20 May

Filtering out ISDN-6-CONNECT/DISCONNECT log messages

If you already implemented central logging, and you have also a Voice Gateway in your network, it is very annoying, that your logs are filled with ISDN-6-CONNECT/DISCONNECT messages, like this:

335414: May 19 19:07:49 CEST: %ISDN-6-CONNECT: Interface Serial0/0/0:26 is now connected to xxx N/A
335415: May 19 19:07:51 CEST: %ISDN-6-DISCONNECT: Interface Serial0/0/0:26 disconnected from xxx , call lasted 2 seconds
335417: May 19 19:08:18 CEST: %ISDN-6-DISCONNECT: Interface Serial0/0/0:27 disconnected from xxx , call lasted 871 seconds
335418: May 19 19:08:20 CEST: %ISDN-6-CONNECT: Interface Serial0/0/0:30 is now connected to xxx N/

You have an option however, to filter out these type of log messages with Message discriminator. For example we can define our discriminator (in one line):

logging discriminator NOISDNLO severity drops 
6 facility drops ISDN msg-body drops connected

Here, we will drop log messages, which has a Severity of 6, a facility of “ISDN” and the message body contains “connected” word. Be careful to not filter out important messages.

Once you defined your discriminator, you can tie it to a syslog session, or to the console / monitor / buffer objects.

logging host 1.1.1.1 discriminator NOISDNLO
logging console discriminator NOISDNLO
logging monitor discriminator NOISDNLO

You can check the result with the show logging command:

RouterA#sh logging
Syslog logging: enabled (0 messages dropped, 1612 messages rate-limited,
1 flushes, 0 overruns, xml disabled, filtering disabled)

Active Message Discriminator:
NOISDNLO severity group drops 6
facility drops ISDN
msg-body drops connected

No Inactive Message Discriminator.

Console logging: level debugging, 139092 messages logged, xml disabled,
filtering disabled, discriminator(NOISDNLO),
0 messages rate-limited, 198075 messages dropped-by-MD
Monitor logging: level debugging, 30127 messages logged, xml disabled,
filtering disabled, discriminator(NOISDNLO),
0 messages rate-limited, 198075 messages dropped-by-MD
Logging to: vty514(0)
Buffer logging: level debugging, 337323 messages logged, xml disabled,
filtering disabled
Logging Exception size (4096 bytes)
Count and timestamp logging messages: disabled
Persistent logging: disabled

No active filter modules.

ESM: 0 messages dropped

Trap logging: level informational, 337330 message lines logged
Logging to 1.1.1.1 (udp port 514, audit disabled,
authentication disabled, encryption disabled, link up),
139255 message lines logged,
0 message lines rate-limited,
198075 message lines dropped-by-MD,
xml disabled, sequence number disabled
filtering enabled, discriminator (NOISDNLO)

You can read more about the feature here.