1.1.4 Operation log and type log

You can save the following operation logs in the order in which they occurred, and then use show logging commandto view them:

Entered command. (Message-type KEY)
Messages output by the device in response to command input (message type RSP)
Scripted input commands (message-type SKY)
Messages output by the device to scripted input commands (message type SRS)
Operational messages (except for message type AUT,DSN)

For details about the message type KEY,RSP,SKY and SRS operation log format, see 1.3.2 Format of operation log.

Category logs categorize the message type ERR and EVT operational messages by message identifier, and record the date and time when the event first occurred, and the date and time when the event last occurred, and the cumulative count. You can use show logging command. You can specify and view reference parameters.

<Structure of this section>

(1) Log specifications

The following table describes the specifications of the operation log and type log.

Table 1-4: Specifications of operation log and type log
Item	Operation log	Reference log
Log contents	Acquires events that occurred in chronological order.	Records statistics for each event, such as the time of the first and last occurrences, and the total number of occurrences.
Target message type	KEY, RSP, SKY, SRS ERR, EVT TRO, RTM, MRP, MR6, BFD	ERR^#1 EVT^{#1 #2}
Number of acquired entries	The number of log entries that can be acquired is 12000. Of these, the first 6000 entries store all logs in chronological order. The following 3000 entries store logs in chronological order, excluding logs with a message type of SKY,SRS among the older logs filled from the above 6000 entries. The remaining 3000 entries are stored in chronological order only when the message type is KEY,RSP,ERR,EVT among the older logs filled from the above 9000 entries. One entry contains 80 characters. If an acquired entry contains 100 characters, it is divided between two entries.	500 entries can be acquired.
Overflow processing when the log size is exceeded	If the number of log entries exceeds 6000, logs with a message type of SKY,SRS out of the older overfilled logs are deleted. Logs that are older than those with a message type of SKY,SRS are stored in entries 6001 through 9000. If the number of log entries exceeds 9000, the log with KEY,RSP,ERR,EVT message type among the filled log entries is stored in entries 9001 to 12000. If the number of log entries exceeds 12000, the system deletes the old log that has spilled.	If the number of log entries exceeds 500 entries, entries that have a lower event level are deleted and the new entries are acquired. Note that new entries that have an event level of E3 or E4 are not acquired.

#1: Not acquired if the event location is SCRIPT.
#2: Not acquired for event-level R8~R5.

(2) Automatic log save

The operation log and type log are automatically saved in the on-chip flash memory at the following timing: and the destination to which they are saved. If the configuration command no logging syslog-dump is set, it is automatically saved only in the event of the following 1.

Occasions when logs are automatically saved:

When the Switch is started
When a critical error with an event level from E9 to E5 occurs
When the device is restarted by using the reload operation command
When login or logout is performed
When the device is restarted accompanying ppupdate
When the device is restarted by pressing the RESET button

Table 1-5: Log storage destinations
Log type	Location of internal memory
Operation log	Logs are saved to /usr/var/log/system.log
Reference log	Logs are saved to /usr/var/log/error.log

(3) How to create a log file

Operation logs and type logs can be retrieved as files. by specifying redirection when executing the show logging command. If you want to output command output results to a file for a command other than the show logging command, you also must specify redirection. The following table describes the directory for storing the created files when redirection is specified for a command.

Table 1-6: Storage directories
Item	Storage directory	Remarks
Home directory for the user	/usr/home/<user-account-name>/	Stored in internal memory
Temporary directory	/tmp/	When the switch stops due to power discontinuity or the reload command, stored files will be deleted.

The following shows an example of creating a backup of log information by executing the show logging command.

Backing up the operation log in internal memory:

> show logging > /usr/home/<User Account Names>/<File Name>
>