[AusNOG] Syslog buffer filter

[Matt Smee]

Cisco devices love to whinge about those things every 10 minutes, even if the device is disconnected (yay for -40 power warnings).
If you tail syslog, just grep -Ev a regex for it or setup your syslog application to filter with regex.

Be mindful: I had a bug where the logging discriminator feature just literally did not work for a few versions which stung us unexpectedly...that was a newly discovered one too.

Global config for the device (nb: IOS 15.x Catalyst switches):
logging discriminator filterpwr msg-body drops /Te6\/[4-5]: (R|T)x.*-40.0 dBm/
logging buffered discriminator filterpwr
logging console discriminator filterpwr
logging host #ipaddress# discriminator filterpwr

I dug this up from when I was labbing it a while ago, it was working (on very new release code). Adjust the regex after the word "drops" as appropriate, but this should get you started :). Check around their documentation for "logging discriminator" which may fill in any gaps you might have.

Cheers,
Matt.

From: AusNOG [mailto:ausnog-bounces at lists.ausnog.net] On Behalf Of Dino Sosic
Sent: Wednesday, 27 July 2016 10:09 AM
To: ausnog at lists.ausnog.net
Subject: [AusNOG] Syslog buffer filter

Hi guys,

Does anyone know how I can filter this from logs on my Cisco device (ASR920)

008480: Jul 27 2016 08:06:48 ACST: %SFF8472-3-THRESHOLD_VIOLATION: Te0/0/27: Rx power low warning; Operating value: -23.7 dBm, Threshold value: -23.0 dBm

I am aware of the power problem with this particular SFP(it's the distance), and I am not interested in that. I just want this to stop spamming and filtering my logs. Maybe with discriminators?

Thanks,
Regards,
Dino
##################################################################################### Confidentiality and Privilege Notice This document is intended solely for the named addressee. The information contained in the pages is confidential and contains legally privileged information. If you are not the addressee indicated in this message or responsible for delivery of the message to such person, you may not copy or deliver this message to anyone, and you should destroy this message and kindly notify the sender by reply email. Confidentiality and legal privilege are not waived or lost by reason of mistaken delivery to you. #####################################################################################
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ausnog.net/pipermail/ausnog/attachments/20160727/a1a3eada/attachment.html>