable fields |
$1: Name and path of the file to be decompressed. |
|
Severity level |
4 |
|
Example |
SYSLOG/4/SYSLOG_FILE_DECOMPRESS_ERROR: Failed to decompress flash:/logfile/logfile1.log.gz. |
|
Explanation |
Failed to decompress a file. |
|
Recommended action |
1. In user view, execute the dir command to check the storage usage of the storage device. If not enough storage space is available, use the delete /unreserved command to delete unnecessary files. 2. If the problem persists, contact H3C Support. |
SYSLOG_LOGBUFFER_FAILURE
|
Message text |
Log cannot be sent to the logbuffer because of communication timeout between syslog and DBM processes. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
SYSLOG/4/SYSLOG_LOGBUFFER_FAILURE: Log cannot be sent to the logbuffer because of communication timeout between syslog and DBM processes. |
|
Explanation |
Failed to output logs to the logbuffer because of the communication timeout between syslog and DBM processes. |
|
Recommended action |
Contact H3C Support. |
SYSLOG_LOGFILE_FULL
|
Message text |
Log file space is full. |
|
Variable fields |
N/A |
|
Severity level |
4 |
|
Example |
SYSLOG/4/SYSLOG_LOGFILE_FULL: Log file space is full. |
|
Explanation |
The log file is full. |
|
Recommended action |
Back up the log file, remove the original file, and then bring up interfaces as needed. |
SYSLOG_RESTART
|
Message text |
System restarted -- [STRING] [STRING] Software. |
|
Variable fields |
$1: Company name. $2: Software name. |
|
Severity level |
6 |
|
Example |
SYSLOG/6/SYSLOG_RESTART: System restarted -- H3C Comware Software |
|
Explanation |
A system restart log was generated. |
|
Recommended action |
No action is required. |
SYSLOG_RELAY_PORT_FAILED
|
Message text |
Failed to configure port [USHORT] as a syslog relay port. |
|
Variable fields |
$1: Listening port number for log relay on a CTRL-VM. |
|
Severity level |
5 |
|
Example |
SYSLOG/5/SYSLOG_RELAY_PORT_FAILED: Failed to configure port 2000 as a syslog relay port. |
|
Explanation |
Failed to configure the listening port number for log relay, possibly because the port is being used by another service module. |
|
Recommended action |
Use the info-center loghost relay port command to reconfigure the listening port number for log relay. |
SYSLOG_RTM_EVENT_BUFFER_FULL
|
Message text |
In the last minute, [String] syslog logs were not monitored because the buffer was full. |
|
Variable fields |
$1: Number of system logs that were not sent to the EAA module in the last minute. |
|
Severity level |
5 |
|
Example |
SYSLOG/5/SYSLOG_RTM_EVENT_BUFFER_FULL: In the last minute, 100 syslog logs were not monitored because the buffer was full. |
|
Explanation |
This message records the number of system logs that are not processed by EAA because the log buffer monitored by EAA is full. The log buffer can be filled up if the device generates large numbers of system logs in a short period of time. |
|
Recommended action |
· Identify log sources and take actions to reduce system logs. · Use the rtm event syslog buffer-size command to increase the log buffer size. |
SYSM messages
This section contains system management messages.
BOARD_NOT_STEADY
|
Message text |
The board [INT32] is not steady! |
|
Variable fields |
$1: Slot number of an interface module. |
|
Severity level |
5 (Notification) |
|
Example |
DRVPLAT/5/BOARD_NOT_STEADY: The board 2 is not steady! |
|
Impact |
The interface module cannot operate correctly. |
|
Cause |
The interface module was not correctly installed or there might be hardware failures. |
|
Recommended action |
1. Verify the interface module installation. 2. Use the display device command to identify whether the interface module is in position. 3. Install the module in another slot if the interface module information is not displayed. 4. Use the display device command to identify whether the interface module is in position. ¡ If the interface module is in position, the slot might be damaged, and contact Technical Support for help. ¡ If the interface module is not in position, the interface module might be damaged, and contact Technical Support for help. |
SYSM_OVER_TEMPERATURE
|
Message text |
Warning: Overtemperature condition is detected on power module [INT32] Please check it. |
|
Variable fields |
$1: Power module ID. |
|
Severity level |
5 (Notification) |
|
Example |
DRVPLAT/5/SYSM_OVER_TEMPERATURE: Warning: Overtemperature condition is detected on power module 2. Please check it. |
|
Impact |
Overtemperature might cause device failure. |
|
Cause |
A power module was in an overtemperature condition. |
|
Recommended action |
1. Verify that the ventilation system in the equipment room is operating correctly. 2. Verify that the air outlet vents are not blocked. 3. Verify that the fan trays are operating correctly and air can exhaust from the air outlet vents. 4. Verify that cards or filler panels are correctly installed. 5. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
SYSM_FAN_FAIL
|
Message text |
Warning: Fan of power module [INT32] fails to operate. Please check it. |
|
Variable fields |
$1: Power module ID. |
|
Severity level |
5 (Notification) |
|
Example |
DRVPLAT/5/SYSM_FAN_FAIL: Warning: Fan of power module 2 fails to operate. Please check it. |
|
Impact |
The power module cannot correctly supply power. |
|
Cause |
Power module fan failure. |
|
Recommended action |
1. Replace the power module with a new power model. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
SYSM_NOPOWER1
|
Message text |
Power Error, there is no input in Power 1. |
|
Variable fields |
N/A |
|
Severity level |
5 (Notification) |
|
Example |
DRVPLAT/5/SYSM_NOPOWER1:Power Error, there is no input in Power 1 |
|
Impact |
The power module cannot correctly supply power. |
|
Cause |
The power module had no power input. |
|
Recommended action |
1. Verify the power cord installation. ¡ If the power cord is loose, reinstall it. ¡ If the power cord is damaged, replace the power cord. 2. Verify that the power module makes good contact with the backplane. 3. Verify that the power source is providing power correctly and the voltage is in the acceptable range. 4. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
SYSM_NOPOWER2
|
Message text |
Power Error, there is no input in Power 2. |
|
Variable fields |
N/A |
|
Severity level |
5 (Notification) |
|
Example |
DRVPLAT/5/SYSM_NOPOWER2:Power Error, there is no input in Power 2 |
|
Impact |
The power module cannot correctly supply power. |
|
Cause |
The power module had no power input. |
|
Recommended action |
1. Verify the power cord installation. ¡ If the power cord is loose, reinstall it. ¡ If the power cord is damaged, replace the power cord. 2. Verify that the power module makes good contact with the backplane. 3. Verify that the power source is providing power correctly and the voltage is in the acceptable range. 4. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
SYSM_FAN_ERROR
|
Message text |
Frame [INT32] fan [STRING] state error! |
|
Variable fields |
$1: ID of a fan tray. $2: ID of a fan. |
|
Severity level |
5 (Notification) |
|
Example |
DRVPLAT/5/SYSM_FAN_ERROR: Frame 1 fan 2 state error! |
|
Impact |
The temperature of the device might be abnormal. |
|
Cause |
A state error occurred on a fan. The possible reason might be communication error between the fan and the active MPU. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
SYSM_AIRFLOWSAME
|
Message text |
The airflow directions for the two fan trays must be the same. Please check it. |
|
Variable fields |
N/A |
|
Severity level |
5 (Notification) |
|
Example |
DRVPLAT/5/SYSM_AIRFLOWSAME: The airflow directions for the two fan trays must be the same. Please check it. |
|
Impact |
The temperature of the device might be abnormal. |
|
Cause |
The system prints this log and then automatically performs the following tasks when it detects both a fan tray that draws cooling air and a fan tray that exhausts warm air: · Enables the fan tray that draws cooling air to operate at full speed. · Enables the fan tray that exhausts warm air to operate at the lowest speed. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
SYSM_FAN_ABSENT
|
Message text |
Warning: Fan [INT32] is absent! |
|
Variable fields |
$1: ID of a fan tray. |
|
Severity level |
5 (Notification) |
|
Example |
DRVPLAT/5/SYSM_FAN_ABSENT: Warning: Fan 2 is absent! |
|
Impact |
The temperature of the device might be abnormal. |
|
Cause |
The system detected no fan tray in the specified slot. |
|
Recommended action |
1. Install a fan tray. 2. Examine the fan tray LED on the MPU. If the LED is steady on, the fan tray is securely installed in the slot. 3. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
DRV_BOARD_UNKNOWN
DRV_SLOTS_INTERMIXED
DRV_FRAMES_POWER
DRV_POWER_MODULE
|
Message text |
Only one power module is installed in power frame [UINT32]. |
SUBCARD_INSTALL_FAULT
|
Message text |
The subcard in subslot [INT32] is not installed correctly. Please remove the subcard and install it again. |
|
Variable fields |
$1: Subslot number of a subcard. |
|
Severity level |
1 (Alert) |
|
Example |
PORT/1/SUBCARD_INSTALL_FAULT: -MDC=1-Slot=7; The subcard in subslot 1 is not installed correctly. Please remove the subcard and install it again. |
|
Impact |
The subcard cannot operate correctly, which affects services. |
|
Cause |
The specified subcard was not securely installed. |
|
Recommended action |
1. Remove the subcard and securely install the subcard. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
SUBCARD_MISMATCH_PREV
|
Message text |
The type of current board is [STRING]. It doesn't match with the previous board [STRING] in Slot [INT32]. |
|
Variable fields |
$1: Model of the new interface module. $2: Model of the replaced interface module. $3: Slot number of the interface module. |
|
Severity level |
2 (Critical) |
|
Example |
DSYSM/2/SUBCARD_MISMATCH_PREV: The type of current board is MIC-PSP4L. It doesn't match with the previous board MIC-CLP4L in Slot 6. |
|
Impact |
Services on the interface module might be affected. |
|
Cause |
An interface module was replaced with a module of a different model. |
|
Recommended action |
Do replace a correctly operating interface module with an interface module of a different model. |
SUBCARD_NOTSPT_SLOT
|
Message text |
Pattern 1: The board is not supported in slot [INT32]. Pattern 2: The [STRING] interface module is not supported in slot [INT32]. It can be installed in the following slots: [INT32]. |
|
Variable fields |
Pattern 1: $1: Slot number of an interface module. Pattern 2: $1: Name of an interface module. $2: Slot number of the interface module. $3: Slot numbers supported by the interface module. |
|
Severity level |
2 (Critical) |
|
Example |
Pattern 1: DSYSM/2/SUBCARD_NOTSPT_SLOT: -MDC=1-Slot=2; The board is not supported in slot 2. Pattern 2: DSYSM/2/SUBCARD_NOTSPT_SLOT: -MDC=1-Slot=18; The MIC-XP10L-M interface module is not supported in slot 2. It can be installed in the following slots: 6 7 8 9 10 11 12 13. |
|
Impact |
Services on the interface module might be affected. |
|
Cause |
The slot does not support installing the interface module. |
|
Recommended action |
Replace the interface module with a supported one, or insert the interface module into a slot that supports the module. |
GET_FPGAFILE_FAILED
|
Message text |
Get fpga file([STRING]) failed! |
|
Variable fields |
$1: FPGA file name. |
|
Severity level |
3 (Error) |
|
Example |
SYSM/3/GET_FPGAFILE_FAILED:Get fpga file(NPS_1812X_E.bin) failed! |
|
Impact |
The card cannot start up correctly. |
|
Cause |
The system failed to obtain the FPGA file of a card. The card might fail to start. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
LOAD_FPGAFILE_FAILED
|
Message text |
Download fpga file([STRING])failed! |
|
Variable fields |
$1: FPGA file name. |
|
Severity level |
3 (Error) |
|
Example |
SYSM/3/LOAD_FPGAFILE_FAILED: Downloadfpga file(NPS_1812X_E.bin) failed! |
|
Impact |
The card cannot start up correctly. |
|
Cause |
The system failed to download the FPGA file of a card. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
INNERLINK_EXCEPTION
|
Message text |
An exception has occured on an internal link. |
|
Variable fields |
N/A |
|
Severity level |
3 (Error) |
|
Example |
SYSM/3/INNERLINK_EXCEPTION：An exception has occured on an internal link. |
|
Impact |
The issue affects the normal operation of the device. |
|
Cause |
Hardware failure, resulting in a large number of error packets on the internal link. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
TACACS messages
This section contains TACACS messages.
TACACS_ACCT_SERVER_DOWN
|
Message text |
TACACS accounting server was blocked: Server IP=[STRING], port=[UINT32], VPN instance=[STRING]. |
|
Variable fields |
$1: IP address of the accounting server. $2: Port number of the accounting server. $3: VPN instance name. This field displays public if the server belongs to the public network. |
|
Severity level |
4 |
|
Example |
TACACS/4/TACACS_ACCT_SERVER_DOWN: TACACS accounting server was blocked: Server IP=1.1.1.1, port=1812, VPN instance=public. |
|
Explanation |
An accounting server became blocked. |
|
Recommended action |
1. Verify that the accounting server has started up. 2. Ping the accounting server to verify that the server is reachable. If the server is not reachable, check the link for connectivity issues and resolve the issues. 3. Collect logs and diagnostic logs, and then contact H3C Support. |
TACACS_ACCT_SERVER_UP
|
Message text |
TACACS accounting server became active: Server IP=[STRING], port=[UINT32], VPN instance=[STRING]. |
|
Variable fields |
$1: IP address of the accounting server. $2: Port number of the accounting server. $3: VPN instance name. This field displays public if the server belongs to the public network. |
|
Severity level |
6 |
|
Example |
TACACS/6/TACACS_ACCT_SERVER_UP: TACACS accounting server became active: Server IP=1.1.1.1, port=1812, VPN instance=public. |
|
Explanation |
An accounting server became active. |
|
Recommended action |
No action is required. |
TACACS_AUTH_FAILURE
|
Message text |
User [STRING] from [STRING] failed authentication. |
|
Variable fields |
$1: Username. $2: IP address. |
|
Severity level |
5 |
|
Example |
TACACS/5/TACACS_AUTH_FAILURE: User cwf@system from 192.168.0.22 failed authentication. |
|
Explanation |
An authentication request was rejected by the TACACS server. |
|
Recommended action |
No action is required. |
TACACS_AUTH_SERVER_DOWN
|
Message text |
TACACS authentication server was blocked: Server IP=[STRING], port=[UINT32], VPN instance=[STRING]. |
|
Variable fields |
$1: IP address of the authentication server. $2: Port number of the authentication server. $3: VPN instance name. This field displays public if the server belongs to the public network. |
|
Severity level |
4 |
|
Example |
TACACS/4/TACACS_AUTH_SERVER_DOWN: TACACS authentication server was blocked: Server IP=1.1.1.1, port=1812, VPN instance=public. |
|
Explanation |
An authentication server became blocked. |
|
Recommended action |
1. Verify that the authentication server has started up. 2. Ping the authentication server to verify that the server is reachable. If the server is not reachable, check the link for connectivity issues and resolve the issues. 3. Collect logs and diagnostic logs, and then contact H3C Support. |
TACACS_AUTH_SERVER_UP
|
Message text |
TACACS authentication server became active: Server IP=[STRING], port=[UINT32], VPN instance=[STRING]. |
|
Variable fields |
$1: IP address of the authentication server. $2: Port number of the authentication server. $3: VPN instance name. This field displays public if the server belongs to the public network. |
|
Severity level |
6 |
|
Example |
TACACS/6/TACACS_AUTH_SERVER_UP: TACACS authentication server became active: Server IP=1.1.1.1, port=1812, VPN instance=public. |
|
Explanation |
An authentication server became active. |
|
Recommended action |
No action is required. |
TACACS_AUTH_SUCCESS
|
Message text |
User [STRING] from [STRING] was authenticated successfully. |
|
Variable fields |
$1: Username. $2: IP address. |
|
Severity level |
6 |
|
Example |
TACACS/6/TACACS_AUTH_SUCCESS: User cwf@system from 192.168.0.22 was authenticated successfully. |
|
Explanation |
An authentication request was accepted by the TACACS server. |
|
Recommended action |
No action is required. |
TACACS_AUTHOR_SERVER_DOWN
|
Message text |
TACACS authorization server was blocked: Server IP=[STRING], port=[UINT32], VPN instance=[STRING]. |
|
Variable fields |
$1: IP address of the authorization server. $2: Port number of the authorization server. $3: VPN instance name. This field displays public if the server belongs to the public network. |
|
Severity level |
4 |
|
Example |
TACACS/4/TACACS_AUTHOR_SERVER_DOWN: TACACS authorization server was blocked: Server IP=1.1.1.1, port=1812, VPN instance=public. |
|
Explanation |
An authorization server became blocked. |
|
Recommended action |
1. Verify that the authorization server has started up. 2. Ping the authorization server to verify that the server is reachable. If the server is not reachable, check the link for connectivity issues and resolve the issues. 3. Collect logs and diagnostic logs, and then contact H3C Support. |
TACACS_AUTHOR_SERVER_UP
|
Message text |
TACACS authorization server became active: Server IP=[STRING], port=[UINT32], VPN instance=[STRING]. |
|
Variable fields |
$1: IP address of the authorization server. $2: Port number of the authorization server. $3: VPN instance name. This field displays public if the server belongs to the public network. |
|
Severity level |
6 |
|
Example |
TACACS/6/TACACS_AUTHOR_SERVER_UP: TACACS authorization server became active: Server IP=1.1.1.1, port=1812, VPN instance=public. |
|
Explanation |
An authorization server became active. |
|
Recommended action |
No action is required. |
TACACS_DELETE_HOST_FAIL
|
Message text |
Failed to delete servers in scheme [STRING]. |
|
Variable fields |
$1: Scheme name. |
|
Severity level |
4 |
|
Example |
TACACS/4/TACACS_DELETE_HOST_FAIL: Failed to delete servers in scheme abc. |
|
Explanation |
Failed to delete servers from a TACACS scheme. |
|
Recommended action |
No action is required. |
TE messages
This section contains TE messages.
TE_BACKUP_SWITCH
|
Message text |
Tunnel [UNIT] ( [STRING] ): [STRING]. [STRING] |
|
Variable fields |
$1: Primary tunnel information. $2: LSP information. $3: Session status: · Backup tunnel ready—Hot standby is enabled. No primary/backup tunnel switchover is triggered. · Backup tunnel used—Hot standby is enabled. Traffic is switched from the primary tunnel to the backup tunnel. · Backup tunnel disabled—Hot standby is disabled. · Main tunnel recovered—The primary tunnel has recovered. The traffic is switched back to the primary tunnel. $4: LSP path information, including IP addresses of the LSR interfaces, and LSR IDs or flag values of the LSRs that the LSP path traverses. This field is displayed only when the session status is Backup tunnel used or Main tunnel recovered. |
|
Severity level |
5 |
|
Example |
TE/5/TE_BACKUP_SWITCH: Tunnel 5 ( IngressLsrID=1.1.1.8 EgressLsrID=2.2.2.8 LSPID=100 Bandwidth=1000kbps ): Backup tunnel used. Current LSP path is 10.1.1.1/32(flag=0x00) - 10.1.1.2/32(flag=0x00) - 1151(flag=0x01) - 2.2.2.8/32(flag=0x20). |
|
Explanation |
This log is generated when a hot standby or segment routing tunnel is established or removed, or a primary/backup tunnel switchover is triggered. |
|
Recommended action |
No action is required. |
TE_MBB_SWITCH
|
Message text |
Tunnel [STRING] ( [STRING] ): Make before break was triggered. Reason: [STRING]. [STRING] |
|
Variable fields |
$1: Primary tunnel information. $2: LSP information. $3: Events that have triggered make-before-break: · configuration change. · FRR used. · reoptimize timer expiration. · automatic bandwidth adjustment. · stateful PCE updated. · stateful PCE state reverted to local configuration. $4: LSP path information, including IP addresses of the LSR interfaces, and LSR IDs or flag values of the LSRs that the LSP path traverses. |
|
Severity level |
5 |
|
Example |
TE/5/TE_MBB_SWITCH: Tunnel 5: Make before break triggered by configuration change. |
|
Explanation |
TE/5/TE_MBB_SWITCH: Tunnel 5 ( IngressLsrID=1.1.1.8 EgressLsrID=2.2.2.8 LSPID=100 Bandwidth=1000kbps ): Make-before-break triggered by configuration change. Current LSP path is 10.1.1.1/32(flag=0x00) - 10.1.1.2/32(flag=0x00) - 1151(flag=0x01) - 2.2.2.8/32(flag=0x20). |
|
Recommended action |
No action is required. |
TE_TUNNEL_NESTING
|
Message text |
Tunnel [STRING] had the nesting issue. |
|
Variable fields |
$1: Tunnel ID. |
|
Severity level |
4 |
|
Example |
TE/4/TE_TUNNEL_NESTING: -MDC=1; Tunnel1002 had the nesting issue. |
|
Explanation |
The explicit path used by the tunnel contains a SID node that identifies a tunnel (which was configured by using the nextsid [ index index-number ] label label-value type binding-sid command). However, the tunnel nesting was wrong, causing packet forwarding failure. |
|
Recommended action |
· Delete the configuration set by the nextsid [ index index-number ] label label-value type binding-sid command for the tunnel. · Check the nextsid configuration for the tunnel to eliminate the following errors: ¡ Self-nesting. The tunnel specified by the binding SID is the current tunnel itself. ¡ Multi-level nesting. The device supports only one-level of tunnel nesting. ¡ Looped nesting. For example, the tunnel (tunnel A) nested another tunnel (tunnel B), and tunnel B nested tunnel A. |
TE_LABEL_DUPLICATE
|
Message text |
Binding SID label [STRING] for tunnel [STRING] is duplicate. |
|
Variable fields |
$1: Value of the BSID label for the tunnel. $2: Tunnel ID. |
|
Severity level |
4 |
|
Example |
TE/4/TE_LABEL_DUPLICATE: -MDC=1; Binding SID label 1200 for tunnel 1 is duplicate. |
|
Explanation |
The BSID label assigned to the MPLS TE tunnel has already been occupied. |
|
Recommended action |
· Keep using the specified BSID label: a. Execute the display mpls label command to view the protocol that is using the label, and then release the label. b. Delete the BSID configuration of the tunnel, and then respecify the BSID for the tunnel. · Use another label as the BSID of the tunnel: delete the current BSID configuration of the tunnel, and then respecify an unused label as the BSID for the tunnel. |
TELNETD messages
This section contains Telnet daemon messages.
TELNETD_ACL_DENY
|
Message text |
The Telnet connection request was denied according to ACL rules: UserAddress=[STRING], LocalAddress=[STRING], VpnInstanceName=[STRING]. |
|
Variable fields |
$1: IP address of the Telnet client. $2: IP address of the Telnet server. $3: VPN instance name. |
|
Severity level |
5 |
|
Example |
TELNET/5/TELNETD_ACL_DENY: The Telnet connection request was denied according to ACL rules: UserAddress=1.2.3.4, LocalAddress=1.2.3.1, VpnInstanceName=vpn1. |
|
Explanation |
The Telnet server denied a connection request based on the access control ACL. |
|
Recommended action |
1. Execute the display current-configuration | include "telnet server" to obtain the applied ACLs when the device acts as the Telnet server. 2. Execute the display acl command to display ACL configuration and match statistics. 3. Verify that the ACL settings meet network requirements. 4. Execute the acl command to configure ACL settings as required. |
TELNETD_REACH_SESSION_LIMIT
|
Message text |
Telnet client [STRING] failed to log in. The current number of Telnet sessions is [NUMBER]. The maximum number allowed is ([NUMBER]). |
|
Variable fields |
$1: IP address of the Telnet client. $2: Current number of Telnet sessions. $3: Maximum number of Telnet sessions allowed by the device. |
|
Severity level |
|
|
Example |
|
|
Explanation |
The number of Telnet connections reached the limit. |
|
Recommended action |
1. Use the display current-configuration | include session-limit command to view the current limit for Telnet connections. If the command does not display the limit, the device is using the default setting. 2. If you want to set a greater limit, execute the aaa session-limit command. If you think the limit is proper, no action is required. |
Tunnel messages
This section contains tunnel messages.
GRE_CREATE_NORES
|
Message text |
No enough resource |
|
Variable fields |
N/A |
|
Severity level |
6 (Informational) |
|
Example |
L3/6/GRE_CREATE_NORES: -MDC=1-Slot=4; No enough resource |
|
Impact |
Hardware resources become insufficient and GRE tunnels cannot be created. |
|
Cause |
Excessive creation of tunnels causes insufficient hardware resources for creating a GRE tunnel. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
TUNNEL_CREATE_NORES
|
Message text |
The Board Slot [INT32] Create Tunnel Failed, Because No Enough Resource! |
|
Variable fields |
$1: Slot number of the card. |
|
Severity level |
3 (Error) |
|
Example |
|
|
Impact |
Tunnels cannot be created on the current card. |
|
Cause |
A tunnel was created when the next hop resources of the card has exhausted or the L3 INTF resources on the MPU were insufficient. This tunnel cannot be created. You need to re-create the tunnel when the resources are sufficient. |
|
Recommended action |
1. Use the debug ipv4-drv show statistics slot slot-number command in probe view to display the card resource usage information. 2. Clear ARP entries to release resources. 3. Display the card resource usage information again to verify that the resources on the card have recovered. 4. Use the display hardware internal l3 np tunnel index index command in probe view to display the tunnel interface number according to the tunnel index ID. Then, re-create the tunnel. 5. If this message is displayed again, execute the display hardware internal indexq handle 1234FF00 slot slot-number chip chip-number command in probe view to display MPU resource usage information. 6. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
TUN_VXLAN_NOTSPT
|
Message text |
In standard mode, the card does not support vxlan or vxlan-dci ipv6 tunnel. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
IPV4/4/TUN_VXLAN_NOTSPT: -MDC=1-Slot=4; In standard mode, the card does not support vxlan or vxlan-dci ipv6 tunnel. |
|
Impact |
VXLAN over IPv6 tunnels or VXLAN-DCI over IPv6 tunnels cannot be created on the current card. |
|
Cause |
When the device operates in standard mode, the current type of card does not support IPv6 VXLAN or VXLAN-DCI tunnel establishment. |
|
Recommended action |
Contact Technical Support, and then perform the following: · If you are allowed to change the system operating mode, use the system-working-mode command to change the system operating mode to SDN-WAN. · If conditions permit, replace the current card with a card of NP5 type. |
TUN_SRV6_NOTSPT
|
Message text |
In standard mode, the card does not support srv6 tunnel. |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
IPV4/4/TUN_SRV6_NOTSPT: -MDC=1-Slot=4; In standard mode, the card does not support srv6 tunnel. |
|
Impact |
SRv6 tunnels cannot be created on the current card. |
|
Cause |
When the device operates in standard mode, the current type of card does not support SRv6 tunnel establishment. |
|
Recommended action |
Contact Technical Support. If you are allowed to change the system operating mode, use the system-working-mode command in system view to change the system operating mode to SDN-WAN. |
TUN_SPT_MAX_SID
|
Message text |
The card in this slot supports a maximum of five segment identifiers (SIDs). |
|
Variable fields |
N/A |
|
Severity level |
4 (Warning) |
|
Example |
IPV4/4/TUN_SPT_MAX_SID: -MDC=1-Slot=4; The card in this slot supports a maximum of five segment identifiers (SIDs). |
|
Impact |
SRv6 tunnels cannot be created. |
|
Cause |
This message is sent when the number of SIDs configured for a SID list for an SRv6 tunnel exceeds the maximum number (5) supported. |
|
Recommended action |
1. Delete unused SIDs and then create the SRv6 tunnel again. 2. If the issue persists, collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
UCM
This section contains UCM messages.
UCM_APPLY_PPPOEA_FWD_POLICY_FAIL (non-vBRAS-CPs)
|
Message text |
Failed to [STRING] a PPPoEA forwarding policy to the driver: UserGroupName=[STRING], AclType=[STRING], AclEventType=[STRING], FailedReason=[STRING]. |
|
Variable fields |
$1: Action type of the PPPoEA forwarding policy: · add · modify · delete $2: User group name. $3: ACL type: · IPv4 · IPv6 $4: ACL event type: · Cfg change · Add rule · Delete rule · Modify rule · Rule active · Rule inactive · Create ACL group · Delete ACL group · Modify ACL step · Create L3VPN rule · Delete L3VPN rule · Bulk delete rules $5: Reason for failing to deploy the PPPoEA forwarding policy to the driver: · Failed—Hardware match counting failed to be applied. · Not enough resources to complete the operation. · The operation is not supported. |
|
Severity level |
4 |
|
Example |
UCM/4/UCM_APPLY_PPPOEA_FWD_POLICY_FAIL: Failed to add a PPPoEA forwarding policy to the driver: UserGroupName=g1, AclType=IPv4, AclEventType=Add rule, FailedReason=Failed. |
|
Explanation |
This message is generated when the pppoe-agency forward command fails to be executed. |
|
Recommended action |
· If the failure reason is Failed, execute the pppoe-agency forward command again. If the problem persists, contact H3C Support. · If the failure reason is one of the other two reasons, contact H3C Support. |
UCM_APPLY_PPPOEA_RELAY_FAIL (non-vBRAS-CPs)
|
Message text |
Failed to [STRING] pppoe-agency-relay-enable configuration to the driver: FailedReason=[STRING]. |
|
Variable fields |
$1: Action type: · add · delete $2: Reason for failing to issue the pppoe-agency-relay enable command to the driver: · Not enough resources to complete the operation. · The operation is not supported. · Failed—Failed due to other reasons. |
|
Severity level |
4 |
|
Example |
UCM/4/UCM_APPLY_PPPOEA_RELAY_FAIL: Failed to add pppoe-agency-relay-enable configuration to the driver: FailedReason=Failed. |
|
Explanation |
This message is generated when the pppoe-agency-relay enable command fails to be issued to the driver. |
|
Recommended action |
· If the failure reason is Failed, execute the pppoe-agency-relay enable command again. If the problem persists, contact H3C Support. · If the failure reason is one of the other two reasons, contact H3C Support. |
|
Message text |
Failed to [STRING] pppoe-agency-relay-group configuration to the driver: IfName=[STRING], AgencyGroupName=[STRING], FailedReason=[STRING]. |
|
Variable fields |
$1: Action type: · add · delete $2: Access interface name of the PPPoE agency gateway. $3: Name of the agency group bound to the access interface name of the PPPoE agency gateway. $4: Reason for failing to issue the pppoe-agency-relay-group command to the driver: · Not enough resources to complete the operation. · The operation is not supported. · Failed—Failed due to other reasons. |
|
Severity level |
4 |
|
Example |
UCM/4/UCM_APPLY_PPPOEA_RELAY_FAIL: Failed to add pppoe-agency-relay-group configuration to the driver: IfName=GigabitEthernet1/0/1, AgencyGroupName=school1, FailedReason=Failed. |
|
Explanation |
This message is generated when the pppoe-agency-relay-group command fails to be issued to the driver. |
|
Recommended action |
· If the failure reason is Failed, execute the pppoe-agency-relay-group command again. If the problem persists, contact H3C Support. · If the failure reason is one of the other two reasons, contact H3C Support. |
UCM_LOSS_RATIO_EXCEED_THRESHOLD
|
Message text |
Centralized devices: The [STRING] detection packet loss ratio on the interface [STRING] is [UINT32]%, and exceeds [UINT32]%. Distributed devices in standalone mode: Centralized IRF devices: The [STRING] detection packet loss ratio on the interface [STRING] on slot [UINT32] is [UINT32]%, and exceeds [UINT32]%. Distributed devices in IRF mode: The [STRING] detection packet loss ratio on the interface [STRING] on chassis [UINT32] slot [UINT32] is [UINT32]%, and exceeds [UINT32]%. |
|
Variable fields |
$1: Detection packet type. Options include: · ARP: ARP packets. · ND: ND packets. · ICMPv4: ICMPv4 packets. · ICMPv6: ICMPv4 packets. $2: Interface name. $3: Chassis number. (Distributed devices in IRF mode.) $4: Slot number. (Distributed devices in standalone mode.)(Centralized IRF devices.)(Distributed devices in IRF mode.) $5: Packet loss ratio of detection packets. $6: Packet loss ratio alarm threshold for detection packets. |
|
Severity level |
4 |
|
Example |
Centralized devices: UCM/4/UCM_LOSS_RATIO_EXCEED_THRESHOLD: The ARP detection packet loss ratio on the interface GigabitEthernet1/0/1 is 50%, and exceeds 30%. Distributed devices in standalone mode: Centralized IRF devices: UCM/4/UCM_LOSS_RATIO_EXCEED_THRESHOLD: The ARP detection packet loss ratio on the interface GigabitEthernet1/0/1 on slot 1 is 50%, and exceeds 30%. Distributed devices in IRF mode: UCM/4/UCM_LOSS_RATIO_EXCEED_THRESHOLD: The ARP detection packet loss ratio on the interface GigabitEthernet1/0/1 on chassis 1 slot 1 is 50%, and exceeds 30%. |
|
Explanation |
The packet loss ratio for IPoE user detection packets exceeded the packet loss ratio alarm threshold on an interface |
|
Recommended action |
1. Verify that the device interface cable connections and network configuration are normal. 2. Collect log messages, and contact Technical Support. |
UCM_LOSS_RATIO_RECOVER_NORMAL
|
Message text |
Centralized devices: The [STRING] detection packet loss ratio on the interface [STRING] has recovered to normal state. Distributed devices in standalone mode: Centralized IRF devices: The [STRING] detection packet loss ratio on the interface [STRING] on slot [ UINT32] has recovered to normal state. Distributed devices in IRF mode: The [STRING] detection packet loss ratio on the interface [STRING] on chassis [ UINT32] slot [ UINT32] has recovered to normal state. |
|
Variable fields |
$1: Detection packet type. Options include: · ARP: ARP packets. · ND: ND packets. · ICMPv4: ICMPv4 packets. · ICMPv6: ICMPv4 packets. $2: Interface name. $3: Chassis number. (Distributed devices in IRF mode.) $4: Slot number. (Distributed devices in standalone mode.)(Centralized IRF devices.)(Distributed devices in IRF mode.) $5: Packet loss ratio of detection packets. |
|
Severity level |
4 |
|
Example |
Centralized devices: UCM/4/UCM_LOSS_RATIO_RECOVER_NORMAL: The ARP detection packet loss ratio on the interface GigabitEthernet1/0/1 has recovered to normal state. Distributed devices in standalone mode: Centralized IRF devices: UCM/4/UCM_LOSS_RATIO_RECOVER_NORMAL: The ARP detection packet loss ratio on the interface GigabitEthernet1/0/1 on slot 1 has recovered to normal state. Distributed devices in IRF mode: UCM/4/UCM_LOSS_RATIO_RECOVER_NORMAL: The ARP detection packet loss ratio on the interface GigabitEthernet1/0/1 on chassis 1 slot 1 has recovered to normal state. |
|
Explanation |
The packet loss ratio for IPoE user detection packets restored to the normal range on an interface |
|
Recommended action |
No action is required. |
UCM_PPPOE_AGENCY_LOGON_SUCCESS (non-vBRAS-CPs)
|
Message text |
-UserName=[STRING]-IPv4Addr=[IPADDR]-IfName=[STRING]-OuterVLAN=[UINT16]-InnerVLAN=[UINT16]-MACAddr=[MAC]–PPPoEAgency-IPv4Addr=[IPADDR]; The PPPoE agency user came online successfully. |
|
Variable fields |
$1: Username used by an internal campus user to come online. $2: IPv4 address of an internal campus user. $3: Access interface name of an internal campus user. $4: Outer VLAN ID of an internal campus user. $5: Inner VLAN ID of an internal campus user. $6: MAC address of an internal campus user. $7: IPv4 address that the service provider allocates to a PPPoE agency user. |
|
Severity level |
6 |
|
Example |
UCM/6/UCM_PPPOE_AGENCY_LOGON_SUCCESS: -UserName=123-IPv4Addr=1.1.1.1-IfName=GigabitEthernet1/0/1-OuterVLAN=100-InnerVLAN=200-MACAddr=0010-9400-000a–PPPoEAgency-IPv4Addr=12.1.1.2; The PPPoE agency user came online successfully. |
|
Explanation |
A PPPoE agency user has successfully come online |
|
Recommended action |
No action is required. |
UCM_SESSION_ADD_DRIVER_FAILED
|
Message text |
Failed to add an UCM session: (UserLabel=[UINT16], IPv4Addr=[IPADDR], IPv6Addr=[IPADDR], IfName=[STRING], MACAddr=[MAC]). Cause: [STRING]. |
|
Variable fields |
$1: User label. $2: User IPv4 address. $3: User IPv6 address. $4: Access interface of the user. $5: User MAC address. $6: Failure reason: · Insufficient hardware resources for BRAS user statistics or BRAS rate-limiting profile. · Insufficient hardware resources for user VLAN QinQ. · Insufficient hardware resources for BRAS user entries. · Insufficient hardware IPv4 or IPv6 ACL resources for leased sessions. · Maximum number of BRAS users already reached. |
|
Severity level |
4 |
|
Example |
UCM/4/UCM_SESSION_ADD_DRIVER_FAILED: Failed to add an UCM session: UserLabel=0x80004c7, IPv4Addr=143.0.0.1, IPv6Addr=N/A, IfName=GigabitEthernet1/0/1, MACAddr=307b-ac83-90df. Cause: Insufficient hardware resources for BRAS user entries. |
|
Explanation |
This message is generated when a UCM session fails to be added. |
|
Recommended action |
Contact H3C Support. |
UCM_SESSIONS_LOWER_THRESHOLD (non-vBRAS-CPs)
|
Message text |
The access user session number is below the lower warning threshold (LowerThreshold=[INT32]). |
|
Variable fields |
$1: Lower online access user session count alarm threshold. |
|
Severity level |
4 |
|
Example |
UCM/4/UCM_SESSIONS_LOWER_THRESHOLD: The access user session number is below the lower warning threshold (LowerThreshold=20). |
|
Explanation |
The online access user session count is below the lower threshold. |
|
Recommended action |
1. Execute the display access-user command to display total number of access users. 2. Identify whether a large number of access users go offline abnormally. |
UCM_SESSIONS_LOWER_THRESHOLD (vBRAS-CPs)
|
Message text |
The access user session number on slot [INT32] is below the lower warning threshold (LowerThreshold=[INT32]). |
|
Variable fields |
$1: Slot number of the master BRAS-VM. $2: Lower online access user session count alarm threshold. |
|
Severity level |
4 |
|
Example |
UCM/4/UCM_SESSIONS_LOWER_THRESHOLD: The access user session number on slot 97 is below the lower warning threshold (LowerThreshold=20). |
|
Explanation |
The online access user session count is below the lower threshold. |
|
Recommended action |
1. Execute the display access-user command to display total number of access users. 2. Identify whether a large number of access users go offline abnormally. |
UCM_SESSIONS_LOWER_RECOVER (non-vBRAS-CPs)
|
Message text |
The access user session number has recovered to normal state from below the lower warning threshold (LowerThreshold=[INT32]). |
|
Variable fields |
$1: Lower online access user session count alarm threshold. |
|
Severity level |
5 |
|
Example |
UCM/5/UCM_SESSIONS_LOWER_RECOVER: The access user session number has recovered to normal state from below the lower warning threshold (LowerThreshold=20). |
|
Explanation |
The online access user session count has recovered to the normal state. |
|
Recommended action |
No action is required. |
UCM_SESSIONS_LOWER_RECOVER (vBRAS-CPs)
|
Message text |
The access user session number on slot [INT32] has recovered to normal state from below the lower warning threshold (LowerThreshold=[INT32]). |
|
Variable fields |
$1: Slot number of the master BRAS-VM. $2: Lower online access user session count alarm threshold. |
|
Severity level |
5 |
|
Example |
UCM/5/UCM_SESSIONS_LOWER_RECOVER: The access user session number on slot 97 has recovered to normal state from below the lower warning threshold (LowerThreshold=20). |
|
Explanation |
The online access user session count has recovered to the normal state. |
|
Recommended action |
No action is required. |
UCM_SESSIONS_UPPER_THRESHOLD (non-vBRAS-CPs)
|
Message text |
The access user session number is above the upper warning threshold (UpperThreshold=[INT32]). |
|
Variable fields |
$1: Upper online access user session count alarm threshold. |
|
Severity level |
4 |
|
Example |
UCM/4/UCM_SESSIONS_UPPER_THRESHOLD: The access user session number is above the upper warning threshold (UpperThreshold=20). |
|
Explanation |
The online access user session count is above the upper threshold. |
|
Recommended action |
1. Execute the display access-user command to display total number of access users. 2. Identify whether a large number of illegal access users come online. |
UCM_SESSIONS_UPPER_THRESHOLD (vBRAS-CPs)
|
Message text |
The access user session number on slot [INT32] is above the upper warning threshold (UpperThreshold=[INT32]). |
|
Variable fields |
$1: Slot number of the master BRAS-VM. $2: Upper online access user session count alarm threshold. |
|
Severity level |
4 |
|
Example |
UCM/4/UCM_SESSIONS_UPPER_THRESHOLD: The access user session number on slot 97 is above the upper warning threshold (UpperThreshold=20). |
|
Explanation |
The online access user session count is above the upper threshold. |
|
Recommended action |
1. Execute the display access-user command to display total number of access users. 2. Identify whether a large number of illegal access users come online. |
UCM_SESSIONS_UPPER_RECOVER (non-vBRAS-CPs)
|
Message text |
The access user session number has recovered to normal state from above the upper warning threshold (UpperThreshold=[INT32]). |
|
Variable fields |
$1: Upper online access user session count alarm threshold. |
|
Severity level |
5 |
|
Example |
UCM/5/UCM_SESSIONS_UPPER_RECOVER: The access user session number has recovered to normal state from above the upper warning threshold (UpperThreshold=20) |
|
Explanation |
The online access user session count has recovered to the normal state. |
|
Recommended action |
No action is required. |
UCM_SESSIONS_UPPER_RECOVER (vBRAS-CPs)
|
Message text |
The access user session number on slot [INT32] has recovered to normal state from above the upper warning threshold (UpperThreshold=[INT32]). |
|
Variable fields |
$1: Slot number of the master BRAS-VM. $2: Upper online access user session count alarm threshold. |
|
Severity level |
4 |
|
Example |
UCM/5/UCM_SESSIONS_UPPER_RECOVER: The access user session number on slot 97 has recovered to normal state from above the upper warning threshold (UpperThreshold=20). |
|
Explanation |
The online access user session count has recovered to the normal state. |
|
Recommended action |
No action is required. |
UCM_UP_SESSIONS_UPPER_THRESHOLD (vBRAS-CPs)
|
Message text |
The access user session number on UP [INT32] is above the upper warning threshold (UpperThreshold=[INT32]). |
|
Variable fields |
$1: UP ID. $2: Upper online access user session count alarm threshold. |
|
Severity level |
4 |
|
Example |
UCM/4/UCM_UP_SESSIONS_UPPER_THRESHOLD: The access user session number on UP 1024 is above the upper warning threshold (UpperThreshold=20). |
|
Explanation |
The online access user session count is above the upper threshold. |
|
Recommended action |
1. Execute the display access-user command to display total number of access users. 2. Identify whether a large number of illegal access users come online. |
UCM_UP_SESSIONS_RECOVER_NORMAL (vBRAS-CPs)
|
Message text |
The access user session number on UP [INT32] has recovered to normal state. |
|
Variable fields |
$1: UP ID. |
|
Severity level |
5 |
|
Example |
UCM/5/UCM_UP_SESSIONS_RECOVER_NORMAL: The access user session number on UP 1024 has recovered to normal state. |
|
Explanation |
The online access user session count has recovered to the normal state. |
|
Recommended action |
No action is required. |
UCM_USER_RECOVER_NORMAL (non-vBRAS-CPs)
|
Message text |
Pattern 1: The user number on slot [INT32] chip [INT32] has recovered to normal state (CurrentThreshold=[FLOAT]). Pattern 2: The user number on chassis [INT32] slot [INT32] chip [INT32] has recovered to normal state (CurrentThreshold=[FLOAT]). |
|
Variable fields |
Pattern 1: $1: Slot number. $2: Chip number. This field is displayed only when the slot hosting the user access interface supports chip-level alarms. $3: User count threshold when the access user count alarm is cleared. Pattern 2: $1: Chassis number. $2: Slot number. $3: Chip number. This field is displayed only when the slot hosting the user access interface supports chip-level alarms. $4: User count threshold when the access user count alarm is cleared. |
|
Severity level |
5 |
|
Example |
UCM/5/UCM_USER_RECOVER_NORMAL: The user number on slot 1 chip 0 has recovered to normal state (CurrentThreshold=60%). |
|
Explanation |
The online access user count of the specified slot or chip has recovered to the normal state. |
|
Recommended action |
No action is required. |
UCM_USER_RECOVER_NORMAL (non-vBRAS-CPs)
|
Message text |
Pattern 1: The user number on slot [INT32] has recovered to normal state (CurrentThreshold=[FLOAT]). Pattern 2: The user number on UP [INT32] slot [INT32] chip [INT32] has recovered to normal state (CurrentThreshold=[FLOAT]). |
|
Variable fields |
Pattern 1: $1: Slot number of a BRAS-VM. $2: User count threshold when the access user count alarm is cleared. Pattern 2: $1: UP ID. $2: Slot number of a UP. $3: Chip number of a UP. This field is displayed only when the slot hosting the user access interface supports chip-level alarms. $4: User count threshold when the access user count alarm is cleared. |
|
Severity level |
4 |
|
Example |
Pattern 1: UCM/5/UCM_USER_RECOVER_NORMAL: The user number on slot 97 has recovered to normal state (CurrentThreshold=60%). Pattern 2: UCM/5/UCM_USER_RECOVER_NORMAL: The user number on UP 1024 slot 1 chip 0 has recovered to normal state (CurrentThreshold=60%). |
|
Explanation |
The online access user count of the specified slot or chip has recovered to the normal state. |
|
Recommended action |
No action is required. |
UCM_USER_UPPER_THRESHOLD (non-vBRAS-CPs)
|
Message text |
Pattern 1: The user number on slot [INT32] chip [INT32] is above the upper warning threshold (UpperThreshold=[INT32]). Pattern 2: The user number on chassis [INT32] slot [INT32] chip [INT32] is above the upper warning threshold (UpperThreshold=[INT32]). |
|
Variable fields |
Pattern 1: $1: Slot number. $2: Chip number. This field is displayed only when the slot hosting the user access interface supports chip-level alarms. $3: Upper online access user count alarm threshold configured. Pattern 2: $1: Chassis number. $2: Slot number. $3: Chip number. This field is displayed only when the slot hosting the user access interface supports chip-level alarms. $4: Upper online access user count alarm threshold configured. |
|
Severity level |
5 |
|
Example |
UCM/4/UCM_USER_UPPER_THRESHOLD: The user number on slot 1 chip 0 is above the upper warning threshold (UpperThreshold=20%). |
|
Explanation |
The online access user count of the specified slot or chip is above the upper threshold. |
|
Recommended action |
Identify whether a large number of illegal IPoE, PPPoE, and L2TP users come online. |
UCM_USER_UPPER_THRESHOLD (vBRAS-CPs)
|
Message text |
Pattern 1: The user number on slot [INT32] is above the upper warning threshold (UpperThreshold=[INT32]). Pattern 2: The user number on UP [INT32] slot [INT32] chip [INT32] is above the upper warning threshold (UpperThreshold=[INT32]). |
|
Variable fields |
Pattern 1: $1: Slot number of a BRAS-VM. $2: Upper online access user count alarm threshold configured. Pattern 2: $1: UP ID. $2: Slot number of a UP. $3: Chip number of a UP. This field is displayed only when the slot hosting the user access interface supports chip-level alarms. $4: Upper online access user count alarm threshold configured. |
|
Severity level |
4 |
|
Example |
Pattern 1: UCM/4/UCM_USER_UPPER_THRESHOLD: The user number on slot 97 is above the upper warning threshold (UpperThreshold=20%). Pattern 2: UCM/4/UCM_USER_UPPER_THRESHOLD: The user number on UP 1024 slot 1 chip 0 is above the upper warning threshold (UpperThreshold=20%). |
|
Explanation |
The online access user count of the specified slot or chip is above the upper threshold. |
|
Recommended action |
Identify whether a large number of illegal IPoE, PPPoE, and L2TP users come online. |
UCM_USER_LOGON_SUCCESS
|
Message text |
-UserName=[STRING]-IPv4Addr=[IPADDR]-IPv6Addr=[IPADDR]-IfName=[STRING]-OuterVLAN=[UINT16]-InnerVLAN=[UINT16]-MACAddr=[MAC]-RemoteTunnelIPAddr=[STRING]-RemoteTunnelName=[STRING]; The user came online successfully. |
|
Variable fields |
$1: Username. $2: User IPv4 address. $3: User IPv6 address. $4: Interface name. $5: Outer VLAN ID. $6: Inner VLAN ID. $7: MAC address. $8: Remote tunnel address. $9: Remote tunnel name. |
|
Severity level |
6 |
|
Example |
UCM/6/UCM_USER_LOGON_SUCCESS: -UserName=user1-IPv4Addr=1.1.0.1-IPv6Addr=N/A-IfName=Bas-interface0-OuterVLAN=N/A-InnerVLAN=N/A-MACAddr=FFFF-FFFF-FFFF-RemoteTunnelIPAddr=123.1.1.2-RemoteTunnelName=LAC; The user came online successfully. |
|
Explanation |
The user came online successfully |
|
Recommended action |
No action is required. |
UCM_USER_LOGON_FAILED
|
Message text |
-UserName=[STRING]-IPv4Addr=[IPADDR]-IPv6Addr=[IPADDR]-IfName=[STRING]-OuterVLAN=[UINT16]-InnerVLAN=[UINT16]-MACAddr=[MAC]-RemoteTunnelIPAddr=[STRING]-RemoteTunnelName=[STRING]-Reason=[STRING]; The user failed to come online. |
|
Variable fields |
$1: Username. $2: User IPv4 address. $3: User IPv6 address. $4: Interface name. $5: Outer VLAN ID. $6: Inner VLAN ID. $7: MAC address. $8: Remote tunnel IP address. $9: Remote tunnel name. $10: Cause for failure to come online. For possible values, see Table 10 |
|
Severity level |
6 |
|
Example |
UCM/6/UCM_USER_LOGON_FAILED: -UserName=user1-IPv4Addr=N/A-IPv6Addr=N/A-IfName=Bas-interface0-OuterVLAN=N/A-InnerVLAN=N/A-MACAddr=FFFF-FFFF-FFFF-RemoteTunnelIPAddr=123.1.1.2-RemoteTunnelName=LNS1-Reason= Invalid username or password ; The user failed to come online. |
|
Explanation |
The user failed to come online. |
|
Recommended action |
For more information, see Table 10 |
Table 10 Causes for failure to come online
|
Cause for failure to come online |
Remarks |
Recommended action |
|
The number of users on this interface has reached the upper limit |
N/A |
Use the access-limit command to adjust the maximum number of users allowed on an interface as needed. |
|
The number of users on this device has reached the upper limit |
N/A |
Purchase a license that allows more users as needed. |
|
The VPN bound to the IPoE static user and the authorized VPN are different |
The VPN bound to the IPoE static user and the VPN authorized to the IPoE static user by AAA are different. |
Make sure the VPN bound to the IPoE static user and the VPN authorized to the IPoE static user by AAA are the same. |
|
Maximum concurrent users for the account has been reached |
The maximum number of concurrent users for the account has been reached. |
Adjust the maximum number of concurrent users for the account in one of the following methods: · Execute the users-per-account command in ISP domain view to adjust the maximum number of concurrent users for the account. · Use attribute 62 (port-limit) on the RADIUS server to adjust the maximum number of users to be provided to the account. |
|
The configured master interface has no backup subinterface |
During the UP hot backup or warm backup network, after the configured backup UP becomes a running active UP, a user cannot come online when the following conditions exist: · The user comes online through a subinterface on the running active UP. · The subinterface is not configured with a backup subinterface on the configured active UP. |
Verify that the VLAN of the subinterface of the interface on the configured active UP is the same as the VLAN of the interface on the configured backup UP. |
|
Only static leased users are permitted |
The interface is configured with static leased users, and other dynamic users cannot come online. |
Check the static leased user configuration. For users except static leased users to come online, execute the undo ip subscriber session static-leased command to delete the static leased user configuration. |
|
IPoE access mode or authentication method error |
A global static session with a PD prefix is configured on the interface, but the access mode is not Layer 2 access mode or the authentication method is not bind on the interface. Therefore, static users cannot come online. |
Verify that the access mode of the interface is Layer 2 access mode, and the bind authentication method is used on the interface. |
|
IPv6 PD prefix conflict |
IPv6 PD conflict |
Verify that the PD prefix configuration of the user is correct. For example, for a global static user, identify whether a session already exists with the IPv6 address in the global static session but a different PD prefix. |
UCM_USER_LOGOFF
|
Message text |
-UserName=[STRING]-IPv4Addr=[IPADDR]-IPv6Addr=[IPADDR]-IfName=[STRING]-OuterVLAN=[UINT16]-InnerVLAN=[UINT16]-MACAddr=[MAC]-RemoteTunnelIPAddr=[STRING]-RemoteTunnelName=[STRING]-Reason=[STRING]; The user logged off. |
|
Variable fields |
$1: Username. $2: User IPv4 address. $3: User IPv6 address. $4: Interface name. $5: Outer VLAN ID. $6: Inner VLAN ID. $7: MAC address. $8: Remote tunnel IP address. $9: Remote tunnel name. $10: Cause for failure to come online. For possible values, see Table 11 |
|
Severity level |
6 |
|
Example |
UCM/6/UCM_USER_LOGOFF: -UserName=user1-IPv4Addr=1.1.0.1-IPv6Addr=N/A-IfName=Bas-interface0-OuterVLAN=N/A-InnerVLAN=N/A-MACAddr=FFFF-FFFF-FFFF-RemoteTunnelIPAddr=123.1.1.2-RemoteTunnelName=LNS1-Reason=user logoff; The user logged off. |
|
Explanation |
The user normally went offline. |
|
Recommended action |
No action is required. |
Table 11 Causes for normally going offline
|
Cause for going offline |
Remarks |
|
Re-DHCP for IPoE Web authentication |
In a transparent MAC authentication application with re-DHCP enabled, a user successfully comes online in the Web authentication phase through a common Web authentication process first. After the device receives accounting reply packets from the AAA server, the DHCP user is forcibly logged out, so that the user can come online again through the transparent MAC authentication process. |
UCM_USER_LOGOFF_ABNORMAL
|
Message text |
-UserName=[STRING]-IPv4Addr=[IPADDR]-IPv6Addr=[IPADDR]-IfName=[STRING]-OuterVLAN=[UINT16]-InnerVLAN=[UINT16]-MACAddr=[MAC]-RemoteTunnelIPAddr=[STRING]-RemoteTunnelName=[STRING]-Reason=[STRING]; The user logged off abnormally. |
|
Variable fields |
$1: Username. $2: User IPv4 address. $3: User IPv6 address. $4: Interface name. $5: Outer VLAN ID. $6: Inner VLAN ID. $7: MAC address. $8: Remote tunnel IP address. $9: Remote tunnel name. $10: Cause for going online. For possible values, see Table 12 |
|
Severity level |
6 |
|
Example |
UCM/6/UCM_USER_LOGOFF_ABNORMAL: -UserName=user1-IPv4Addr=1.1.0.1-IPv6Addr=N/A-IfName=Bas-interface0-OuterVLAN=N/A-InnerVLAN=N/A-MACAddr=FFFF-FFFF-FFFF-RemoteTunnelIPAddr=123.1.1.2-RemoteTunnelName=LNS1-Reason=session time out; The user logged off abnormally. |
|
Explanation |
The user abnormally went offline. |
|
Recommended action |
For more information, see Table 12 |
Table 12 Causes for abnormally going offline
|
Cause for going offline |
Remarks |
Recommended action |
|
Logged out by the RADIUS proxy |
For an 802.1X user and an IPoE user that come online through a wireless service in a RADIUS proxy network, the IPoE user goes offline when the 802.1X user goes offline. |
Troubleshoot the problem that the 802.1X user goes offline. |
|
UP switchover |
In the UP backup network, the active/standby UP switchover causes users to go offline. |
Contact Technical Support. |
|
UP switchover without backup interface |
In the UP hot backup or warm backup network, the active/standby UP switchover causes users without backup interfaces to go offline. |
· In warm backup mode: ¡ Verify that the backup-interface command has been executed to configure backup interfaces. ¡ If a user accesses through a subinterface, identify whether the subinterface has the corresponding backup subinterface. If yes, verify that the backup subinterface operates properly. · In hot backup mode, identify whether the subinterface through which the user comes online has a backup subinterface. If yes, verify that the backup subinterface operates properly. |
|
UP backup status change |
The process of the module (for example, UP backup module) restarts or the active/standby switchover occurs, which causes the UP backup group state change. As a result, the users go offline. |
Identify whether the UP backup group state is normal. If the state is abnormal, verify that the UP backup configuration is correct. |
|
UP backup configuration change |
The UP backup configuration changes cause the users to go offline. |
Check the recent configuration changes. |
UCM_USER_ONLINE_FAIL_ALARM (vBRAS-CPs)
|
Message text |
The number of online failure records is above the warning threshold. (OnlineFailThreshold=[INT32]). |
|
Variable fields |
$1: User online failure count alarm threshold. |
|
Severity level |
4 |
|
Example |
UCM/4/UCM_USER_ONLINE_FAIL_ALARM: The number of online failure records is above the warning threshold. (OnlineFailThreshold=90). |
|
Explanation |
This notification is generated when the number of user online failures within a certain period exceeds the threshold. |
|
Recommended action |
1. Execute the display aaa online-fail-record command to view user online failure records. 2. Identify whether a large number of invalid access users try to come online. |
UCM_USER_ONLINE_FAIL_ALARM (vBRAS-CPs)
|
Message text |
The number of online failure records on slot [INT32] is above the warning threshold. (OnlineFailThreshold=[INT32]) |
|
Variable fields |
$1: Slot number of the master BRAS-VM. $2: User online failure count alarm threshold. |
|
Severity level |
4 |
|
Example |
UCM/4/UCM_USER_ONLINE_FAIL_ALARM: The number of online failure records on slot 97 is above the warning threshold. (OnlineFailThreshold=90). |
|
Explanation |
This notification is generated when the number of user online failures within a certain period exceeds the threshold. |
|
Recommended action |
1. Execute the display aaa online-fail-record command to view user online failure records. 2. Identify whether a large number of invalid access users try to come online. |
USER
This section contains service tracing messages.
USER_RECOVER_NORMAL
|
Message text |
Pattern 1: The user number on slot [INT32] has recovered to normal state. Pattern 2: The user number on chassis [INT32] slot [INT32] has recovered to normal state. |
|
Variable fields |
Pattern 1: $1: Slot number. Pattern 2: $1: Chassis number. $2: Slot number. |
|
Severity level |
5 |
|
Example |
USER/5/ USER_RECOVER_NORMAL: The user number on slot 1 has recovered to normal state. |
|
Explanation |
The access user count on the specified slot has dropped below the upper access user count alarm threshold and recovered to the normal range. |
|
Recommended action |
No action is required. |
USER_TRACEINFO
|
Message text |
[objectID=[UINT16]][slotID=[UINT16]][STRING][user info: [STRING] ][trace info:[STRING]] |
|
Variable fields |
$1: Service tracing object ID. $2: Slot number of the access user. $3: Service tracing phase. Possible values include PPPoE, L2TP, PPP, IPoE, portal, UCM, and AAA. $4: User information. For more information about user information, see Table 13. $5: Detailed service tracing information. For detailed service tracing information in each service tracing phase, see the following information: ¡ For detailed information in PPPoE phases, see Table 14. ¡ For detailed information in L2TP phases, see Table 15. ¡ For detailed information in PPP phases, see Table 16. ¡ For detailed information in IPoE phases, see Table 17. ¡ For detailed information in portal phases, see Table 18. ¡ For detailed information in UCM phases, see Table 19. ¡ For detailed information in AAA phases, see Table 20. ¡ For detailed information in DHCP phases, see Table 21. ¡ For detailed information in ARP phases, see Table 22. ¡ For detailed information in ND phases, see Table 23. ¡ For detailed information in IGMP phases, see Table 24. ¡ For detailed information in MLD phases, see Table 25. |
|
Severity level |
7 |
|
Example |
USER/7/USER_TRACEINFO:[objectID=1][slotID=0][UCM][user info: MAC address: 0000-0000-0020 IP address: 2.2.2.8 Access interface: GigabitEthernet1/0/1 User name: 2.2.2.8 Access mode: IPoE ] [trace info:[Adapt State]UserID:4, ConnectID:0, Receive MODIFY event, current state is ADDED] |
|
Explanation |
The service tracing object with ID 1 in the UCM phase received a MODIFY event message from GigabitEthernet 1/0/1 in slot 1. |
|
Recommended action |
No action is required. |
Traced user information description table
Table 13 Traced user information description table
|
Field |
Description |
|
MAC address |
MAC address of the access user. |
|
Access interface |
Access interface of the access user. |
|
Service VLAN |
Outer VLAN ID of the access user. |
|
Customer VLAN |
Inner VLAN ID of the access user. |
|
Tunnel ID |
L2TP tunnel ID of the access user. |
|
Username |
Username of the access user. |
|
IP address |
IP address of the access user. |
|
Access mode |
Access mode of the service tracing object. |
Detailed information of traced objects
1. PPPoE
Table 14 Detailed information of traced objects (PPPoE)
|
Field |
Description |
|
Received a PADI packet |
The PPPoE sever received a PADI packet from the PPPoE client. |
|
Sent a PADO packet |
The PPPoE sever sent a PADO packet to the PPPoE client. |
|
Received a PADR packet |
The PPPoE sever received a PADR packet from the PPPoE client. |
|
Established a PPPoE session successfully. Notified PPP to create session (session ID=sessionid) |
A PPPoE session was successfully established. UCM notified PPP to create the session with the specified session ID. |
|
Sent a PADS packet |
The PPPoE sever sent a PADS packet to the PPPoE client. |
|
Established a PPPoE session successfully. Notified PPP to start session negotiation (session ID=sessionid) |
A PPPoE session was successfully established. UCM notified PPP to start session negotiation with the specified session ID. |
|
Received a PADT packet |
The PPPoE sever received a PADT packet from the PPPoE client or the PPPoE agency received a PADT packet from the PPPoE server. |
|
Deleted the PPPoE session successfully. |
The PPPoE session was successfully deleted. |
|
Sent a PADT packet |
The PPPoE sever sent a PADT packet to the PPPoE client or the PPPoE agency sent a PADT packet to the PPPoE server. |
|
Sent a PADI packet |
The PPPoE agency sent a PADI packet to the PPPoE server. |
|
Received a PADO packet |
The PPPoE agency received a PADO packet from the PPPoE server. |
|
Sent a PADR packet |
The PPPoE agency sent a PADR packet to the PPPoE server. |
|
Received a PADS packet |
The PPPoE agency received a PADS packet from the PPPoE server. |
|
Deleted the PPPoEA session successfully. |
The PPPoEA session was successfully deleted. |
2. L2TP
Table 15 Detailed information of traced objects (L2TP)
|
Field |
Description |
|
PPP notified LAC up and L2TP started a tunnel establishment process |
PPP notified the LAC up event, and the LAC started L2TP tunnel negotiation. |
|
PPP notified LAC up and L2TP started establishing a session within a middle state L2TP tunnel |
PPP notified the LAC up event, and the LAC started L2TP session negotiation in an L2TP tunnel in a middle state. |
|
PPP notified LAC up and L2TP started establishing a session within an L2TP tunnel |
PPP notified the LAC up event, and the LAC started L2TP session negotiation in an established L2TP tunnel. |
|
Sent an ICRQ packet to LNS, TunnelID=tunnelid, SessionID=sessionid |
The LAC sent an ICRQ to the LNS. The parameters are as follows: · TunnelID—L2TP tunnel ID. · SessionID—L2TP session ID. |
|
Received an ICRP packet, TunnelID=tunnelid, SessionID=sessionid |
The LAC received an ICRP packet. The parameters are as follows: · TunnelID—L2TP tunnel ID. · SessionID—L2TP session ID. |
|
Sent an ICCN packet to LNS, TunnelID=tunnelid, SessionID=sessionid |
The LAC sent an ICCN packet to the LNS. The parameters are as follows: · TunnelID—L2TP tunnel ID. · SessionID—L2TP session ID. |
|
Received an ICCN packet and processed successfully, TunnelID=tunnelid, SessionID=sessionid |
The LNS received an ICCN packet and successfully processed the packet. The parameters are as follows: · TunnelID—L2TP tunnel ID. · SessionID—L2TP session ID. |
|
Received an invalid ICCN packet and failed to process it, TunnelID=tunnelid, SessionID=sessionid |
The LNS received an ICCN packet and failed to process the packet. The parameters are as follows: · TunnelID—L2TP tunnel ID. · SessionID—L2TP session ID. |
|
Received an ICCN packet but failed to allocate resources, TunnelID=tunnelid, SessionID=sessionid |
The LNS received an ICCN packet, and failed to process the packet due to insufficient resources. The parameters are as follows: · TunnelID—L2TP tunnel ID. · SessionID—L2TP session ID. |
|
Received an ICCN packet but failed to process it, TunnelID=tunnelid, SessionID=sessionid |
The LNS received an ICCN packet but failed to process the packet. The parameters are as follows: · TunnelID—L2TP tunnel ID. · SessionID—L2TP session ID. |
|
An L2TP session on LAC was going offline, TunnelID=tunnelid, SessionID=sessionid |
An L2TP session on the LAC was going offline. The parameters are as follows: · TunnelID—L2TP tunnel ID. · SessionID—L2TP session ID. |
|
An L2TP session on LNS was going offline, TunnelID=tunnelid, SessionID=sessionid |
An L2TP session on the LNS was going offline. The parameters are as follows: · TunnelID—L2TP tunnel ID. · SessionID—L2TP session ID. |
|
Sent a CDN packet to the peer, TunnelID=tunnelid, SessionID=sessionid |
The local end sent a CDN packet to the peer. The parameters are as follows: · TunnelID—L2TP tunnel ID. · SessionID—L2TP session ID. |
|
Received a CDN packet, TunnelID=tunnelid, SessionID=sessionid |
The local end received a CDN packet to the peer. |
|
Deleted an L2TP session, TunnelID=tunnelid, SessionID=sessionid |
A local L2TP session was deleted. The parameters are as follows: · TunnelID—L2TP tunnel ID. · SessionID—L2TP session ID. |
3. PPP
Table 16 Detailed information of traced objects (PPP)
|
Field |
Description |
|
Received interface up event |
PPP received interface up event. |
|
LCP FSM open event |
The PPP LCP state machine was opened. |
|
Determined negotiation parameters during LCP initialization |
PPP determined negotiation parameters during LCP initialization. |
|
LCP FSM up event |
The PPP LCP state machine came up. |
|
Sent an LCP Configuration Request packet |
PPP sent an LCP Configure-Request packet. |
|
Received an LCP negotiation packet or Echo keepalive packet |
PPP received an LCP negotiation packet or Echo keepalive packet. |
|
Received an LCP Configuration Request packet |
PPP received an LCP Configure-Request packet. |
|
Sent an LCP Configuration Ack packet |
PPP sent an LCP Configure-Ack packet. |
|
Received an LCP Configuration Ack packet |
PPP received an LCP Configure-Ack packet. |
|
LCP up event |
PPP LCP negotiation succeeded. |
|
LCP FSM down event |
The PPP LCP state machine went down. |
|
LCP down event |
PPP received an LCP down event. |
|
LCP FSM close event |
The PPP LCP state machine was closed. |
|
Started authentication after LCP negotiation succeeded |
PPP LCP negotiation succeeded and entered the authentication phase. |
|
Sent a CHAP Challenge packet |
PPP sent a Challenge packet in the PPP CHAP authentication phase. |
|
Received a CHAP authentication packet in authentication phase |
PPP received a CHAP authentication packet in the authentication phase. |
|
Received a CHAP Request packet |
PPP received a CHAP request packet. |
|
Sent an authentication request to UCM |
PPP sent an authentication request to UCM for authentication. |
|
Received a CHAP authentication success message from AAA |
PPP received a CHAP authentication success message from AAA. |
|
Sent a CHAP Ack packet |
PPP sent a CHAP ACK packet to the client. |
|
CHAP authentication succeeded |
PPP CHAP authentication succeeded. |
|
Received a CHAP authentication failure message from AAA |
PPP received a CHAP authentication failure message from AAA. |
|
Sent a CHAP Nak packet |
PPP sent a CHAP NAK packet to the client. |
|
Received a PAP authentication packet in authentication phase |
PPP received a PAP authentication packet in the authentication phase. |
|
Received a PAP Request packet |
PPP received a PAP request packet. |
|
Received a PAP authentication success message from AAA |
PPP received a PAP authentication success message from AAA. |
|
Sent a PAP Ack packet |
PPP sent a PAP ACK packet to the client. |
|
PAP authentication succeeded |
PPP PAP authentication succeeded |
|
PAP authentication failed |
PPP PAP authentication failed |
|
Received a PAP authentication failure message from AAA |
PPP received a PAP authentication failure message from AAA. |
|
Sent a PAP Nak packet |
PPP sent a PAP NAK packet to the client. |
|
Received an LCP Termination Request packet |
PPP received an LCP termination request packet. |
|
Sent an LCP Termination Ack packet |
PPP sent an LCP termination ACK packet. |
|
Started NCP negotiation |
PPP entered the NCP negotiation phase. |
|
IPCP FSM open event |
The PPP IPCP state machine is opened. |
|
Determined negotiation parameters during IPCP initialization |
The IPCP negotiation parameters are initialized. |
|
IPCP FSM up event |
The PPP IPCP state machine is up. |
|
Sent an IPCP Configuration Request packet |
PPP sent an IPCP configuration request packet. |
|
Received an IPCP negotiation packet in IPCP negotiation phase |
PPP received an IPCP negotiation packet in IPCP negotiation phase. |
|
Received an IPCP Configuration Request packet |
PPP received an IPCP configuration request packet. |
|
Received an IPCP Configuration Ack packet |
PPP received an IPCP configuration ACK packet. |
|
Sent an IPCP Configuration Nak packet |
PPP sent an IPCP configuration NAK packet. |
|
Sent an IPCP Configuration Ack packet |
PPP sent an IPCP configuration ACK packet. |
|
IPCP negotiation succeeded |
PPP IPCP negotiation succeeded. |
|
Sent an LCP Echo Request packet |
PPP sent an LCP echo request packet. |
|
Received an LCP Echo Reply packet |
PPP received an LCP echo reply packet. |
|
Received interface down event |
PPP received interface down event. |
|
IPCP FSM down event |
The PPP IPCP state machine went down. |
|
IPCP down event |
PPP received an IPCP down event. |
|
IPCP FSM close event |
The PPP IPCP state machine was closed. |
|
Notify NCP down |
LCP notified the upper layer protocol of the NCP down event. |
|
PPP L2TP prenego started |
PPP L2TP prenegotiation started. |
|
PPP L2TP prenego finished |
PPP L2TP prenegotiation ended. |
|
Mandatory-lcp, LCP renego started |
LCP renegotiation was mandatory, and LCP renegotiation started. |
|
Mandatory-chap, CHAP renego started |
CHAP authentication was mandatory, and CHAP authentication started. |
|
L2TP mandatory-chap needed the authentication mode of CHAP on VT |
Mandatory CHAP authentication was configured, but CHAP authentication was not configured on the VT interface. |
|
LCP prenego for L2TP failed |
LCP prenegotiation failed. |
|
PPP L2TP prenego CHAP started |
CHAP authentication prenegotiation started. |
|
PPP L2TP prenego CHAP finished |
CHAP authentication prenegotiation ended. |
|
PPP L2TP prenego PAP started |
PAP authentication prenegotiation started. |
|
PPP L2TP prenego PAP finished |
PAP authentication prenegotiation ended. |
|
PPP L2TP prenego MSCHAP started |
MSCHAP authentication prenegotiation started. |
|
PPP L2TP prenego MSCHAP finished |
MSCHAP authentication prenegotiation ended. |
|
PPP L2TP prenego authentication failed |
PPP L2TP authentication prenegotiation failed. |
|
Received an LCP Configuration Nak packet |
PPP received an LCP configuration NAK packet. |
|
Sent an LCP Configuration Nak packet |
PPP sent an LCP configuration NAK packet. |
|
Received an LCP Configuration Reject packet |
PPP received an LCP configuration reject packet. |
|
Sent an LCP Configuration Reject packet |
PPP sent an LCP configuration reject packet. |
|
Received an LCP Termination Ack packet |
PPP received an LCP termination ACK packet. |
|
Sent an LCP Termination Request packet |
PPP sent an LCP termination request packet. |
|
Received an LCP Code Reject packet |
PPP received an LCP code reject packet. |
|
Sent an LCP Code Reject packet |
PPP sent an LCP code reject packet. |
|
Received an LCP Protocol Reject packet |
PPP received an LCP protocol reject packet. |
|
Sent an LCP Protocol Reject packet |
PPP sent an LCP protocol reject packet. |
|
Received an LCP Echo Request packet |
PPP received an LCP echo request packet. |
|
Sent an LCP Echo Reply packet |
PPP sent an LCP echo reply packet. |
|
Received an LCP Identification packet |
PPP received an LCP identification packet. |
|
Sent an LCP Identific packet |
PPP sent an LCP identification packet. |
|
Received an IPCP Configuration Nak packet |
PPP received an IPCP configuration NAK packet. |
|
Sent an IPCP Configuration Reject packet |
PPP sent a IPCP configuration reject packet. |
|
Received an IPCP Configuration Reject packet |
PPP received a IPCP configuration reject packet. |
|
Sent an IPCP Termination Request packet |
PPP sent a IPCP termination request packet. |
|
Received an IPCP Termination Request packet |
PPP received a IPCP termination request packet. |
|
Sent an IPCP Termination Ack packet |
PPP sent a IPCP termination ACK packet. |
|
Received an IPCP Termination Ack packet |
PPP received a IPCP termination ACK packet. |
|
Sent an IPCP Code Reject packet |
PPP sent a IPCP code reject packet. |
|
Received an IPCP Code Reject packet |
PPP received a IPCP code reject packet. |
|
Sent a CHAP Request packet |
PPP sent a CHAP request packet. |
|
Received a CHAP Challenge packet |
PPP received a CHAP challenge packet. |
|
Received a CHAP Ack packet |
PPP received a CHAP ACK packet. |
|
Received a CHAP Nak packet |
PPP received a CHAP NAK packet. |
|
Sent a MS-CHAP-V2 CHGPWD packet |
PPP sent an MS-CHAP-V2 change password packet. |
|
Received a PAP Ack packet |
PPP received a PAP ACK packet. |
|
Received a PAP Nak packet |
PPP received a PAP NAK packet. |
|
Sent a PAP Request packet |
PPP sent a PAP request packet. |
|
Authentication failed |
Authentication failed. |
|
Authentication succeeded |
Authentication succeeded. |
|
CHAP authentication failed |
CHAP authentication failed. |
|
Received an authentication failure message from UCM |
PPP received an authentication failure message from UCM. |
|
Received an authentication success message from UCM |
Received an authentication success message from UCM. |
|
Sent a conn request to UCM |
PPP sent a connection request to UCM. |
|
Sent a conn-down request to UCM |
PPP sent a connection-down request to UCM. |
|
Sent a conn-up request to UCM |
PPP sent a connection-up request to UCM. |
|
Sent an MP bundle request to UCM |
PPP sent an MP bundle request to UCM. |
|
Sent an offline request to UCM |
PPP sent an offline request to UCM. |
4. IPoE
Table 17 Detailed information of traced objects (IPoE)
|
Field |
Description |
|
Received an IP packet, VPN=vpn |
IPoE received a n user IP packet. The VPN indicates the VPN instance to which the user belongs. If the user is in a public network, the VPN field is not displayed. |
|
Sent a packet to UCM for authentication, VPN=vpn |
IPoE sent a packet to UCM for authentication. The VPN indicates the VPN instance to which the user belongs. If the user is in a public network, the VPN field is not displayed. |
|
Received a Reject message from UCM, VPN=vpn |
IPoE received a reject message from UCM. The VPN indicates the VPN instance to which the user belongs. If the user is in a public network, the VPN field is not displayed. |
5. Portal
Table 18 Detailed information of traced objects (Portal)
|
Field |
Description |
|
Sent logon request to UCM |
Portal sent a logon request to UCM. |
|
Received logon success message from UCM |
Portal received a logon success message from UCM. |
|
Received logon failure message from UCM |
Portal received a logon failure message from UCM. |
|
Sent logoff request to UCM |
Portal sent a logoff request to UCM. |
|
Received logoff response from UCM |
Portal received a logoff response from UCM. |
|
Received forced-logoff message from UCM |
Portal received a forced-logoff message from UCM. |
|
Received message for user information transparent transmission from UCM |
Portal received a message for user information transparent transmission from UCM. |
|
Received MAC binding query request from IPoE |
Portal received a MAC binding query request from IPoE. |
|
Sent MAC binding query response to IPoE |
Portal sent a MAC binding query response to IPoE. |
|
Received MAC-trigger user online message from UCM |
Portal received a MAC-trigger user online message from UCM. |
|
Received MAC-trigger user offline message from UCM. |
Portal received a MAC-trigger user offline message from UCM. |
|
Received user roaming message from UCM |
Portal received a user roaming message from UCM. |
|
Received authentication-continue message from UCM |
Portal received an authentication-continue message from UCM. |
|
Received packet from portal server newpt |
UCM received a packet from the portal server newpt. |
|
Sent packet to portal server newpt |
UCM sent a packet to the portal server newpt. |
|
Ver |
Portal protocol packet version number: · 1.0. · 2.0. · 3.0. |
|
Type |
Portal protocol packet type: · REQ_CHALLENGE · ACK_CHALLENGE · REQ_AUTH · ACK_AUTH · REQ_LOGOUT · ACK_LOGOUT · AFF_ACK_AUTH · NTF_LOGOUT · REQ_INFO · ACK_INFO · NTF_USER_DISCOVER · NTF_USER_IP_CHANGE · AFF_NTF_USER_IP_CHANGE · ACK_NTF_LOGOUT · NTF_HEART · NTF_USER_HEART · ACK_NTF_USER_HEART · NTF_CHALLENGE · NTF_USER_NOTIFY · AFF_NTF_USER_NOTIFY · REQ_MACBIND_INFO · ACK_MACBIND_INFO · NTF_USER_LOGON · NTF_USER_LOGOUT · REQ_USER_OFFLINE · UNKNOWN |
|
Method |
Portal authentication method: · EAP. · CHAP. · PAP. |
|
SerialNo |
Portal packet sequence number. |
|
ReqID |
Portal packet request ID. |
|
UserIP |
Portal user IP address. |
|
ErrCode |
Error code. |
|
AttrNum |
Number of attributes carried in the portal packet. |
6. UCM
Table 19 Detailed information of traced objects (UCM)
|
Field |
Description |
|
Failed to send msgtype. |
UCM failed to send message of the msgtype type to PAM. Possible msgtype values include: · UCM_UIA_PAM_MSG_COA—Change of Authorization (COA) messages, which are used to change the user's authorization information. · UCM_UIA_PAM_MSG_DM—Disconnect messages (DM), which are used to log out users. |
|
UserID: userid, VASID: vasid, Received AAA reply (MsgType: msgtype) |
UCM received a reply from AAA. The parameters are as follows: · UserID—User ID. · VASID—Value-added service ID (ITA service accounting level or EDSG service ID) · MsgType—Message type. Possible values include: ¡ AUTH_REQ_ACK. ¡ AUTH_REQ_REJ. ¡ AUTH_REQ_CONTINUE. ¡ AUTHOR_REQ_ACK. ¡ AUTHOR_REQ_REJ. ¡ ACCT_START_ACK. ¡ ACCT_START_REJ. ¡ ACCT_START_BROADCAST_ACK. ¡ ACCT_UPDATE_ACK. ¡ ACCT_UPDATE_REJ. ¡ ACCT_UPDATE_BROADCAST_ACK. ¡ ACCT_STOP_ACK. ¡ ACCT_STOP_REJ. ¡ ACCT_STOP_BROADCAST_ACK. ¡ DM_REQ. ¡ COA_REQ. ¡ DOMAIN_CUT. ¡ GET_DATA. |
|
UserID: userid, Sent account start request to AAA |
UCM sent an accounting start request to AAA. |
|
UserID: userid, Sent account update request to AAA |
UCM sent an accounting update request to AAA. |
|
UserID: userid, ConnectID: connectid, Received msgname from accessname. |
UCM received a message named msgname from access method accessname. The parameters are as follows: · UserID—User ID. · ConnectID—UCM connection type ID. Possible values include: ¡ 0—Auto-dialed L2TP connection on a LAC or L2TP connection on an LNS. ¡ 1—DHCP, IPoE, or ARP connection. ¡ 2—DHCPv6, IPoEv6, or ND connection. ¡ 3—PPP, IP6CP, or ND connection. · accessname—Access method name. Possible values include: ¡ PPP—PPP access. ¡ IPOE4—IPv4 IPoE access. ¡ DHCP4—DHCPv4 access. ¡ IPOE6—IPv6 IPoE access. ¡ DHCP6—DHCPv6 access. ¡ ARP—ARP access. ¡ NDRS—NDRS access. ¡ NDNS—NDNS access. ¡ IPOEWEB—IPoE Web access. ¡ L2IFLEASE—Layer 2 IPoE interface-leased access. ¡ L3IFLEASE—Layer 3 IPoE interface-leased access. ¡ L3SUBLEASE—Layer 3 IPoE subnet-leased access. ¡ L2VPNLEASE—IPoE L2VPN-leased access. ¡ PAM—PAM access. ¡ DOT1X—802.1X access. · msgname—Message name. Possible values include: ¡ UCM_UIA_PPP_MSG_AUTH_REQ—PPP authentication request. ¡ UCM_UIA_PPP_MSG_CONN_REQ—PPP connection request. ¡ UCM_UIA_PPP_MSG_CONN-UP_REQ—PPP connection-up request. ¡ UCM_UIA_PPP_MSG_CONN-DOWN_REQ—PPP connection-down request. ¡ UCM_UIA_PPP_MSG_OFFLINE_REQ—PPP offline request. ¡ UCM_UIA_PPP_MSG_OFFLINE_INF—PPP offline information. ¡ UCM_UIA_IPOEIP4_MSG_CONN_REQ—IPv4 IPoE connection request. ¡ UCM_UIA_IPOEIP6_MSG_CONN_REQ—IPv6 IPoE connection request. ¡ UCM_UIA_IPOEIP6_MGG_CONN_MODIFYUSR_NTF—IPv6 IPoE username modification notification. ¡ UCM_UIA_DHCP_MSG_CONN_REQ—DHCPv4 connection request. ¡ UCM_UIA_DHCP_MSG_CONN-UP_REQ—DHCPv4 connection-up request. ¡ UCM_UIA_DHCP_MSG_RENEW_REQ—DHCPv4 renewal request. ¡ UCM_UIA_DHCP_MSG_CONN-DOWN_REQ—DHCPv4 connection-down request. ¡ UCM_UIA_DHCP_MSG_DISCONN_INF—DHCPv4 disconnection information ¡ UCM_UIA_DHCP6_MSG_CONN_REQ—DHCPv6 connection request ¡ UCM_UIA_DHCP6_MSG_CONN-UP_REQ—DHCPv6 connection-up request ¡ UCM_UIA_DHCP6_MSG_RENEW_REQ—DHCPv6 connection renewal request. ¡ UCM_UIA_DHCP6_MSG_CONN-DOWN_REQ—DHCPv6 connection-down request. ¡ UCM_UIA_DHCP6_MSG_DISCONN_INF—DHCPv6 disconnection information ¡ UCM_UIA_ARP_MSG_CONN_REQ—ARP connection request ¡ UCM_UIA_ARP_MSG_CONN-UP_REQ—ARP connection-up request ¡ UCM_UIA_ARP_MSG_DTC_TIMEOUT—ARP detection timeout. ¡ UCM_UIA_NDRS_MSG_CONN_REQ—NDRS connection request ¡ UCM_UIA_NDRS_MSG_CONN-UP_REQ—NDRS connection-up request ¡ UCM_UIA_NDRS_MSG_MODIFYUSRIP_REQ—NDRS user IP modification request. ¡ UCM_UIA_NDNSNA_MSG_CONN_REQ—NDNS connection request ¡ UCM_UIA_NDNSNA_MSG_CONN-UP_REQ—NDNS connection-up request ¡ UCM_UIA_ND_MSG_DTC_TIMEOUT—NDNS detection timeout ¡ UCM_UIA_PORTAL_MSG_AUTH_REQ—IPoE Web authentication request. ¡ UCM_UIA_PORTAL_MSG_AUTH_REQ_CONTINUE—IPoE Web continuous authentication request ¡ UCM_UIA_PORTAL_MSG_DISCONN_REQ—IPoE Web authentication disconnection request ¡ UCM_UIA_PORTAL_MSG_DISCONN_INF—IPoE Web authentication disconnection information ¡ UCM_UIA_PORTAL_MSG_SERVERINFO—IPoE Web authentication server information. ¡ UCM_UIA_PORTAL_MSG_ROAM—IPoE Web user roaming. ¡ UCM_UIA_PORTAL_MSG_MT_ONLINE—IPoE Web user online information. ¡ UCM_UIA_PORTAL_MSG_MT_OFFLINE—IPoE Web user offline information. ¡ UCM_UIA_LEASE_MSG_CONN_REQ—IPoE leased connection request ¡ UCM_UIA_LEASE_MSG_CONN-UP_REQ—IPoE leased connection-up request ¡ UCM_UIA_LEASE_MSG_CONDOWN_REQ—IPoE leased connection-down request ¡ UCM_UIA_PAM_MSG_AUTH_REQ—PAM authentication request ¡ UCM_UIA_PAM_MSG_ACCT_START_REQ—PAM accounting start request. ¡ UCM_UIA_PAM_MSG_ACCT_UPDATE_REQ—PAM accounting update request. ¡ UCM_UIA_PAM_MSG_ACCT_STOP_REQ—PAM accounting stop request. ¡ UCM_UIA_PAM_MSG_USER_DELETE—PAM user deletion. ¡ UCM_UIA_PAM_MSG_USER_RECOVER—PAM user recovery. ¡ UCM_UIA_PAM_MSG_GETDATA_ACK—PAM data getting ACK. ¡ UCM_UIA_PAM_MSG_SMOOTH_USERDELETE—PAM user deletion sync. ¡ UCM_UIA_DOT1X_MSG_AUTH_REQ—802.1X authentication request. ¡ UCM_UIA_DOT1X_MSG_AFF_ACK_AUTH—802.1X reauthentication request. ¡ UCM_UIA_DOT1X_MSG_DISCONN_REQ—802.1X disconnection request. ¡ UCM_UIA_DOT1X_MSG_PRIORITY_AUTH_REJ—802.1X-authentication-first rejection. ¡ UCM_UIA_DOT1X_MSG_SMOOTH_USERDELETE—802.1X user deletion sync. |
|
[Adapt State]UserID: userid, ConnectID: connectid, Received event event, current state is state. |
Adapter state machine received an event of the even type, and the current state is state. The parameters are as follows: · UserID—User ID. · ConnectID—UCM connection type ID. Possible values include: ¡ 0—Auto-dialed L2TP connection on a LAC or L2TP connection on an LNS. ¡ 1—DHCP, IPoE, or ARP connection. ¡ 2—DHCPv6, IPoEv6, or ND connection. ¡ 3—PPP, IP6CP, or ND connection. · event—Adapter state machine event. Possible values include: ¡ ADD—Add. ¡ MODIFY—Modify information. ¡ DEL—Delete. ¡ TRAFFIC_DELCOMPLETE—Traffic deletion completed. ¡ PROXY_DELCOMPLETE—Issuing to the interface module for deletion completed. ¡ FWD-DELCOMPLETE—Issuing to the kernel for deletion completed. ¡ FWD-SUCC—Successfully issued to the kernel. ¡ FWD-FAIL—Failed to be issued to the kernel. ¡ PROXY-SUCC—Successfully issued to the interface module. ¡ PROXY-FAIL—Failed to be issued to the interface module. · state—Current state. Possible values include: ¡ INIT—Initial. ¡ FWD—Issued to the kernel. ¡ FWD-MODIFY—Issued to the kernel for modifying information. ¡ PROXY—Issued to the interface module and backup interface module. ¡ PROXY-MODIFY—Issued to the interface module for modifying information. ¡ ADDED—Successfully added. ¡ DELETING—Deleting. |
|
[Adapt State]UserID: userid, ConnectID: connectid, Received event event, State changed from oldstate to newstate |
Adapter state machine received an event of the event type, and the state changed from oldstate to newstate. The parameters are as follows: · UserID—User ID. · ConnectID—UCM connection type ID. For values, see the ConnectionID in the preceding message. · event—Adapter state machine event. For values, see the event field in the preceding message. · oldstate—State before the switching. For values, see the state field in the preceding message. · newstate—State after the switching. For values, see the state field in the preceding message. |
|
[Conn state]UserID: userid, ConnectID: connectid, Received event event, Current state is state. |
The connection state machine received an event of the event type, and the current state is state. The parameters are as follows: · UserID—User ID. · ConnectID—UCM connection type ID. Possible values include: ¡ 0—Auto-dialed L2TP connection on a LAC or L2TP connection on an LNS. ¡ 1—DHCP, IPoE, or ARP connection. ¡ 2—DHCPv6, IPoEv6, or ND connection. ¡ 3—PPP, IP6CP, or ND connection. · event—Connection state machine event. Possible values include: ¡ USER-AUTH-PASSED—The user passed authentication. ¡ CONNREQ-PASSED—The connection request passed. ¡ ADDR-REQ-ACK—The address request passed. ¡ CONN-UP-WITH-NAT—Connection-up with the NAT event. ¡ CONN-UP-WITHOUT-NAT—Connection-up without the NAT event. ¡ NAT-REQ-ACK—The NAT request passed. ¡ USER-ADD-ACK—The user adding request passed. ¡ USER-DEL-ACK—The user deletion request passed. ¡ CLOSE—The connection is closed. ¡ DOWN —The connection is down. ¡ EXTRA-CONNREQ—Extra connection request ¡ EXTRA-CONN-UP—Extra connection-up request ¡ RENEW—Connection renewal information (for example, leases). · state—Current state. Possible values include: ¡ INIT—Initialization. ¡ ADDR-REQ-SENT—Address request sent. ¡ AUTHED—Authenticated. ¡ NAT-REQ-SENT—NAT request sent. ¡ USER-ADDING—Adding users. ¡ OPEN—Connection established. ¡ DELETING—Deleting. ¡ DELETED—Deleted. |
|
[Conn State]UserID: userid, Received event event, State changed from oldstate to newstate. |
Connection state machine received an event of the event type, and the state changed from oldstate to newstate. The parameters are as follows: · UserID—User ID. · event—Connection state machine event. For values, see the event field in the preceding message. · oldstate—State before the switching. For values, see the state field in the preceding message. · newstate—State after the switching. For values, see the state field in the preceding message. |
|
[LOGOUT State]UserID: userid, Received event event, Current state is state. |
Logout state machine received an event of the event type, and the current state is state. The parameters are as follows: · UserID—User ID. · event—Logout state machine event. Possible values include: ¡ AUTHREQ—Authentication requested. ¡ AUTHSUCC—Authentication succeeded. ¡ USER_MODIFYACK—User modification succeeded. · state—Current state. Possible values include: ¡ INIT—Initialization. ¡ AUTHING—Authenticating. ¡ USER_UPDATE—User updated. |
|
[LOGOUT State]UserID: userid, Received event event, State changed from oldstate to newstate. |
Logout state machine received an event of the event type, and the state changed from oldstate to newstate. The parameters are as follows: · UserID—User ID. · event—Logout state machine event. For values, see the event field in the preceding message. · oldstate—State before the switching. For values, see the state field in the preceding message. · newstate—State after the switching. For values, see the state field in the preceding message. |
|
[Reauth State]UserID: userid, Received event event, Current state is state. |
Reauthentication state machine received an event of the event type, and the current state is state. The parameters are as follows: · UserID—User ID. · event—Reauthentication state machine event. Possible values include: ¡ AUTHREQ—Authentication requested. ¡ AUTHSUCC—Authentication succeeded. ¡ AUTHCONTINUE—The user authentication continues. ¡ AUTH-FAIL—Authentication failed. ¡ USER_MODIFYACK—User service parameters modified. ¡ USER_MODIFYREJ—User service parameter modification rejected. ¡ WEB_AUTHACK_RESP—Web authentication ACK replied. ¡ MACAUTH_ACK—MAC authentication succeeded. ¡ DOWN—UCM received a disconnection request. · state—Current state. Possible values include: ¡ INIT—Initialization. ¡ AUTHING—Authenticating. ¡ USER_UPDATE—User data updated. ¡ WAIT_WEBRESP_ACK—Waiting for ACK from Web ¡ WAIT_MACAUTH_ACK—Waiting for ACK from MAC authentication |
|
[Reauth State]UserID: userid, Received event event, State changed from oldstate to newstate. |
Reauthentication state machine received an event of the event type, and the state changed from oldstate to newstate. The parameters are as follows: · UserID—User ID. · event—Reauthentication state machine event. For values, see the event field in the preceding message. · oldstate—State before the switching. For values, see the state field in the preceding message. · newstate—State after the switching. For values, see the state field in the preceding message. |
|
[Shell Phase]UserID: userid, ConnectID: connectid, Received event event, Current phase is phase. |
Shell state machine received an event of the event type, and the current state is phase. The parameters are as follows: · UserID—User ID. · ConnectID—UCM connection type ID. Possible values include: ¡ 0—Auto-dialed L2TP connection on a LAC or L2TP connection on an LNS. ¡ 1—DHCP, IPoE, or ARP connection. ¡ 2—DHCPv6, IPoEv6, or ND connection. ¡ 3—PPP, IP6CP, or ND connection. · event—Shell state machine event. Possible values include: ¡ AUTH-REQ—Authentication request. ¡ CONN-REQ—UCM received a connection request. ¡ CONN-UP—Connection-up request. ¡ CONN-DOWN—Connection-down request. ¡ RENEW-REQ—Connection renewal request (for example, lease) ¡ MODIFY-USERIP—User IP modification. ¡ DISCONN-REQ—Disconnection request. ¡ MPBIND-REQ—MP bundling request. ¡ ACCT-START-REQ—Accounting start request. ¡ ACCT-UPDATE-REQ—Accounting update request. ¡ ACCT-STOP-REQ—Accounting stop request. ¡ RECOVER-REQ—Recovery request. ¡ GETDATA-ACK—Processing GetData ACK. ¡ WEB-AUTHREQ—Web authentication request ¡ WEB-AUTHACK-RESPONSE—Web authentication ACK response. ¡ DOWN-REQ—Down request. ¡ STOP-MT—Stop MAC transparent authentication. ¡ MAC-AUTH—MAC authentication. ¡ TERMINATE—User termination. ¡ GROUPID-CHG—Group ID change. ¡ AUTH-SUCC—Authentication success. ¡ AUTH-FAIL—Authentication failure. ¡ AUTH-CONTINUE—User authentication continued. ¡ ACC-START-SUCC—Accounting start succeeded. ¡ ACC-START-FAIL—Accounting start failed. ¡ ACC-UPDATE-SUCC—Accounting update succeeded. ¡ ACC-STOP-FAIL—Accounting stop failed. ¡ ACCESS-MSG-PASS—Access message passed. ¡ MPBIND-SUCCESS—MP bundling succeeded. ¡ MPBIND-FAILURE—MP binding failed. ¡ PAM-AUTH-SUCC—PAM authentication succeeded. ¡ PAM-AUTH-FAIL—PAM authentication failed. ¡ PAM-AUTH-CONTINUE—PAM authentication continued. ¡ PAM-ACCT-START-SUCC—PAM accounting start succeeded. ¡ PAM-ACCT-START-FAIL—PAM accounting start failed. ¡ PAM-ACCT-UPDATE-SUCC—PAM accounting update succeeded. ¡ PAM-ACCT-UPDATE-FAIL—PAM accounting update failed. ¡ PAM-ACCT-STOP-SUCC—PAM accounting stop succeeded. ¡ PAM-ACCT-STOP-FAIL—PAM accounting stop failed. ¡ COA—Authentication information changed. ¡ MODIFY-ACK—Modification succeeded. ¡ NEGSLOTCHG—User negotiation slot changed. ¡ TERMINATE—User termination. ¡ ADDRREQ-ACK—Address request succeeded. ¡ ADDRREQ-REJ—Address request failed. ¡ NATREQ-ACK—NAT event request succeeded. ¡ NATREQ-REJ—NAT event request failed. ¡ FWD-SYNC-SUCC—Forwarding entry adding succeeded. ¡ FWD-SYNC-FAIL—Forwarding entry adding failed. ¡ PROXY-SYNC-SUCC—Notifying the interface module to add forwarding entries succeeded. ¡ PROXY-SYNC-FAIL—Notifying the interface module to add forwarding entries failed. ¡ FWD-SYNC-DELCOMPLETE—Deleting users in the kernel completed. ¡ PROXY-SYNC-DELCOMPLETE—Deleting users on the interface module completed. ¡ AUTH-PASS—Authentication passed. ¡ ADAPT-ADD-ACK—Adding users succeeded. ¡ ADAPT-ADD-REJ—Adding users rejected. ¡ ADAPT-MODIFY-ACK—User modification succeeded. ¡ ADAPT-MODIFY-REJ—User modification rejected. ¡ UP—A user came online. ¡ ADAPT-DEL-ACK—A user was successfully deleted. ¡ DEL-COMPLETE—Deletion completed. ¡ REAUTH-AUTH-PASS—Reauthentication passed. ¡ REAUTH-AUTH-CONTINUE—Reauthentication continued. ¡ REAUTH-AUTH-FAIL—Reauthentication failed. ¡ REAUTH-MACAUTH-SUCC—Reauthentication succeeded. ¡ REAUTH-COMPLETE—Reauthentication completed. ¡ REAUTH-DOWN—Reauthentication stopped. ¡ WEB-CLOSE—Web disconnection request. ¡ LOGOUT-AUTH-PASS—An IPoE Web user returned to the preauthentication phase from the Web authentication phase, and the authentication succeeded. ¡ LOGOUT-COMPLETE—An IPoE Web user successfully came online in the Web authentication phase. ¡ USER-MODIFY-ACK—User modification succeeded. ¡ OPEN—Connection completed. · phase—Current phase. Possible values include: ¡ INITIAL—Initialization phase. ¡ AUTHENTICATION—Authentication phase. AAA sent an authentication request but received no reply. ¡ AUTHED—Authenticated phase. An authentication success reply was received from AAA. ¡ NETWORK—Network negotiation phase. An IP address has been requested and starts to be issued to the kernel, interface module, and backup interface module. ¡ ONLINE—The user successfully came online. ¡ TERMINATE—The user went offline. ¡ REAUTH—Reauthentication phase. An IPoE web user performed authentication in the Web authentication phase. ¡ LOGOUT—Logout phase. An (IPoE web user returned back to the preauthentication phase from the web authentication phase. ¡ PRE_AUTHENTICATION—802.1X user authentication phase. ¡ PRE_AUTHED—802.1X user authentication completed phase. |
|
[Shell Phase]UserID: userid, ConnectID: connectid, Received event event, Phase changed from oldphase to newphase. |
The shell state machine received an event of the event type, and the state changed from oldphase to newphase. The parameters are as follows: · UserID—User ID. · ConnectID—UCM connection type ID. For values, see the ConnectionID in the preceding message. · event—Shell state machine event. For values, see the event field in the preceding message. · oldphase—State before the switching. For values, see the state field in the preceding message. · newphase—State after the switching. For values, see the state field in the preceding message. |
|
[User State]UserID: userid, Received event event, Current state is state. |
The user state machine received an event of the event type and the current state is state. The parameters are as follows: · UserID—User ID. · event—User state machine event. Possible values include: ¡ AUTHREQ—UCM received an access authentication request ¡ AUTHSUCC—UCM received a AAA authentication success event. ¡ AUTHSUCC-ADMIN—Management user authentication succeeded. ¡ AUTH-FAIL—UCM received an AAA authentication failure event. ¡ AUTH-CONTINUE—UCM received an AAA user authentication continual event. ¡ CONNREQ—UCM received an access connection request ¡ CONN-UP—UCM received a connection-up event. ¡ USERADD-ACK—User adding succeeded. ¡ USERDEL-ACK—User adding succeeded. ¡ CLOSE—Internal errors of UCM caused user to go offline. ¡ DOWN—Connection-down event initiated by access. ¡ MPBINDREQ—MP bundling request. ¡ MPBINDSUCCESS—MP bundling succeeded. ¡ MPBINDFAILURE—MP bundling failed. ¡ PAM_AUTHREQ—PAM authentication request ¡ PAM_ACCTSTARTREQ—PAM accounting start request. ¡ PAM_ACCTUPDATEREQ—PAM accounting update request. ¡ PAM_ACCTSTOPREQ—PAM accounting stop request. ¡ PAM_AUTHSUCCESS—PAM authentication succeeded. ¡ PAM_AUTHFAILURE—PAM authentication failed. ¡ PAM_AUTHCONTINUE—PAM user authentication failed. ¡ PAM_USERDELETE—PAM user deleted. ¡ REAUTH—IPoE Web preauthentication reauthenticated. ¡ REAUTH_SUCC—Reauthentication succeeded. ¡ REAUTH_FAIL—Reauthentication failed. ¡ LOGOUT—An IPoE Web user exited the postauthentication domain. ¡ LOGOUT_SUCC—An IPoE Web user successfully exited the postauthentication domain. ¡ MODIFY—User modified. ¡ MODIFY-ACK—User modified successfully. · state—Current state. Possible values include: ¡ INIT—Initialization. ¡ AUTHING—Authenticating. ¡ ALLOC—Intermediate state between authentication failure and user logout. Only PPP has this state. ¡ AUTHED—Authenticated. ¡ USER-ADDING—Intermediate state between issuing to the kernel and notifying the backup interface module and interface module. ¡ UP—Coming online successfully. ¡ DELETING—Deleting. ¡ DELETED—Deleted. ¡ BINDING—Binding phase (supported only by PPP MP) ¡ REAUTH—Reauthentication phase. An IPoE Web user performed authentication in the Web authentication phase. ¡ LOGOUT—An IPoE Web user returned to the preauthentication phase from the Web authentication phase. ¡ MODIFY—User authentication modification (COA). |
|
[User State]UserID: userid, Received event event, State changed from oldstate to newstate |
The user state machine received an event of the event type, and the state changed from oldstate to newstate. The parameters are as follows: · UserID—User ID. · event—User state machine event. For values, see the event field in the preceding message. · oldphase—State before the switching. For values, see the state field in the preceding message. · newphase—State after the switching. For values, see the state field in the preceding message. |
|
UserID userid group ID changed. |
The user group ID of the user changed. |
|
UserID: userid, Received assigned IP address ipaddr from AM. |
The user received an assigned IP address ipaddr from AM. |
|
UserID userid will be terminated, the cause is cause. |
The user connection will be terminated for the cause cause. |
|
UserID: userid, Sent authentication request to AAA, the access user type is type. |
UCM sent an authentication request to AAA. The parameters are as follows: · UserID—User ID. · type—User access type. Possible values include: ¡ PPPoE—PPP over Ethernet user. ¡ PPPoA—PPP over ATM user. ¡ PPPoFR—PPP over FR user. ¡ PPPoPhy—PPP user directly carried over a physical link. ¡ VPPP—L2TP user auto-dialed on a LAC. ¡ LNS—L2TP user on an LNS. ¡ MAC auth—MAC authentication user. ¡ Dot1x—802.1X user. ¡ Web auth—Web authentication user. ¡ Telnet—Telnet user. ¡ FTP—FTP user. ¡ Terminal—User logging in through the Console port, AUX port, or Asyn port. ¡ SSH—SSH user. ¡ Portal—Portal user. ¡ PAD—PAD user. ¡ Command—Command authorization and accounting user. ¡ Super—User that can switch the user role. ¡ IPoE L2VPN leased—IPoE L2VPN-leased user. ¡ NETCONF SOAP HTTP—HTTP web user. ¡ NETCONF RESTful HTTP—NETCONF over SOAP over HTTP user. ¡ HTTP Web—HTTP web user. ¡ NETCONF SOAP HTTPS—NETCONF over SOAP over HTTPS user. ¡ NETCONF RESTful HTTPS—NETCONF over RESTful over HTTPS user. ¡ HTTPS Web—HTTPS web user. ¡ L2 IPoE dynamic—Layer 2 IPoE dynamic user. ¡ L2 IPoE static—Layer 2 IPoE static user. ¡ L2 IPoE interface leased—Layer 2 IPoE interface-leased user. ¡ L2 IPoE leased subuser—Layer 2 leased subuser. ¡ L3 IPoE dynamic—Layer 3 IPoE dynamic user. ¡ L3 IPoE static—Layer 3 IPoE static user. ¡ L3 IPoE interface leased—Layer 3 IPoE interface-leased user. ¡ L3 IPoE subnet leased—Layer 3 subnet-leased user. ¡ IKE—IKE user. ¡ SSLVPN—SSL VPN user. ¡ DVPN—DVPN user. ¡ PPPoEA—PPPoE agency user. |
|
UserID: userid, session key: key, New SocketPAM (usertype) user is created. |
A socket PAM user was created. The parameters are as follows: · UserID—User ID. · session key—PAM access user index. · usertype—User type. Possible values include: ¡ Telnet—Telnet user. ¡ FTP—FTP user. ¡ Terminal—User logging in through the Console port, AUX port, or Asyn port. ¡ SSH—SSH user. ¡ PAD—PAD user. ¡ Command—Command authorizing and accounting user. ¡ Super—User that can switch the user role. |
|
UserID: userid, session key: key, New SessionPAM (usertype) user is created. |
A session PAM user was created. The parameters are as follows: · UserID—User ID. · session key—PAM access user index. · usertype—User type. Possible values include: ¡ NETCONF SOAP HTTPS—NETCONF over SOAP over HTTPS user. ¡ NETCONF RESTful HTTP—NETCONF over SOAP over HTTP user. ¡ HTTP Web—HTTP web user. ¡ NETCONF SOAP HTTPS—NETCONF over SOAP over HTTPS user. ¡ NETCONF RESTful HTTPS—NETCONF over RESTful over HTTPS user. ¡ HTTPS Web—HTTPS web user. ¡ IKE—IKE user. ¡ SSLVPN—SSL VPN user. ¡ DVPN—DVPN user. |
|
UserID: userid, session Key: key, New Portal user is created |
A portal user was created. The parameters are as follows: · UserID—User ID. · session key—PAM access user index. |
|
UserID: userid, ConnectID: connectid, New PPP user is created |
A PPP user was created. The parameters are as follows: · UserID—User ID. · ConnectID—UCM connection type ID. Possible values include: ¡ 0—Auto-dialed L2TP connection on a LAC or L2TP connection on an LNS. ¡ 1—DHCP, IPoE, or ARP connection. ¡ 2—DHCPv6, IPoEv6, or ND connection. ¡ 3—PPP, IP6CP, or ND connection. |
|
UserID: userid, ConnectID: connectid, New IPoE4 user is created |
An IPv4 IPoE user was created. The parameters are as follows: · UserID—User ID. · ConnectID—UCM connection type ID. Possible values include: ¡ 0—Auto-dialed L2TP connection on a LAC or L2TP connection on an LNS. ¡ 1—DHCP, IPoE, or ARP connection. ¡ 2—DHCPv6, IPoEv6, or ND connection. ¡ 3—PPP, IP6CP, or ND connection. |
|
UserID: userid, ConnectID: connectid, New IPoE6 user is created. |
An IPv6 IPoE user was created. The parameters are as follows: · UserID—User ID. · ConnectID—UCM connection type ID. Possible values include: ¡ 0—Auto-dialed L2TP connection on a LAC or L2TP connection on an LNS. ¡ 1—DHCP, IPoE, or ARP connection. ¡ 2—DHCPv6, IPoEv6, or ND connection. ¡ 3—PPP, IP6CP, or ND connection. |
|
UserID: userid, ConnectID: connectid, New leased user is created. |
An IPoE leased user was created. The parameters are as follows: · UserID—User ID. · ConnectID—UCM connection type ID. Possible values include: ¡ 0—Auto-dialed L2TP connection on a LAC or L2TP connection on an LNS. ¡ 1—DHCP, IPoE, or ARP connection. ¡ 2—DHCPv6, IPoEv6, or ND connection. ¡ 3—PPP, IP6CP, or ND connection. |
|
UserID: userid, ConnectID: connectid, New Dot1X user is created |
A user was created. The parameters are as follows: · UserID—User ID. · ConnectID—UCM connection type ID. Possible values include: ¡ 0—Auto-dialed L2TP connection on a LAC or L2TP connection and 802.1X user on an LNS. ¡ 1—DHCP, IPoE, or ARP connection. ¡ 2—DHCPv6, IPoEv6, or ND connection. ¡ 3—PPP, IP6CP, or ND connection. |
|
UserID: userid, UCM received COA request for PPPoEA from AAA. |
UCM received a COA request for PPPoE agency user from AAA. |
7. AAA
Table 20 Detailed information of traced objects (AAA)
|
Field |
Description |
|
Domain domain-name rejected the user. |
The domain name domain-name rejected the user. |
|
Domain domain-name is in blocked state. |
The domain named domain-name is in blocked state. |
|
The user failed to access domain domain-name because the maximum number of users already reached. |
The user failed to access the domain named domain-name because the maximum number of users was already reached. |
|
Received an authentication request. |
AAA received an authentication request from a UCM user. |
|
Received an accounting-start request. |
AAA received an accounting-start request from an UCM user. |
|
Received an accounting-update request. |
AAA received an accounting-update request from a UCM user. |
|
Received an accounting-stop request. |
AAA received an accounting-stop request from a UCM user. |
|
Received a get-data reply. |
AAA received a get-data reply from UCM. |
|
Received an LDAP authentication response. |
AAA received a LDAP authentication response packet. |
|
Received an LDAP authorization response. |
AAA received a LDAP authorization response packet. |
|
RADIUS authentication: Request initiated. |
RADIUS authentication: Request packet was initiated. |
|
RADIUS accounting start: Request initiated. |
RADIUS accounting start: Request packet was initiated. |
|
RADIUS accounting update: Request initiated. |
RADIUS accounting update: Request packet was initiated. |
|
RADIUS accounting stop: Request initiated. |
RADIUS accounting stop: Request packet was initiated. |
|
RADIUS accounting start: Failed. Reason: reason. |
RADIUS accounting start failed for the reason reason. |
|
RADIUS accounting update: Failed. Reason: reason. |
RADIUS accounting update failed for the reason reason. |
|
RADIUS accounting stop: Failed. Reason: reason. |
RADIUS accounting stop failed for the reason reason. |
|
RADIUS authentication: Succeeded. |
RADIUS authentication succeeded. |
|
RADIUS accounting start: Succeeded. |
RADIUS accounting start succeeded. |
|
RADIUS accounting update: Succeeded. |
RADIUS accounting update succeeded. |
|
RADIUS accounting stop: Succeeded. |
RADIUS accounting stop succeeded. |
|
RADIUS authentication: Failed. Reason: reason. |
RADIUS authentication failed for a reason. Possible reasons include: · Server rejected. |
|
RADIUS authorization: Failed. Reason: reason. |
RADIUS authorization failed for a reason. Possible reasons are: · Data error. |
|
TACACS authentication: Request initiated. |
TACACS authentication: Request packet was initiated. |
|
TACACS continue authentication: Request initiated. |
TACACS continue authentication: Request packet was initiated. |
|
TACACS accounting start: Request initiated. |
TACACS accounting start: Request packet was initiated. |
|
TACACS accounting update: Request initiated. |
TACACS accounting update: Request packet was initiated. |
|
TACACS accounting stop: Request initiated. |
TACACS accounting stop: Request packet was initiated. |
|
TACACS authentication: Failed. Reason: reason. |
TACACS authentication failed for the reason reason. |
|
TACACS continue authentication: Failed. Reason: reason. |
TACACS continue authentication failed for the reason reason. |
|
TACACS authorization: Failed. Reason: reason. |
TACACS authorization failed for the reason reason. |
|
TACACS accounting start: Failed. Reason: reason. |
TACACS accounting start failed for the reason reason. |
|
TACACS accounting update: Failed. Reason: reason. |
TACACS accounting update failed for the reason reason. |
|
TACACS accounting stop: Failed. Reason: reason. |
TACACS accounting stop failed for the reason reason. |
|
TACACS authentication: Succeeded. |
TACACS authentication succeeded. |
|
TACACS continue authentication: Succeeded. |
TACACS continue authentication succeeded. |
|
TACACS accounting start: Succeeded. |
TACACS accounting start succeeded. |
|
TACACS accounting update: Succeeded. |
TACACS accounting update succeeded. |
|
TACACS accounting stop: Succeeded. |
TACACS accounting stop succeeded. |
8. DHCP
Table 21 Detailed information of traced objects (DHCP)
|
Field |
Description |
|
DHCPACC received a message type, UserID userid, DHCPACCIndex index, state state |
The DHCP access module received a DHCP client message of the type type from UCM. The user ID is userid, the local index of the DHCP client is index, and the DHCP client is in the state state. Possible values of type include: · UCM_UIA_DHCP_MSG_CONN_REQ_ACK—A connection is successfully established. · UCM_UIA_DHCP_MSG_CONN_REQ_REJ—Connection establishment was rejected. · UCM_UIA_DHCP_MSG_CONNUP_REQ_ACK—The DHCP client successfully came online. · UCM_UIA_DHCP_MSG_CONNUP_REQ_REJ—The online request of the DHCP client was rejected. · UCM_UIA_DHCP_MSG_DISCONN_INF—The user successfully went offline. Possible values of state include: · DHCPACC_WAIT_UCM_REQ_ACK—The DHCP access module is waiting for the reply to the connection request message from UCM. · DHCPACC_WAIT_UCM_UP_ACK—The DHCP access module is waiting for the reply to the online request from UCM. · DHCPACC_WAIT_UCM_DOWN_ACK—The DHCP access module is waiting for the replay to the offline request from UCM. |
|
DHCPACC sent a message type, UserID userid, DHCPACCIndex index, state state. |
The DHCP access module sent a DHCP client message of the type type to UCM. The user ID is userid, the local index of the DHCP client is index, and the DHCP client is in the state state. Possible values of type include: · UCM_UIA_DHCP_MSG_CONNUP_REQ—The DHCP client comes online. · UCM_UIA_DHCP_MSG_CONNDOWN_REQ—The DHCP client went offline. Possible values of state include: · DHCPACC_WAIT_SERVER_ACK—Waiting for the DHCP-ACK packet from the DHCP server. · DHCPACC_WORKING—The DHCP client successfully comes online. |
|
DHCPACC would change to state after-state, UserID userid, DHCPACCIndex index, current state before-state. |
The state of the DHCP access module will switch to the after-state. The user ID is userid, the local index of the DHCP client is index, and the DHCP client is in the before-state state currently. Possible values of after-state and before-state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the DHCP-OFFER packet from the AM module. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCP client to send a DHCP-REQUEST packet. · DHCPACC_WAIT_AM_ACK—Waiting for the DHCP-ACK packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the DHCP client online request ACK message from UCM. · DHCPACC_WORKING—The DHCP client successfully comes online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the DHCP-RENEW packet from the AM module. |
|
DHCPACC sent a DHCP-DISCOVER packet to AM. Giaddr giaddr, Yiaddr yiaddr, UserID userid, DHCPACCIndex index, state state. |
The DHCP access module forwarded the DHCP-DISCOVER packet to the AM module. In the DHCP-DISCOVER packet, the Giaddr field is giaddr, and the Yiaddr field is yiaddr. The user ID is userid, the local index of the DHCP client is index, and the DHCP client is in the state state. Possible values of state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the DHCP-OFFER packet from the AM module. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCP client to send a DHCP-REQUEST packet. · DHCPACC_WAIT_AM_ACK—Waiting for the DHCP-ACK packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the DHCP client online request ACK message from UCM. · DHCPACC_WORKING—The DHCP client successfully comes online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the DHCP-RENEW packet from the AM module. |
|
DHCPACC received a DHCP-OFFER packet from AM. Giaddr giaddr, Yiaddr yiaddr, UserID userid, DHCPACCIndex index, state state. |
The DHCP access module received a DHCP-OFFER packet from the AM module. In the DHCP-OFFER packet, the Giaddr field is giaddr, and the Yiaddr field is yiaddr. The user ID is userid, the local index of the DHCP client is index, and the DHCP client is in the state state. Possible values of state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the DHCP-OFFER packet from the AM module. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCP client to send a DHCP-REQUEST packet. · DHCPACC_WAIT_AM_ACK—Waiting for the DHCP-ACK packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the DHCP client online request ACK message from UCM. · DHCPACC_WORKING—The DHCP client successfully comes online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the DHCP-RENEW packet from the AM module. |
|
DHCPACC received a DHCP-NAK packet from AM. Giaddr giaddr, Yiaddr yiaddr, UserID userid, DHCPACCIndex index, state state. |
The DHCP access module received a DHCP-NAK packet from the AM module. In the DHCP-NAK packet, the Giaddr field is giaddr, and the Yiaddr field is yiaddr. The user ID is userid, the local index of the DHCP client is index, and the DHCP client is in the state state. Possible values of state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the DHCP-OFFER packet from the AM module. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCP client to send a DHCP-REQUEST packet. · DHCPACC_WAIT_AM_ACK—Waiting for the DHCP-ACK packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the DHCP client online request ACK message from UCM. · DHCPACC_WORKING—The DHCP client successfully comes online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the DHCP-RENEW packet from the AM module. |
|
DHCPACC sent a DHCP-OFFER packet to client. Giaddr giaddr, Yiaddr yiaddr, UserID userid, DHCPACCIndex index, state state |
The DHCP access module forwarded the DHCP-OFFER packet to the DHCP client. In the DHCP-OFFER packet, the Giaddr field is giaddr, and the Yiaddr field is yiaddr. The user ID is userid, the local index of the DHCP client is index, and the DHCP client is in the state state. Possible values of state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the DHCP-OFFER packet from the AM module. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCP client to send a DHCP-REQUEST packet. · DHCPACC_WAIT_AM_ACK—Waiting for the DHCP-ACK packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the DHCP client online request ACK message from UCM. · DHCPACC_WORKING—The DHCP client successfully comes online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the DHCP-RENEW packet from the AM module. |
|
DHCPACC sent a DHCP-NAK packet to client. Giaddr giaddr, Yiaddr yiaddr, UserID userid, DHCPACCIndex index, state state |
The DHCP access module forwarded the DHCP-NAK packet to the DHCP client. In the DHCP-NAK packet, the Giaddr field is giaddr, and the Yiaddr field is yiaddr. The user ID is userid, the local index of the DHCP client is index, and the DHCP client is in the state state. Possible values of state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the DHCP-OFFER packet from the AM module. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCP client to send a DHCP-REQUEST packet. · DHCPACC_WAIT_AM_ACK—Waiting for the DHCP-ACK packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the DHCP client online request ACK message from UCM. · DHCPACC_WORKING—The DHCP client successfully comes online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the DHCP-RENEW packet from the AM module. |
|
DHCPACC received a DHCP-REQUEST packet from client. Giaddr giaddr, Yiaddr yiaddr, UserID userid, DHCPACCIndex index, state state |
The DHCP access module received a DHCP-REQUEST packet from the DHCP client. In the DHCP-REQUEST packet, the Giaddr field is giaddr, and the Yiaddr field is yiaddr. The user ID is userid, the local index of the DHCP client is index, and the DHCP client is in the state state. Possible values of state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the DHCP-OFFER packet from the AM module. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCP client to send a DHCP-REQUEST packet. · DHCPACC_WAIT_AM_ACK—Waiting for the DHCP-ACK packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the DHCP client online request ACK message from UCM. · DHCPACC_WORKING—The DHCP client successfully comes online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the DHCP-RENEW packet from the AM module. |
|
DHCPACC sent a DHCP-REQUEST packet to AM. Giaddr giaddr, Yiaddr yiaddr, UserID userid, DHCPACCIndex index, state state |
The DHCP access module forwarded the DHCP-REQUEST packet to the AM module. In the DHCP-REQUEST packet, the Giaddr field is giaddr, and the Yiaddr field is yiaddr. The user ID is userid, the local index of the DHCP client is index, and the DHCP client is in the state state. Possible values of state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the DHCP-OFFER packet from the AM module. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCP client to send a DHCP-REQUEST packet. · DHCPACC_WAIT_AM_ACK—Waiting for the DHCP-ACK packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the DHCP client online request ACK message from UCM. · DHCPACC_WORKING—The DHCP client successfully comes online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the DHCP-RENEW packet from the AM module. |
|
DHCPACC receive a DHCP-ACK packet from AM. Giaddr giaddr, Yiaddr yiaddr, DHCPACCIndex index, state state. |
The DHCP access module received a DHCP-ACK packet from the AM module. In the DHCP-ACK packet, the Giaddr field is giaddr, and the Yiaddr field is yiaddr. The user ID is userid, the local index of the DHCP client is index, and the DHCP client is in the state state. Possible values of state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the DHCP-OFFER packet from the AM module. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCP client to send a DHCP-REQUEST packet. · DHCPACC_WAIT_AM_ACK—Waiting for the DHCP-ACK packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the DHCP client online request ACK message from UCM. · DHCPACC_WORKING—The DHCP client successfully comes online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the DHCP-RENEW packet from the AM module. |
|
DHCPACC sent a DHCP-ACK packet to client. Giaddr giaddr, Yiaddr yiaddr, UserID userid, DHCPACCIndex index, state state |
The DHCP access module forwarded the DHCP-ACK packet to the AM module. In the DHCP-ACK packet, the Giaddr field is giaddr, and the Yiaddr field is yiaddr. The user ID is userid, the local index of the DHCP client is index, and the DHCP client is in the state state. Possible values of state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the DHCP-OFFER packet from the AM module. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCP client to send a DHCP-REQUEST packet. · DHCPACC_WAIT_AM_ACK—Waiting for the DHCP-ACK packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the DHCP client online request ACK message from UCM. · DHCPACC_WORKING—The DHCP client successfully comes online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the DHCP-RENEW packet from the AM module. |
|
DHCPACC received a DHCP-REQUEST packet from client. Giaddr giaddr, Yiaddr yiaddr, UserID userid, DHCPACCIndex index, state state. |
The DHCP access module received a DHCP-REQUEST packet from the DHCP client. In the DHCP-REQUEST packet, the Giaddr field is giaddr, and the Yiaddr field is yiaddr. The user ID is userid, the local index of the DHCP client is index, and the DHCP client is in the state state. Possible values of state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the DHCP-OFFER packet from the AM module. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCP client to send a DHCP-REQUEST packet. · DHCPACC_WAIT_AM_ACK—Waiting for the DHCP-ACK packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the DHCP client online request ACK message from UCM. · DHCPACC_WORKING—The DHCP client successfully comes online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the DHCP-RENEW packet from the AM module. |
|
DHCPACC sent a DHCP-REQUEST packet to AM. Giaddr giaddr, Yiaddr yiaddr, UserID userid, DHCPACCIndex index, state state. |
The DHCP access module forwarded the DHCP-REQUEST packet to the AM module. In the DHCP-REQUEST packet, the Giaddr field is giaddr, and the Yiaddr field is yiaddr. The user ID is userid, the local index of the DHCP client is index, and the DHCP client is in the state state. Possible values of state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the DHCP-OFFER packet from the AM module. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCP client to send a DHCP-REQUEST packet. · DHCPACC_WAIT_AM_ACK—Waiting for the DHCP-ACK packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the DHCP client online request ACK message from UCM. · DHCPACC_WORKING—The DHCP client successfully comes online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the DHCP-RENEW packet from the AM module. |
|
DHCPACC received a DHCP-ACK packet from AM. Giaddr giaddr, Yiaddr yiaddr, UserID userid, DHCPACCIndex index, state state. |
The DHCP access module received a DHCP-ACK packet from the AM module. In the DHCP-ACK packet, the Giaddr field is giaddr, and the Yiaddr field is yiaddr. The user ID is userid, the local index of the DHCP client is index, and the DHCP client is in the state state. Possible values of state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the DHCP-OFFER packet from the AM module. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCP client to send a DHCP-REQUEST packet. · DHCPACC_WAIT_AM_ACK—Waiting for the DHCP-ACK packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the DHCP client online request ACK message from UCM. · DHCPACC_WORKING—The DHCP client successfully comes online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the DHCP-RENEW packet from the AM module. |
|
DHCPACC sent a DHCP-ACK packet to CLIENT. Giaddr giaddr, Yiaddr yiaddr, UserID userid, DHCPACCIndex index, state state. |
The DHCP access module forwarded a DHCP-ACK packet to the DHCP client. In the DHCP-ACK packet, the Giaddr field is giaddr, and the Yiaddr field is yiaddr. The user ID is userid, the local index of the DHCP client is index, and the DHCP client is in the state state. Possible values of state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the DHCP-OFFER packet from the AM module. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCP client to send a DHCP-REQUEST packet. · DHCPACC_WAIT_AM_ACK—Waiting for the DHCP-ACK packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the DHCP client online request ACK message from UCM. · DHCPACC_WORKING—The DHCP client successfully comes online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the DHCP-RENEW packet from the AM module. |
|
DHCPACC received Release packet from client Giaddr giaddr, Yiaddr yiaddr, UserID userid, DHCPACCIndex index, state state. |
The DHCP access module received a Release packet from a DHCP client. In the DHCP-REQUEST packet, the Giaddr field is giaddr, and the Yiaddr field is yiaddr. The user ID is userid, and the local index of the DHCP client is index. Available values for state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the DHCP-OFFER packet from the AM module. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCP client to send a Request packet. · DHCPACC_WAIT_AM_ACK—Waiting for the DHCP-ACK packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the reply to the DHCP online packet from UCM. · DHCPACC_WORKING—The DHCP client successfully came online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the DHCP-RENEW packet from the AM module. |
|
DHCPACC sent Release packet to AM Giaddr giaddr, Yiaddr yiaddr, UserID userid, DHCPACCIndex index, state state. |
The DHCP access module forwarded a Release packet to the AM module. In the Release packet, the Giaddr field is giaddr, and the Yiaddr field is yiaddr. The user ID is userid, the local index of the DHCP client is index, and the current state of the DHCP client is state. Available values for state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the DHCP-OFFER packet from the AM module. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCP client to send a Request packet. · DHCPACC_WAIT_AM_ACK—Waiting for the DHCP-ACK packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the reply to the DHCP online packet from UCM. · DHCPACC_WORKING—The DHCP client successfully came online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the DHCP-RENEW packet from the AM module. |
|
DHCPACC received Release packet from AM. Giaddr giaddr, Yiaddr yiaddr, UserID userid, DHCPACCIndex index, state state. |
The DHCP access module received a Release packet from the AM module. In the Release packet, the Giaddr field is giaddr, and the Yiaddr field is yiaddr. The user ID is userid, the local index of the DHCP client is index, and the current state of the DHCP client is state. Available values for state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the DHCP-OFFER packet from the AM module. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCP client to send a DHCP-REQUEST packet. · DHCPACC_WAIT_AM_ACK—Waiting for the DHCP-ACK packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the DHCP client online request ACK message from UCM. · DHCPACC_WORKING—The DHCP client successfully came online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the DHCP-RENEW packet from the AM module. |
|
DHCPACC received Decline packet from client. Giaddr giaddr, Yiaddr yiaddr, UserID userid, DHCPACCIndex index, state state. |
The DHCP access module received a Decline packet from a DHCP client. The user ID is userid. In the DHCP-REQUEST packet, the Giaddr field is giaddr, and the Yiaddr field is yiaddr. The local index of the DHCP client is index. Available values for state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the DHCP-OFFER packet from the AM module. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCP client to send a DHCP-REQUEST packet. · DHCPACC_WAIT_AM_ACK—Waiting for the DHCP-ACK packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the DHCP client online request ACK message from UCM. · DHCPACC_WORKING—The DHCP client successfully came online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the DHCP-RENEW packet from the AM module. |
|
DHCPACC sent Decline packet to AM Giaddr giaddr, Yiaddr yiaddr, UserID userid, DHCPACCIndex index, state state. |
The DHCP access module forwarded a Decline packet to the AM module. In the Decline packet, the Giaddr field is giaddr, and the Yiaddr field is yiaddr. The user ID is userid, the local index of the DHCP client is index, and the current state of the DHCP client is state. Available values for state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the DHCP-OFFER packet from the AM module. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCP client to send a DHCP-REQUEST packet. · DHCPACC_WAIT_AM_ACK—Waiting for the DHCP-ACK packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the DHCP client online request ACK message from UCM. · DHCPACC_WORKING—The DHCP client successfully came online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the DHCP client offline request ACK message from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the DHCP-RENEW packet from the AM module. |
|
DHCPACC sent a Solicit packet to AM. IA_NA IAAddr(iaid iaid), IA_PD IAPD(iaid iaid) UserID userid, DHCPACCIndex index, state state. |
The DHCPv6 access module forwarded the Solicit packet to the AM module. In the Solicit packet, the IA_NA field is IAAddr, and the IA_PD field is IAPD(iaid). The user ID is userid, the local index of the DHCPv6 client is index, and the DHCPv6 client is in the state state. Possible values of state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the AM module to reply to the Advertise packet. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCPv6 client to send a Request packet. · DHCPACC_WAIT_AM_ACK—Waiting for the Reply packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the reply to the DHCPv6 online packet from UCM. · DHCPACC_WORKING—The DHCPv6 client successfully came online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the reply to the DHCPv6 offline packet from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the reply to DHCPv6 client offline request from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the Renew packet from the AM module. |
|
DHCPACC received an Advertise packet from AM. IA_NA IAAddr(iaid iaid), IA_PD IAPD(iaid iaid) UserID userid, DHCPACCIndex index, state state. |
The DHCPv6 access module received an Advertise packet from the AM module. In the Advertise packet, the IA_NA field is IAAddr. The local index of the DHCPv6 client is index, and the DHCPv6 client is in the state state. Possible values of state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the AM module to reply to the Advertise packet. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCPv6 client to send a Request packet. · DHCPACC_WAIT_AM_ACK—Waiting for the Reply packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the reply to the DHCPv6 online packet from UCM. · DHCPACC_WORKING—The DHCPv6 client successfully came online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the reply to the DHCPv6 offline packet from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the reply to DHCPv6 client offline request from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the Renew packet from the AM module. |
|
DHCPACC sent an Advertise packet to client. IA_NA IAAddr(iaid iaid), IA_PD IAPD(iaid iaid) UserID userid, DHCPACCIndex index, state state. |
The DHCPv6 access module forwarded an Advertise packet to the DHCPv6 client. In the Advertise packet, the IA_NA field is IAAddr, and the IA_PD field is IAPD(iaid). The user ID is userid, the local index of the DHCPv6 client is index, and the DHCPv6 client is in the state state. Possible values of state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the AM module to reply to the Advertise packet. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCPv6 client to send a Request packet. · DHCPACC_WAIT_AM_ACK—Waiting for the Reply packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the reply to the DHCPv6 online packet from UCM. · DHCPACC_WORKING—The DHCPv6 client successfully came online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the reply to the DHCPv6 offline packet from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the reply to DHCPv6 client offline request from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the Renew packet from the AM module. |
|
DHCPACC received a Reply packet from AM. IA_NA IAAddr(iaid iaid), IA_PD IAPD(iaid iaid) UserID userid, DHCPACCIndex index, state state. |
The DHCPv6 access module received a Reply packet from the AM module. In the Reply packet, the IA_NA field is IAAddr, and the IA_PD field is IAPD(iaid). The user ID is userid, the local index of the DHCPv6 client is index, and the DHCPv6 client is in the state state. Possible values of state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the AM module to reply to the Advertise packet. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCPv6 client to send a Request packet. · DHCPACC_WAIT_AM_ACK—Waiting for the Reply packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the reply to the DHCPv6 online packet from UCM. · DHCPACC_WORKING—The DHCPv6 client successfully came online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the reply to the DHCPv6 offline packet from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the reply to DHCPv6 client offline request from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the Renew packet from the AM module. |
|
DHCPACC sent a Reply packet to client. IA_NA IAAddr(iaid iaid), IA_PD IAPD(iaid iaid) UserID userid, DHCPACCIndex index, state state. |
The DHCPv6 access module forwarded a Reply packet to the DHCPv6 client. In the Reply packet, the IA_NA field is IAAddr, and the IA_PD field is IAPD(iaid). The user ID is userid, the local index of the DHCPv6 client is index, and the DHCPv6 client is in the state state. Possible values of state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the AM module to reply to the Advertise packet. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCPv6 client to send a Request packet. · DHCPACC_WAIT_AM_ACK—Waiting for the Reply packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the reply to the DHCPv6 online packet from UCM. · DHCPACC_WORKING—The DHCPv6 client successfully came online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the reply to the DHCPv6 offline packet from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the reply to DHCPv6 client offline request from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the Renew packet from the AM module. |
|
DHCPACC received a Release packet from client. IA_NA IAAddr(iaid iaid), IA_PD IAPD(iaid iaid) UserID userid, DHCPACCIndex index, state state. |
The DHCPv6 access module received a Release packet from a DHCP client. In the Release packet, the IA_NA field is IAAddr (iaid), and the IA_PD field is IAPD(iaid). The user ID is userid, the local index of the DHCPv6 client is index, and the current state of the DHCPv6 client is state. Available values for state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the AM module to reply to the Advertise packet. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCPv6 client to send a Request packet. · DHCPACC_WAIT_AM_ACK—Waiting for the DHCP-ACK packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the DHCPv6 client online request ACK message from UCM. · DHCPACC_WORKING—The DHCPv6 client successfully came online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the reply to the DHCPv6 offline packet from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the reply to DHCPv6 client offline request from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the Renew packet from the AM module. |
|
DHCPACC sent a Release packet to AM IA_NA IAAddr(iaid iaid), IA_PD IAPD(iaid iaid) UserID userid, DHCPACCIndex index, state state. |
The DHCPv6 access module forwarded a Release packet to the AM module. In the Release packet, the IA_NA field is IAAddr (iaid), and the IA_PD field is IAPD(iaid). The user ID is userid, the local index of the DHCPv6 client is index, and the current state of the DHCPv6 client is state. Available values for state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the AM module to reply to the Advertise packet. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCPv6 client to send a Request packet. · DHCPACC_WAIT_AM_ACK—Waiting for the DHCP-ACK packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the DHCPv6 client online request ACK message from UCM. · DHCPACC_WORKING—The DHCPv6 client successfully came online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the reply to the DHCPv6 offline packet from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the reply to DHCPv6 client offline request from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the Renew packet from the AM module. |
|
DHCPACC sent a Rebind packet to AM IA_NA IAAddr(iaid iaid), IA_PD IAPD(iaid iaid) UserID userid, DHCPACCIndex index, state state. |
The DHCPv6 access module forwarded a Rebind packet to the AM module. In the Rebind packet, the IA_NA field is IAAddr (iaid), and the IA_PD field is IAPD(iaid). The user ID is userid, the local index of the DHCPv6 client is index, and the current state of the DHCPv6 client is state. Available values for state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the AM module to reply to the Advertise packet. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCPv6 client to send a Request packet. · DHCPACC_WAIT_AM_ACK—Waiting for the DHCP-ACK packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the DHCP client online request ACK message from UCM. · DHCPACC_WORKING—The DHCPv6 client successfully came online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the reply to the DHCPv6 offline packet from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the reply to DHCPv6 client offline request from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the Renew packet from the AM module. |
|
DHCPACC sent a Renew packet to AM IA_NA IAAddr(iaid iaid), IA_PD IAPD(iaid iaid) UserID userid, DHCPACCIndex index, state state. |
The DHCPv6 access module forwarded a Renew packet to the AM module. In the Renew packet, the IA_NA field is IAAddr (iaid), and the IA_PD field is IAPD(iaid). The user ID is userid, the local index of the DHCPv6 client is index, and the current state of the DHCPv6 client is state. Available values for state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the AM module to reply to the Advertise packet. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCPv6 client to send a Request packet. · DHCPACC_WAIT_AM_ACK—Waiting for the DHCP-ACK packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the DHCP client online request ACK message from UCM. · DHCPACC_WORKING—The DHCPv6 client successfully came online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the reply to the DHCPv6 offline packet from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the reply to DHCPv6 client offline request from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the Renew packet from the AM module. |
|
DHCPACC received a Decline packet from client. IA_NA IAAddr(iaid iaid), IA_PD IAPD(iaid iaid) UserID userid, DHCPACCIndex index, state state. |
The DHCPv6 access module received a Decline packet from a DHCP client. In the Decline packet, the IA_NA field is IAAddr (iaid), and the IA_PD field is IAPD(iaid). The user ID is userid, the local index of the DHCPv6 client is index, and the current state of the DHCPv6 client is state. Available values for state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the AM module to reply to the Advertise packet. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCPv6 client to send a Request packet. · DHCPACC_WAIT_AM_ACK—Waiting for the DHCP-ACK packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the DHCP client online request ACK message from UCM. · DHCPACC_WORKING—The DHCPv6 client successfully came online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the reply to the DHCPv6 offline packet from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the reply to DHCPv6 client offline request from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the Renew packet from the AM module. |
|
DHCPACC sent a Decline packet to AM IA_NA IAAddr(iaid iaid), IA_PD IAPD(iaid iaid) UserID userid, DHCPACCIndex index, state state. |
The DHCPv6 access module forwarded a Decline packet to the AM module. In the Decline packet, the IA_NA field is IAAddr (iaid), and the IA_PD field is IAPD(iaid). The user ID is userid, the local index of the DHCPv6 client is index, and the current state of the DHCPv6 client is state. Available values for state include: · DHCPACC_WAIT_UCM_REQ_ACK—Waiting for the connection request ACK message from UCM. · DHCPACC_WAIT_AM_OFFER—Waiting for the AM module to reply to the Advertise packet. · DHCPACC_WAIT_CLIENT_REQ—Waiting for the DHCPv6 client to send a Request packet. · DHCPACC_WAIT_AM_ACK—Waiting for the DHCP-ACK packet from the AM module. · DHCPACC_WAIT_UCM_UP_ACK—Waiting for the DHCP client online request ACK message from UCM. · DHCPACC_WORKING—The DHCPv6 client successfully came online. · DHCPACC_WAIT_AM_DOWN_ACK—Waiting for the reply to the DHCPv6 offline packet from the AM module. · DHCPACC_WAIT_UCM_DOWN_ACK—Waiting for the reply to DHCPv6 client offline request from UCM. · DHCPACC_RENEW_WAIT_SERACK—Waiting for the reply to the Renew packet from the AM module. |
9. ARP
Table 22 Detailed information of traced objects (ARP)
|
Field |
Description |
|
Add user |
UCM notified ARP to add a user. |
|
Modify user by UID uid |
ARP modified the session parameters of the ARP user with UID uid. |
|
Modify user |
ARP modified the session parameters of ARP users. |
|
Delete user |
UCM notified ARP to delete a user. |
|
Receive a connection ACK message from UCM |
ARP received a connection ACK message from UCM. |
|
Receive a connection reject message from UCM |
ARP receive a connection reject message from UCM. |
|
Work slot has been changed to the local slot, start ARP user detection through |
The slot that initiated ARP user detection has been switched to the local slot, and the local slot started ARP user detection. |
|
Work slot has been changed to slot slot-number, stop ARP user detection |
The slot that initiated ARP user detection has been switched to the slot slot-number, and the local slot stopped ARP user detection. |
|
Receive an ARP type packet: DstIP: dst-ip, DstMAC: dst-mac, SrcIP: src-ip, SrcMAC: src-mac |
An ARP packet was received, with the packet type as type, destination IP address as dst-ip, destination MAC address as dst-mac, sender IP address as src-ip, and sender MAC address as src-mac. |
|
Send an ARP reply to user |
ARP sent an ARP reply to a user. |
|
[DetectTimer] Create ARP user detection timer |
ARP created the ARP user detection timer. |
|
[DetectTimer] ARP user detection timer timed out |
The ARP user detection timer timed out. |
|
[DetectTimer] ARP request successfully sent |
During the ARP user detection process, the ARP request was successfully sent. |
|
[DetectTimer] User detection attempts reached. Send cut message to UCM |
The maximum user detection attempts were reached. ARP sent a cut message to UCM. |
|
[DetectTimer] Set ARP user detection flag |
ARP set the ARP user detection flag. |
|
[DetectTimer] The detection configuration has been changed. Ifindex: ifindex, Retries: retries, Interval: interval |
The ARP user detection configuration has been changed. The interface initiating ARP user detection was changed to interface with index ifindex, the maximum user detection attempts were changed to retries, and the detection interval was changed to interval. |
10. ND
Table 23 Detailed information of traced objects (ND)
|
Field |
Description |
|
Add user with IPv6 prefix prefix |
UCM notified ND to add a user. UCM allocated IPv6 prefix prefix to the ND user. |
|
Modify user by UID uid |
ND modified the session parameters of the ARP user with UID uid. |
|
Modify user |
ND modified the session parameters of ND users. |
|
Delete user |
UCM notified ND to delete users. |
|
Receive a connection ACK message from UCM |
ND received a connection ACK message from UCM. |
|
Receive a connection reject message from UCM |
ND received a connection reject message from UCM. |
|
Forbid to renew link-local address |
ND forbade users from renewing link-local addresses. |
|
Work slot has been changed to the local slot, start ND user detection |
The slot that initiated ND user detection has been switched to the local slot, and the local slot started ND user detection. |
|
Work slot has been changed to slot slot-number, stop ND user detection |
The slot that initiated ND user detection has been switched to the slot slot-number, and the local slot stopped ND user detection. |
|
Send an RA message. User MAC: mac_address, IPv6 prefix: prefix |
ND sent an RA message with the user MAC as mac_address and IPv6 prefix as prefix. |
|
[DetectTimer] Create ND user detection timer |
ND created the ND user detection timer. |
|
[DetectTimer] ND user detection timer timed out |
The ND user detection timer timed out. |
|
[DetectTimer] NS message successfully sent |
During the ND user detection process, the NS message was successfully sent. |
|
[DetectTimer] User detection attempts reached. Send cut message to UCM |
The maximum user detection attempts were reached. ND sent a cut message to UCM. |
|
[DetectTimer] Set ND user detection flag |
ND set the ND user detection flag. |
|
[DetectTimer] The detection configuration has been changed. Ifindex: ifindex, Retries: retries, Interval: interval |
The ND user detection configuration has been changed. The interface initiating ND user detection was changed to interface with index ifindex, the maximum user detection attempts were changed to retries, and the detection interval was changed to interval. |
|
[DetectTimer] Invalid user IPv6 address. Detection failed |
The user IPv6 address was invalid. As a result, ND user detection failed. |
11. IGMP
Table 24 Detailed information of traced objects (IGMP)
|
Field |
Description |
|
Multicast user comes online. |
ICMP received multicast user coming online messages from UCM. |
|
Multicast user goes offline. |
ICMP received multicast user going offline messages from UCM. |
|
Multicast authentication information change. |
Multicast authentication information changed. |
12. MLD
Table 25 Detailed information of traced objects (MLD)
|
Field |
Description |
|
Multicast user comes online. |
MLD received multicast user coming online messages from UCM. |
|
Multicast user goes offline. |
MLD received multicast user going offline messages from UCM. |
|
Multicast authentication information change. |
Multicast authentication information changed. |
USER_UPPER_THRESHOLD
|
Message text |
Pattern 1: The user number on slot [INT32] is above the upper warning threshold (UpperThreshold=[INT32]). Pattern 2: The user number on chassis [INT32] slot [INT32] is above the upper warning threshold (UpperThreshold=[INT32]). |
|
Variable fields |
Pattern 1: $1: Slot number. $2: Upper access user count alarm threshold. Pattern 2: $1: Chassis number. $2: Slot number. $3: Upper access user count alarm threshold. |
|
Severity level |
4 |
|
Example |
USER/4/USER_UPPER_THRESHOLD: The user number on slot 1 is above the upper warning threshold (UpperThreshold=20). |
|
Explanation |
The access user count on the specified slot exceeds the upper access user count alarm threshold. |
|
Recommended action |
Identify whether a large number of illegal IPoE and PPPoE users exist on the slot. |
VLAN messages
This section contains VLAN messages.
VLAN_FAILED
|
Message text |
Failed to add interface [STRING] to the default VLAN. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
VLAN/4/VLAN_FAILED: Failed to add interface S-Channel4/2/0/19:100 to the default VLAN. |
|
Explanation |
An S-channel interface was created when hardware resources were insufficient. The S-channel interface failed to be assigned to the default VLAN. |
|
Recommended action |
No action is required. |
VLAN_VLANMAPPING_FAILED
|
Message text |
The configuration failed because of resource insufficiency or conflicts on [STRING]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
VLAN/4/VLAN_VLANMAPPING_FAILED: The configuration failed because of resource insufficiency or conflicts on Ethernet0/0. |
|
Explanation |
Part of or all VLAN mapping configurations on the interface were lost because of one of the following occurrences: · Hardware resources were insufficient for the interface. · The interface joined or left a Layer 2 aggregation group. |
|
Recommended action |
No action is required. |
VLAN_VLANTRANSPARENT_FAILED
|
Message text |
The configuration failed because of resource insufficiency or conflicts on [STRING]. |
|
Variable fields |
$1: Interface name. |
|
Severity level |
4 |
|
Example |
VLAN/4/VLAN_VLANTRANSPARENT_FAILED: The configuration failed because of resource insufficiency or conflicts on Ethernet0/0. |
|
Explanation |
Part of or all VLAN transparent transmission configurations on the interface were lost because of one of the following occurrences: · Hardware resources were insufficient for the interface. · The interface joined or left a Layer 2 aggregation group. |
|
Recommended action |
No action is required. |
OAM
This section contains messages about VM internal link OAM.
OAM_SLOT_CONFLICT
|
Message text |
Slot [INT32] entered silent state because its UUID([STRING]) is different from UUID ([STRING]) in the conflict detection packet. |
|
Variable fields |
$1: Slot number of a VM. $2: UUID of the VM. $3: UUID in the conflict detection packet. |
|
Severity level |
4 |
|
Example |
OAM/4/OAM_SLOT_CONFLICT: Slot 10 entered silent state because its UUID(00000000-0000-0000-0054-AABBCCDDEEFF) is different from UUID(00000000-0000-0000-0054-AABBCCDDEEEE) in the conflict detection packet. |
|
Explanation |
A VM received a slot conflict detection packet and looked up the packet for information that has the same slot number as the current VM. The VM was placed in silent state because its UUID is different from the UUID in the conflict detection packet. A VM in silent state can receive packets but cannot send packets. |
|
Recommended action |
No action is required. |
OAM_SLOT_MAC_CONFLICT
|
Message text |
Slot [INT32]% (MAC: [STRING]) in forwarding state conflicts with slot [INT32]% (MAC: [STRING]) |
|
Variable fields |
$1: Slot number of the VM where slot conflict is detected. $2: MAC address of the first VMC interface on the VM where slot conflict is detected. $3: Slot number of the VM that has slot conflict with the detection end. $4: MAC address of the first VMC interface on the VM that has slot conflict with the detection end. |
|
Severity level |
4 |
|
Example |
OAM/4/OAM_SLOT_MAC_CONFLICT: Slot 1(MAC: 00:16:EA:AE:3C:40) in forwarding state conflicts with slot 1(MAC: 00:16:EA:AE:3C:41) |
|
Explanation |
The system detected that the slot number of the local VM in forwarding state conflicts with the slot number of another VM. |
|
Recommended action |
Shut down one of the VMs to make sure each VM in the same broadcast domain has a unique slot number. Make sure the shutdown operation does not interrupt services. |
OAM_SLOT_RECOVER
|
Message text |
Slot [INT32] entered forwarding state because its UUID([STRING]) is the same as the one in the conflict detection packet. |
|
Variable fields |
$1: Slot number of a VM. $2: UUID of the VM. |
|
Severity level |
5 |
|
Example |
OAM/5/OAM_SLOT_RECOVER: Slot 10 entered forwarding state because UUID(00000000-0000-0000-0054-AABBCCDDEEFF) is the same as the one in the conflict detection packet. |
|
Explanation |
A VM in silent state received a slot conflict detection packet and looked up the packet for information that has the same slot number as the current VM. The VM was placed in forwarding state because its UUID is the same as the UUID in the conflict detection packet. A VM in forwarding state can receive and send packets. |
|
Recommended action |
No action is required. |
VRRP messages
This section contains VRRP messages.
VRRP_STATUS_CHANGE
|
Message text |
The status of [STRING] virtual router [UINT32] (configured on [STRING]) changed from [STRING] to [STRING]: [STRING]. |
|
Variable fields |
$1: VRRP version. $2: VRRP group number. $3: Name of the interface where the VRRP group is configured. $4: Original status. $5: Current status. $6: Reason for status change: · Interface event received—An interface event was received. · IP address deleted—The virtual IP address has been deleted. · The status of the tracked object changed—The status of the associated track entry changed. · VRRP packet received—A VRRP advertisement was received. · Current device has changed to IP address owner—The current device has become the IP address owner. · Zero priority packet received—A VRRP packet containing priority 0 was received. · Preempt—Preemption occurred. · Master group drove—The state of the master group changed. |
|
Severity level |
6 |
|
Example |
VRRP/6/VRRP_STATUS_CHANGE: The status of IPv4 virtual router 10 (configured on Ethernet0/0) changed (from Backup to Master): Master-down-timer expired. |
|
Explanation |
The VRRP group status changed because of the following reasons: · An interface event was received. · The virtual IP address has been deleted. · The status of the associated track entry changed. · A VRRP advertisement was received. · The current device has become the IP address owner. · The master down timer (3 × VRRP advertisement interval + Skew_Time) expired. · A VRRP packet containing priority 0 was received. · Preemption occurred. · The state of the master group changed. |
|
Recommended action |
Check the VRRP group status to make sure it is operating correctly. |
VRRP_VF_STATUS_CHANGE
|
Message text |
The [STRING] virtual router [UINT32] (configured on [STRING]) virtual forwarder [UINT32] detected status change (from [STRING] to [STRING]): [STRING]. |
|
Variable fields |
$1: VRRP version. $2: VRRP group number. $3: Name of the interface where the VRRP group is configured. $4: VF ID. $5: Original status of VF. $6: Current status of VF. $7: Reason for the status change. |
|
Severity level |
6 |
|
Example |
VRRP/6/VRRP_VF_STATUS_CHANGE: The IPv4 virtual router 10 (configured on GigabitEthernet5/1) virtual forwarder 2 detected status change (from Active to Initialize): Weight changed. |
|
Explanation |
The status of the virtual forwarder has changed because the weight changed, the timeout timer expired, or VRRP went down. |
|
Recommended action |
Check the status of the track entry. |
VRRP_VMAC_INEFFECTIVE
|
Message text |
The [STRING] virtual router [UINT32] (configured on [STRING]) failed to add virtual MAC: [STRING]. |
|
Variable fields |
$1: VRRP version. $2: VRRP group number. $3: Name of the interface where the VRRP group is configured. $4: Reason for the error. |
|
Severity level |
3 |
|
Example |
VRRP/3/VRRP_VMAC_INEFFECTIVE: The IPv4 virtual router 10 (configured on Ethernet0/0) failed to add virtual MAC: Insufficient hardware resources. |
|
Explanation |
The virtual router failed to add a virtual MAC address. |
|
Recommended action |
Find out the root cause for the operation failure and fix the problem. |
VSRP messages
This section contains VSRP messages.
VSRP_BIND_FAILED
|
Message text |
Failed to bind the IP addresses and the port on VSRP peer [STRING]. |
|
Variable fields |
$1: VSRP peer name. |
|
Severity level |
6 |
|
Example |
VSRP/6/VSRP_BIND_FAILED: Failed to bind the IP addresses and the port on VSRP peer aaa. |
|
Explanation |
Failed to bind the IP addresses and the port when creating a TCP connection to the VSRP peer because the TCP port is in use. |
|
Recommended action |
No action is required. |
VSRP_INSTANCE_STATE_CHANGE
|
Message text |
VSRP instance state changed: VSRP instance name=[STRING], OldState=[STRING], NewState=[STRING], ChangeReason=[TEXT]. |
|
Variable fields |
$1: VSRP instance name. $2: Status before VSRP instance status change: · Master: The device is the master in the VSRP instance. · Backup: The device is the backup in the VSRP instance. · Down: The device is not operating in the VSRP instance. $3: Status after VSRP instance status change: · Master: The device is the master in the VSRP instance. · Backup: The device is the backup in the VSRP instance. · Down: The device is not operating in the VSRP instance. $4: Cause of VSRP instance status change. See Table 26. |
|
Severity level |
4 |
|
Example |
VSRP/4/VSRP_INSTANCE_STATE_CHANGE: VSRP instance state changed: VSRP instance name=aaa, OldState=Backup, NewState=Master, ChangeReason=vsrp instance failed to register VRRP events, and VSRP local status changed. |
|
Explanation |
The status of a VSRP instance changed. |
|
Recommended action |
See Table 26. |
Table 26 Cause of VSRP instance status change and recommended action
|
Cause |
Recommended action |
|
The VSRP instance failed to register VRRP events, and the VSRP local status changed |
Use the display vrrp command to examine the status of the associated VRRP group. If the VRRP group is abnormal, resolve the VRRP group issue. For example, use the display current-configuration vrrp command to verify correctness of VRRP group configuration. |
|
The VSRP instance was unbound from VRRP, and the VSRP local state changed |
No action is required. |
|
The S-Trunk binding of the VSRP instance was set to the initialization state, and the VSRP local state changed |
Use the display s-trunk verbose to examine the status of the associated smart trunk. If the smart trunk is abnormal, resolve the smart trunk issue. For example, use the display current-configuration s-trunk command to verify correctness of smart trunk configuration. |
|
The VSRP instance was unbound from S-Trunk, and the VSRP local state changed |
No action is required. |
|
The UP backup interface binding of the VSRP instance was set to the initialization state, and the VSRP local state changed |
1. Use the display up-backup-profile command to view the status of the UP backup interface. 2. Use the display up-backup-profile switchover-history virtual-mac command to view the switchover records of the UP backup interface. If the UP backup interface is abnormal, troubleshoot the UP backup interface issue. |
|
The VSRP instance was unbound from a UP backup interface, and the VSRP local state changed |
No action is required. |
|
The VRRP configuration bound to the VSRP instance had state change, and the VSRP local state changed |
Use the display vrrp command to examine the status of the associated VRRP group. If the VRRP group is abnormal, resolve the VRRP group issue. For example, use the display current-configuration vrrp command to verify correctness of VRRP group configuration. |
|
The S-Trunk configuration bound to the VSRP instance had state change, and the VSRP local state changed |
Use the display s-trunk verbose to examine the status of the associated smart trunk. If the smart trunk is abnormal, resolve the smart trunk issue. For example, use the display current-configuration s-trunk command to verify correctness of smart trunk configuration. |
|
The UP backup interface bound to the VSRP instance had state change, and the VSRP local state changed |
1. Use the display up-backup-profile command to view the status of the UP backup interface. 2. Use the display up-backup-profile switchover-history virtual-mac command to view the switchover records of the UP backup interface. If the UP backup interface is abnormal, troubleshoot the UP backup interface issue. |
|
The UP backup interfaces bound to VSRP instances had state change, and the VSRP local state of these VSRP instances changed |
1. Use the display up-backup-profile command to view the status of the UP backup interface. 2. Use the display up-backup-profile switchover-history virtual-mac command to view the switchover records of the UP backup interface. If the UP backup interface is abnormal, troubleshoot the UP backup interface issue. |
|
The VSRP local state changed in processing buffered status change messages |
Locate the cause of VSRP status change based on the associated feature, VRRP, S-Trunk, or UP backup interface. |
|
The VSRP instance backup ID was set, and the VSRP peer state changed |
No action is required. |
|
The TCP disconnection timer timed out, and the VSRP peer state changed |
Check the TCP connection to verify network connectivity. |
|
The TCP connection went down, and the VSRP peer state changed due to configuration deletion |
No action is required. |
|
The TCP connection went down, and the VSRP peer state changed because the associated track entry changed to negative |
Check the status of the track entry associated in VSRP peer view, and troubleshoot the cause of track entry status change. |
|
The VSRP peer state changed after the peer status change message was received |
Troubleshoot VSRP peer status change. You can use the display vsrp instance command to check status information. |
|
VSRP split-brain prevention was performed, and the VSRP instance state changed |
No action is required. |
|
The VSRP peer state changed after the forced backup switchover message was received |
No action is required. |
VSRP_PEER_CONN_DOWN
|
Message text |
The TCP connection to a VSRP peer went down: VSRP peer name=[STRING], down reason=[STRING] |
|
Variable fields |
$1: VSRP peer name. $2: Cause of VSRP disconnection: · Negative track entry: The associated track entry became negative · Configuration deletion: The TCP connection to the VSRP peer was deleted by using the undo peer command in VSRP peer view. · Abnormal network connection. |
|
Severity level |
4 |
|
Example |
VSRP/4/VSRP_PEER_CONN_DOWN: The TCP connection to a VSRP peer went down: VSRP peer name=aaa, down reason=Negative track entry. |
|
Explanation |
A VSRP connection was interrupted. |
|
Recommended action |
Perform one of the following tasks based on the cause: · Negative track entry: Check the status of the track entry associated in VSRP peer view, and troubleshoot the cause of track entry status change. · Configuration deletion: If the deletion is by mistake, use the peer command in VSRP peer view to set up the TCP connection again. · Abnormal network connection: Troubleshoot the network connection issue. |
VSRP_PEER_CONN_UP
|
Message text |
The TCP connection to a VSRP peer came up: VSRP peer name=[STRING] |
|
Variable fields |
$1: VSRP peer name. |
|
Severity level |
4 |
|
Example |
VSRP/4/VSRP_PEER_CONN_UP: The TCP connection to a VSRP peer came up: VSRP peer name=aaa |
|
Explanation |
A VSRP connection was set up and came up. |
|
Recommended action |
No action is required. |
VXLAN messages
This section contains VXLAN messages.
VXLAN_LICENSE_UNAVAILABLE
|
Message text |
The VXLAN feature is disabled, because no licenses are valid. |
|
Variable fields |
N/A |
|
Severity level |
3 |
|
Example |
VXLAN/3/VXLAN_LICENSE_UNAVAILABLE: The VXLAN feature is disabled, because no licenses are valid. |
|
Explanation |
VXLAN was disabled because no licenses were valid. |
|
Recommended action |
Install valid licenses for VXLAN. |
WAN messages
This section contains WAN messages.
ALARM_PATH
|
Message text |
[STRING] : Path [STRING] Alarm [STRING] [STRING]! Start Time : [STRING]! |
|
Variable fields |
$1: CPOS interface name. $2: Higher order path number. $3: Higher order path alarm name (for example, AIS/LOF/LOS/RDI/SD/SLM/TIM/UNEQ). $4: State of the higher order path alarm. Options include recover and report. $5: Time when the alarm was cleared or reported, in the format of Y-M-D H:M:S:MS. |
|
Severity level |
4 (Warning) |
|
Example |
WAN/4/ALARM_PATH: -MDC=1-Slot=5; Cpos5/1/1 : Path 1 Alarm AIS report! Start Time : 2014-04-04 11:40:53:533! |
|
Impact |
The higher order path of the CPOS interface has an alarm. Comprehensively assess the impact on the system according to the actual situation. |
|
Cause |
· When the state of the higher order path alarm is recover, this message displays the specific clearing time and alarm type of the higher order path alarm on the CPOS interface. · When the state of the higher order path alarm is report, this message displays the specific triggering time and alarm type of the higher order path alarm on the CPOS interface. Possible reasons for this log message include: ¡ The peer CPOS interface is shut down by using the shutdown command. ¡ The transceiver module or line fails. ¡ The framing format of the local interface is different from that of the peer interface. ¡ The multiplexing mode of the local interface is different from that of the peer interface. ¡ The higher order path overhead byte configuration is inconsistent on the two ends. |
|
Recommended action |
· When the state of the higher order path alarm is recover, no action is required. · When the state of the higher order path alarm is report, perform the following tasks: a. Use the display controller cpos command to identify whether the physical state of the interface is up. b. The state of UP indicates the physical state of the interface is normal. Proceed to the next step. c. The state of DOWN (Administratively) indicates the interface is shut down by using the shutdown command. In this case, bring up the interface by using the undo shutdown command. d. The state of DOWN indicates that the interface is administratively up but physically down, possibly because the line fails or the peer interface is shut down by using the shutdown command. In this case, resolve the corresponding issue. e. Use the display transceiver alarm command to identify whether the transceiver module fails. f. Verify that the optical fibers are normal. g. If the framing format of the interface is inconsistent, use the frame-format or e1 frame-format command to configure the framing format of the interface. h. If the multiplexing mode of the interface is inconsistent, use the multiplex mode command to configure the multiplexing mode of the interface. i. Enter interface view and use the display this command j. Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
ALARM_SDH_AU3E1
|
Message text |
[STRING] : AUG 1 VC3 [STRING] TUG-2 [STRING] TU12 [STRING] E1 Alarm [STRING] [STRING]! Start Time : [STRING]! |
|
Variable fields |
$1: CPOS interface name. $2: VC3 number. $3: TUG-2 number. $4: TUG-12 number. $5: Alarm name (for example, AIS/LOF/LOS/RDI/SD/SLM/TIM/UNEQ). $6: Alarm state. Options include recover and report. $7: Time when the alarm was cleared or reported, in the format of Y-M-D H:M:S:MS. |
|
Severity level |
4 (Warning) |
|
Example |
WAN/4/ALARM_SDH_AU3E1: -MDC=1-Slot=4; Cpos4/1/1 : AUG 1 VC3 1 TUG-2 1 TU12 1 E1 Alarm AIS report! Start Time : 2014-04-04 14:17:55:977! |
|
Impact |
The CPOS interface has an alarm. Comprehensively assess the impact on the system according to the actual situation. |
|
Cause |
· When the state of the alarm is recover, this message displays the specific clearing time and alarm type of the lower order E1 channel alarm when the framing format and AUG multiplexing mode of the CPOS interface are SDH and AU-3, respectively. · When the state of the alarm is report, this message displays the specific triggering time and alarm type of the lower order E1 channel alarm when the framing format and AUG multiplexing mode of the CPOS interface are SDH and AU-3, respectively. Possible reasons for this log message include: ¡ The E1 channel on the peer CPOS interface has been shut down. ¡ The transceiver module or line fails. ¡ The framing format of the local interface is different from that of the peer interface. ¡ The multiplexing mode of the local interface is different from that of the peer interface. ¡ The overhead byte configuration of the E1 channel is inconsistent on the two ends. |
|
Recommended action |
· When the state of the alarm is recover, no action is required. · When the state of the alarm is report, perform the following tasks: k. Use the display controller cpos e1 command to identify whether the physical state of the interface is up. l. The state of UP indicates the physical state of the interface is normal. Proceed to the next step. m. The state of DOWN (Administratively) indicates the interface is shut down by using the shutdown command. In this case, bring up the interface by using the undo shutdown command. n. The state of DOWN indicates that the interface is administratively up but physically down, possibly because the line fails or the peer interface is shut down by using the shutdown command. In this case, resolve the corresponding issue. o. Use the display transceiver alarm command to identify whether the transceiver module fails. p. Verify that the optical fibers are normal. q. If the framing format of the interface is inconsistent, use the frame-format or e1 frame-format command to configure the framing format of the interface. r. If the multiplexing mode of the interface is inconsistent, use the multiplex mode command to configure the multiplexing mode of the interface. s. Enter interface view and use the display this command t. Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
ALARM_SDH_AU4E1
|
Message text |
[STRING] : VC4 1 TUG-3 [STRING] TUG-2 [STRING] TU12 [STRING] E1 Alarm [STRING] [STRING]! Start Time : [STRING]! |
|
Variable fields |
$1: CPOS interface name. $2: TUG-3 number. $3: TUG-2 number. $4: TU-12 number. $5: Alarm name (for example, AIS/LOF/LOS/RDI/SD/SLM/TIM/UNEQ). $6: Alarm state. Options include recover and report. $7: Time when the alarm was cleared or reported, in the format of Y-M-D H:M:S:MS. |
|
Severity level |
4 (Warning) |
|
Example |
WAN/4/ALARM_SDH_AU3E1: -MDC=1-Slot=4; Cpos4/1/1 : VC4 1 TUG-3 1 TUG-2 1 TU12 1 E1 Alarm AIS report! Start Time : 2014-04-04 14:16:51:213! |
|
Impact |
The CPOS interface has an alarm. Comprehensively assess the impact on the system according to the actual situation. |
|
Cause |
· When the state of the alarm is recover, this message displays the specific clearing time and alarm type of the lower order E1 channel alarm when the framing format and AUG multiplexing mode of the CPOS interface are SDH and AU-4, respectively. · When the state of the alarm is report, this message displays the specific triggering time and alarm type of the lower order E1 channel alarm when the framing format and AUG multiplexing mode of the CPOS interface are SDH and AU-4, respectively. Possible reasons for this log message include: ¡ The E1 channel on the peer CPOS interface has been shut down. ¡ The transceiver module or line fails. ¡ The framing format of the local interface is different from that of the peer interface. ¡ The multiplexing mode of the local interface is different from that of the peer interface. ¡ The overhead byte configuration of the E1 channel is inconsistent on the two ends. |
|
Recommended action |
· When the state of the alarm is recover, no action is required. · When the state of the alarm is report, perform the following tasks: u. Use the display controller cpos e1 command to identify whether the physical state of the interface is up. v. The state of UP indicates the physical state of the interface is normal. Proceed to the next step. w. The state of DOWN (Administratively) indicates the interface is shut down by using the shutdown command. In this case, bring up the interface by using the undo shutdown command. x. The state of DOWN indicates that the interface is administratively up but physically down, possibly because the line fails or the peer interface is shut down by using the shutdown command. In this case, resolve the corresponding issue. y. Use the display transceiver alarm command to identify whether the transceiver module fails. z. Verify that the optical fibers are normal. aa. If the framing format of the interface is inconsistent, use the frame-format or e1 frame-format command to configure the framing format of the interface. bb. If the multiplexing mode of the interface is inconsistent, use the multiplex mode command to configure the multiplexing mode of the interface. cc.
Enter interface view and use the display this command dd. Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
ALARM_SECTION_LINE
|
Message text |
[STRING] : Alarm [STRING] [STRING]! Start Time : [STRING]! |
|
Variable fields |
$1: CPOS or POS interface name. $2: Alarm name (for example, AIS/LOF/LOS/RDI/SD/SLM/TIM/UNEQ). $3: Alarm state. Options include report and recover. $4: Time when the alarm was reported or cleared, in the format of Y-M-D H:M:S:MS. |
|
Severity level |
4 (Warning) |
|
Example |
WAN/4/ALARM_SECTION_LINE: -MDC=1-Slot=4; Cpos4/1/1 : Alarm LOS report! Start Time : 2014-04-04 14:14:47:263! |
|
Impact |
The CPOS interface has an alarm. Comprehensively assess the impact on the system according to the actual situation. |
|
Cause |
· When the state of the alarm is recover, this message displays the specific clearing time and alarm type of the regenerator section or multiplex section alarm on the CPOS interface. · When the state of the alarm is report, this message displays the specific triggering time and alarm type of the regenerator section or multiplex section alarm on the CPOS interface. Possible reasons for this log message include: ¡ The peer CPOS interface has been shut down. ¡ The transceiver module or line fails. ¡ The overhead byte configuration for SONET/SDH frames is inconsistent on the CPOS interfaces on both ends. ¡ The line clock mode of the peer CPOS interface is the same as that of the local CPOS interface. |
|
Recommended action |
· When the state of the alarm is recover, no action is required. · When the state of the alarm is report, perform the following tasks: ee. Use the display controller cpos command to identify whether the physical state of the interface is up. ff. The state of UP indicates the physical state of the interface is normal. Proceed to the next step. gg. The state of DOWN (Administratively) indicates the interface is shut down by using the shutdown command. In this case, bring up the interface by using the undo shutdown command. hh. The state of DOWN indicates that the interface is administratively up but physically down, possibly because the line fails or the peer interface is shut down by using the shutdown command. In this case, resolve the corresponding issue. ii. Use the display transceiver alarm command to identify whether the transceiver module fails. jj. Verify that the optical fibers are normal. kk.
Enter interface view and use the display this command ll. Use the display this command to identify whether the clock mode is master on one end and slave on the other end. If not, modify the clock mode. mm. Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
ALARM_SONET_E1
|
Message text |
[STRING] : OC-3 1 STS [STRING] VTG [STRING] VT2 [STRING] E1 Alarm [STRING] [STRING]! Start Time : [STRING]! |
|
Variable fields |
$1: CPOS interface name. $2: STS number. $3: VTG number. $4: VT2 number. $5: Alarm name (for example, AIS/LOF/LOS/RDI/SD/SLM/TIM/UNEQ). $6: Alarm state. Options include recover and report. $7: Time when the alarm was cleared or reported, in the format of Y-M-D H:M:S:MS. |
|
Severity level |
4 (Warning) |
|
Example |
WAN/4/ALARM_SDH_AU3E1: -MDC=1-Slot=4; Cpos4/1/1 : OC-3 1 STS 1 VTG 1 VT2 1 E1 Alarm AIS recover! Start Time : 2014-04-04 14:23:04:125! |
|
Impact |
The CPOS interface has an alarm. Comprehensively assess the impact on the system according to the actual situation. |
|
Cause |
· When the state of the alarm is recover, this message displays the specific clearing time and alarm type of the lower order E1 channel alarm when the framing format of the CPOS interface is SONET. · When the state of the alarm is report, this message displays the specific triggering time and alarm type of the lower order E1 channel alarm when the framing format of the CPOS interface is SONET. Possible reasons for this log message include: ¡ The E1 channel on the peer CPOS interface has been shut down. ¡ The transceiver module or line fails. ¡ The framing format of the local interface is different from that of the peer interface. ¡ The multiplexing mode of the local interface is different from that of the peer interface. ¡ The overhead byte configuration of the E1 channel is inconsistent on the two ends. |
|
Recommended action |
· When the state of the alarm is recover, no action is required. · When the state of the alarm is report, perform the following tasks: nn. Use the display controller cpos e1 command to identify whether the physical state of the interface is up. oo. The state of UP indicates the physical state of the interface is normal. Proceed to the next step. pp. The state of DOWN (Administratively) indicates the interface is shut down by using the shutdown command. In this case, bring up the interface by using the undo shutdown command. qq. The state of DOWN indicates that the interface is administratively up but physically down, possibly because the line fails or the peer interface is shut down by using the shutdown command. In this case, resolve the corresponding issue. rr. Use the display transceiver alarm command to identify whether the transceiver module fails. ss. Verify that the optical fibers are normal. tt. If the framing format of the interface is inconsistent, use the frame-format or e1 frame-format command to configure the framing format of the interface. uu. If the multiplexing mode of the interface is inconsistent, use the multiplex mode command to configure the multiplexing mode of the interface. vv.
Enter interface view and use the display this command ww. Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
ALARM_STATUS_CHG
|
Message text |
[STRING] : [STRING] of [STRING] has lasted link-delay time! |
|
Variable fields |
$1: WAN interface name. $2: Alarm state. Options include Reporting and Recovering. $3: Alarm type (for example, SD/SF/RDI). |
|
Severity level |
4 (Warning) |
|
Example |
WAN/4/ALARM_STATUS_CHG: -MDC=1-Slot=2; Pos2/4/1 Reporting of Line RDI has lasted link-delay time! |
|
Impact |
The WAN interface has generated an alarm. Comprehensively assess the impact on the system according to the actual situation. |
|
Cause |
· When the state of the alarm is recover, it means that the WAN interface has cleared the SD, SF, or RDI alarm specified by using the alarm-detect command within the physical state change suppression interval configured by using the link-delay command. · When the state of the alarm is report, it means that the WAN interface has received the SD, SF, or RDI alarm specified by using the alarm-detect command within the physical state change suppression interval configured by using the link-delay command. |
|
Recommended action |
· When the state of the alarm is recover, no action is required. · When the state of the alarm is report, perform the following tasks: xx. Check optical fiber connectivity by re-plugging or replacing the optical fibers. yy. Use the display interface command to identify whether the physical state of the interface is up. zz. The state of DOWN indicates that the interface is administratively up but physically down, possibly because the line fails or the peer interface is shut down by using the shutdown command. In this case, resolve the corresponding issue. aaa. Use the display transceiver alarm command to identify whether the transceiver module fails. bbb. Use the alarm-detect command to configure the action to take when an alarm occurs on an interface. When an alarm is detected, the device automatically sets the physical state of the interface to down. Check the following alarms: Remote defect indication (RDI) alarm, signal degrade (SD) alarm, and signal fail (SF) alarm. ccc. Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
ALTERA_SEU_CLK_CHK
|
Message text |
Subslot [UINT16] of slot [UINT16] has an unrecoverable SEU error. |
|
Variable fields |
$1: Subslot number. $2: Slot number. |
|
Severity level |
2 (Critical) |
|
Example |
WAN/2/ALTERA_SEU_CLK_CHK: -MDC=1-Slot=4; Subslot 2 of slot 4 has an unrecoverable SEU error. |
|
Impact |
Traffic cannot be forwarded. |
|
Cause |
An internal error occurs in the chip. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
OMEGA_SEU_CLK_CHK
|
Message text |
Subslot [UINT16] of slot [UINT16] has an unrecoverable SEU error. |
|
Variable fields |
$1: Subslot number. $2: Slot number. |
|
Severity level |
2 (Critical) |
|
Example |
WAN/2/OMEGA_SEU_CLK_CHK: -MDC=1-Slot=4; Subslot 2 of slot 4 has an unrecoverable SEU error. |
|
Impact |
Traffic cannot be forwarded. |
|
Cause |
An internal error occurs in the chip. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
OMEGA3_SEU_CLK_CHK
|
Message text |
Subslot [UINT16] of slot [UINT16] has an unrecoverable SEU error. |
|
Variable fields |
$1: Subslot number. $2: Slot number. |
|
Severity level |
2 (Critical) |
|
Example |
WAN/2/OMEGA3_SEU_CLK_CHK: -MDC=1-Slot=4; Subslot 2 of slot 4 has an unrecoverable SEU error. |
|
Impact |
Traffic cannot be forwarded. |
|
Cause |
An internal error occurs in the chip. |
|
Recommended action |
Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
POS_CLK_CHK
|
Message text |
The clock mode configuration of [STRING] must be the same as [STRING]. Otherwise, the configuration does not take effect. |
|
Variable fields |
$1: Interface name. $2: Interface name. |
|
Severity level |
5 (Notification) |
|
Example |
WAN/5/POS_CLK_CHK: -MDC=1-Slot=4; The clock mode configuration of Pos2/4/1 must be the same as Pos2/4/2. Otherwise, the configuration does not take effect. |
|
Impact |
For the configuration to take effect, make sure the clock mode configuration is the same on the two interfaces. |
|
Cause |
The clock mode configurations of the two interfaces are different. |
|
Recommended action |
1. Set the same clock mode for the two interfaces. 2. Collect alarm information, log messages, and configuration data, and then contact Technical Support for help. |
