ArubaOS-Switch - How To Disable Events In The Switch Event Logs
How can I disable event log messages that I don't want to see in my switch event logs?
Normally it is recommended to leave all messages enabled in the switch event logs. However, on occasion, the logs may be flooded with events that you want to disable either temporarily or permanently.
These same events can be sent to a syslog server as well.
Normally, to keep Informational messages such as Port offline/online or “blocked by STP” from filling your syslog, you can chose a severity level of Warning to only send Warning and above messages to your syslog server. The command to enable this would be:
logging severity warning
Once this is enabled, these informational message will no longer be sent to the syslog server. However, they will still show up in the switch event logs.
If you don’t want the messages to show up in the switch event logs or the syslog server, there are two ways to stop these messages from occurring:
Option 1) You could to use the “logging filter” commands to filter out the events you don’t want to see any more. These will show up in your config file so you can see which event filters have been configured and easily enable/disable them.
Option 2) Use can use SNMP or SetMIB via the CLI to turn these events off or on. These do not show up on the config file so you are not able to easily determine when this event filter is configured.
I will explain both options.
Option 1) Filtering out the events using the "logging filter" command:
There are multiple steps to enable this feature. First, you would need to create a named filter, and second, you would need to enable that filter before it will block the event messages.
The syntax to configure a logging filter is:
logging filter <name> <sequence #> <”event”> deny
To enable the filter, you would use the following command:
logging filter <name> enable.
For example, if you only want to filter out the “blocked by STP” messages, you could configure the following:
logging filter nobpdu 10 “Blocked by STP” deny
logging filter nobpdu enable
If you are wanting to filter out the “blocked by STP” messages and the offline/online event messages, you could configure the following
logging filter noUpDownBPDU 10 “is now on-line” deny
logging filter noUpDownBPDU 20 “is now off-line” deny
logging filter noUpDownBPDU 30 “Blocked by STP” deny
logging filter noUpDownBPDU enable
If you need these to get logged for certain ports, but not others, there are additional commands you can use to specify ports to deny and/or permit the events to occur on. Here is a link to a document that goes into more detail about configuring ports to permit and deny based upon the port numbers:
Option 2) Disable events via SetMIB/SNMP:
In the event log, you will see the event ID listed after the date/time stamp:
I 12/28/17 15:04:45 00077 ports: SM2: port J15 is now off-line
I 12/28/17 15:04:48 00435 ports: AM1: port J15 is Blocked by STP
I 12/28/17 15:04:48 00076 ports: AM1: port J15 is now on-line
Offline Event ID = 77
Online Event ID = 76
Blocked by STP Event ID = 435
OID: 184.108.40.206.220.127.116.11.1.1.3 can be used to set the log value:
(Default vlaue = 4 Log and Trap)
Set to 1 to disable:
setMIB 18.104.22.168.22.214.171.124.1.1.3.<event-id> -i 1
From the CLI of the switch, issue the setMIB command to turn off these events:
Disable Offline Log Messages:
setMIB 126.96.36.199.188.8.131.52.184.108.40.206 -i 1
Disable Online Log Messages:
setMIB 220.127.116.11.18.104.22.168.22.214.171.124 -i 1
Disable "Blocked by STP" Log Messages:
setMIB 126.96.36.199.188.8.131.52.184.108.40.2065 -i 1
If you want to set them back to the defaults at a later time, use a value of 4 to re-enable them.
setMIB 220.127.116.11.18.104.22.168.22.214.171.124 -i 4
setMIB 126.96.36.199.188.8.131.52.184.108.40.206 -i 4
setMIB 220.127.116.11.18.104.22.168.22.214.171.1245 -i 4
If you want to see the current log value configured for all event IDs, use the following command:
For a full list of all event IDs use the following command:
For additional examples, see the following online document: