Filtering out ISDN-6-CONNECT/DISCONNECT log messages

May 20th, 2011 | Tags: , ,

If you already implemented central logging, and you have also a Voice Gateway in your network, it is very annoying, that your logs are filled with ISDN-6-CONNECT/DISCONNECT messages, like this:

335414: May 19 19:07:49 CEST: %ISDN-6-CONNECT: Interface Serial0/0/0:26 is now connected to xxx N/A
335415: May 19 19:07:51 CEST: %ISDN-6-DISCONNECT: Interface Serial0/0/0:26 disconnected from xxx , call lasted 2 seconds
335417: May 19 19:08:18 CEST: %ISDN-6-DISCONNECT: Interface Serial0/0/0:27 disconnected from xxx , call lasted 871 seconds
335418: May 19 19:08:20 CEST: %ISDN-6-CONNECT: Interface Serial0/0/0:30 is now connected to xxx N/

You have an option however, to filter out these type of log messages with Message discriminator. For example we can define our discriminator (in one line):

logging discriminator NOISDNLO severity drops 
6 facility drops ISDN msg-body drops connected

Here, we will drop log messages, which has a Severity of 6, a facility of “ISDN” and the message body contains “connected” word. Be careful to not filter out important messages.

Once you defined your discriminator, you can tie it to a syslog session, or to the console / monitor / buffer objects.

logging host 1.1.1.1 discriminator NOISDNLO
logging console discriminator NOISDNLO
logging monitor discriminator NOISDNLO

You can check the result with the show logging command:

RouterA#sh logging
Syslog logging: enabled (0 messages dropped, 1612 messages rate-limited,
1 flushes, 0 overruns, xml disabled, filtering disabled)

Active Message Discriminator:
NOISDNLO severity group drops 6
facility drops ISDN
msg-body drops connected

No Inactive Message Discriminator.

Console logging: level debugging, 139092 messages logged, xml disabled,
filtering disabled, discriminator(NOISDNLO),
0 messages rate-limited, 198075 messages dropped-by-MD
Monitor logging: level debugging, 30127 messages logged, xml disabled,
filtering disabled, discriminator(NOISDNLO),
0 messages rate-limited, 198075 messages dropped-by-MD
Logging to: vty514(0)
Buffer logging: level debugging, 337323 messages logged, xml disabled,
filtering disabled
Logging Exception size (4096 bytes)
Count and timestamp logging messages: disabled
Persistent logging: disabled

No active filter modules.

ESM: 0 messages dropped

Trap logging: level informational, 337330 message lines logged
Logging to 1.1.1.1 (udp port 514, audit disabled,
authentication disabled, encryption disabled, link up),
139255 message lines logged,
0 message lines rate-limited,
198075 message lines dropped-by-MD,
xml disabled, sequence number disabled
filtering enabled, discriminator (NOISDNLO)

You can read more about the feature here.

(Visited 995 times, 1 visits today)
  1. Aman
    August 29th, 2011 at 08:09
    Reply | Quote | #1

    thanks. thats helpful

  2. January 24th, 2012 at 14:30
    Reply | Quote | #2

    nagyon hasznos infókat teszel közzé, de a sablon által a fehér keretbe foglalt, szürke háttér és fekete betű olvashatatlan, esetleg ezt megváltoztathatnád, de ez csak egy észrevétel..

    • xcke
      July 4th, 2012 at 16:45
      Reply | Quote | #3

      Igaz 🙂 Ezt majd áthackeljük!

  3. Brian
    December 7th, 2012 at 22:27
    Reply | Quote | #4

    no logging event link-status (on seriel interface ie 0/0/0:23)

  4. xcke
    January 8th, 2013 at 10:55
    Reply | Quote | #5

    Hi Brian,

    Thanks 🙂

  5. January 9th, 2013 at 11:21
    Reply | Quote | #6

    thank you
    thank you ~~~~

  6. Baanjo
    February 11th, 2014 at 11:23
    Reply | Quote | #7

    Hello,

    I believe that in your example, we will drop all log messages, which has a Severity of 6, all log messages with a facility of “ISDN”, and all log messages with the message body contains “connected”. Is that correct?

    I would like to filther out log messages, which has a Severity of 6, AND a facility of “ISDN” AND the message body contains “connected” word.
    Can you please advise how can this be done?

    Thanks,

  7. xcke
    February 13th, 2014 at 09:29
    Reply | Quote | #8

    Hi,

    Have you tried the example what is in the post?