Logging

In the EcoRouterOS all the events (operations, configuration changes) are recorded, i.e. logged. By default the event log is located on the device itself.

Messages about events are written in two formats, described below.

The actions performed by services (daemons) of the system generate the messages in the following format:

><DATE> <TIME> [VERBOSE] [SERVICE] <MESSAGE>

The actions performed by users generate the messages in the following format:

<DATE> <TIME> [VERBOSE] [IMISH] AUDIT [USER] <MESSAGE>

The parameters of the conditional recording of message formats are described in the table below.

Use the show log command in the administration mode to display and write the event log into file.

The command synthax is: show log (all |) (excessive |) (lines <NUM> |) (follow |reverse|). Also other modificators are available just like for all commnads from the show group.

Follow the show log command by the | redirect <FILE> modifier or its short form > to write the command's output to specified file:

ecorouter#show log > Text1.log

Use the show log command as is to display all messages from the system log since the device was booted on the console.

ecorouter#show log

>2016-10-26 13:55:28.490128 [info] [ecolog] writer thread started

>2016-10-26 13:55:28.490128 [info] [ecolog] reader thread started

>2016-10-26 13:55:28.490128 [info] [ecolog] listener thread started

>2016-10-26 13:55:28.490128 [info] [ecolog] watchdog thread started

>2016-10-26 13:55:28.490128 [info] [ecolog] Ecolog v1.0 connection request[0]: 1

>2016-10-26 13:55:28.490128 [info] [ecolog] Ecolog v1.0 connection request[0]: OK

>2016-10-26 13:55:28.490128 [info] [ecolog] [0] reader thread started

>2016-10-26 13:55:28.490128 [info] [ecobus] reader thread started

>2016-10-26 13:55:28.490128 [info] [ecobus] listener thread started

>2016-10-26 13:55:28.490128 [info] [ecobus] watchdog thread started

...

Use the show log command with the all parameter to display all the messages from journalctl on the console.

Use the show log command with the exessive parameter to display messages from the system log with additional information about the file, function and source file line on the console.

ecorouter#show log excessive

>2016-10-27 12:25:10.571110 [info] [ecolog] [src/writer.c:263,ecolog_writer_thread_proc] writer thread started

>2016-10-27 12:25:10.571110 [info] [ecolog] [src/reader.c:295,ecolog_reader_thread_proc] reader thread started

>2016-10-27 12:25:10.571110 [info] [ecolog] [src/listener.c:380,ecolog_listener_thread_proc] listener thread started

>2016-10-27 12:25:10.571110 [info] [ecolog] [src/watchdog.c:197,ecolog_watchdog_thread_proc] watchdog thread started

>2016-10-27 12:25:12.571112 [info] [ecolog] [src/listener.c:212,ecolog_listener_accept] Ecolog v1.0 connection request[2]: 1

>2016-10-27 12:25:12.571112 [info] [ecolog] [src/listener.c:225,ecolog_listener_accept] Ecolog v1.0 connection request[2]: OK

>2016-10-27 12:25:12.571112 [info] [ecolog] [src/reader.c:155,ecolog_reader_session_thread_proc] [2] reader thread started

>2016-10-27 12:25:12.571112 [info] [IMI] [log.c:311,openzlog] trace started

>2016-10-27 12:25:12.571112 [info] [IMI] [imi_ercp.c:488,imi_ercp_init] -> imi_ercp_init []

>2016-10-27 12:25:12.571112 [info] [IMI] [imi_ercp.c:750,imi_ercp_platform_init] -> imi_ercp_platform_init []

>2016-10-27 12:25:12.571112 [info] [IMI] [imi_ercp_snmp.c:318,imi_ercp_snmp_init] -> imi_ercp_snmp_init [snmp_config Ox00000000]

>2016-10-27 12:25:12.571112 [info] [IMI] [imi_ercp_snmp.c:382,imi_ercp_snmp_init] <- imi_ercp_snmp_init: 0x0

...

Use the show log command with the lines <NUM> parameter to display last several messages where <NUM> is the number of messages.

ecorouter#show log lines 10

>2016-10-27 12:25:29.571129 [info] [OSPF] OSPFd (3.2.1) starts

>2016-10-27 12:25:29.571129 [info] [IMI] imi_server_send_config called (PM 4)

>2016-10-27 12:25:29.571129 [info] [IMI] imi_server_send_config called (PM 44)

>2016-10-27 12:25:29.571129 [info] [BGP] BGPd 3.2.1 starting: vty@2605, bgp@179

>2016-10-27 12:25:29.571129 [info] [IMI] imi_server_send_config called (PM 44)

>2016-10-27 12:25:30.571130 [info] [ecolog] Ecolog v1.0 connection request[11]: 1

>2016-10-27 12:25:30.571130 [info] [ecolog] Ecolog v1.0 connection request[11]: OK

>2016-10-27 12:25:30.571130 [info] [ecolog] [11] reader thread started

>2016-10-27 12:25:30.571130 [info] [PIM] trace started

>2016-10-27 12:25:30.571130 [info] [IMI] imi_server_send_config called (PM 11)

Use the show log command with the follow parameter to display the continious log message stream. Disable the pager to see the continious log message stream: show log follow | nopager.

Use the show log command with the reverse parameter to display the log message stream in reverse order.

Several parameters and modifier can be used at the same time.

ecorouter#show log excessive lines 2

>2016-10-27 14:14:20.577660 [info] [ecobus] [src/listener.c:351,ecobus_listener_accept] Ecobus v1.0 connection request[7109]: 0/2/0

>2016-10-27 14:14:20.577660 [info] [ecobus] [src/listener.c:366,ecobus_listener_accept] Ecobus v1.0 connection request[7109]: OK

For example, use the following command to display the only messages related to user actions:

ecorouter#show log all | include IMISH

 2016-10-27 12:25:43.571143 [info] [IMISH] AUDIT Logged in user

 2016-10-27 12:25:43.571143 [info] [IMISH] AUDIT [admin] logged in

>2016-10-27 12:25:43.571143 [info] [IMISH-1648] trace started

 2016-10-27 12:25:46.571146 [info] [IMISH] AUDIT ER user

 2016-10-27 12:25:46.571146 [info] [IMISH] AUDIT [admin] logged in

 2016-10-27 12:25:48.571148 [info] [IMISH] AUDIT [admin] en

 2016-10-27 12:26:29.571189 [info] [IMISH] AUDIT [admin] terminal monitor

 2016-10-27 12:26:47.571207 [info] [IMISH] AUDIT [admin] conf t

 2016-10-27 12:26:58.571218 [info] [IMISH] AUDIT [admin]  port te0

 2016-10-27 12:28:11.571291 [info] [IMISH] AUDIT [admin]

 2016-10-27 12:28:42.571322 [info] [IMISH] AUDIT [admin]  service-instance 100

 2016-10-27 12:29:02.571342 [info] [IMISH] AUDIT [admin] ex

 2016-10-27 12:29:05.571345 [info] [IMISH] AUDIT [admin] ex

For additional control over the actions performed, it is possible to output log messages to the console in real time.
Use the terminal monitor command in the administration mode to enable this function. Use the no terminal monitor command in the administration mode to disable log message output to the console.

Debug enabling and disabling

For each component of the system the debug commands described in this section are valid.

Use the debug <SUBSYSTEM> command to enable debugging for a specific subsystem where <SUBSYSTEM> is subsystem name. This command is available both in administration and configuration mode. Use this command in the configuration mode it will be written tothe router's configuration.

Debug can be enabled not only for specific sybsustem but for specific option too, for example, debug nsm packet recv detail.

The list of available subsystems and parameters of this command are shown in the table below.

Use the no debug <SUBSYSTEM> command to disable debugging. This command is valid both in administration and configuration mode. The undebug <SUBSYSTEM> command is available only for susbsystems and operates only in administrative mode.

Use the no debug all and undebug all commands to disable debugging for all available subsystems.

Use the show debugging <SUBSYSTEM> command to display on the console the information of subsystem debugging where SUBSYSTEM is the subsystem name. This command is valid for the following subsystems: bgp, data-plane, igmp, isis, ldp, mrib, nsm, ospf, pim, rib, security-profile, vrrp.

Show log archive

In EcoRouterOS, in case of unforeseen situations, a log archives containig all necessary data for diagnostics are created. These files have the prefix "report" in the title. The file name also includes the date and the exact time of creation. All reports are stored locally on the router. To display them, use the show reports command. As a result of its execution, a list of log files with their size and the date and time of their creation is displayed.

ecorouter#show reports 
report-20171107T143644UTC-3.2.3.9.11254-develop-68fb7f7.tar.xz: 181 KB 2017-10-07 14:36:45
report-20171107T143606UTC-3.2.3.9.11254-develop-68fb7f7.tar.xz: 174 KB 2017-10-07 14:36:07

Delete log archive

Use the delete report <REPORT_NAME> command to delete unnecessary or old log archives where <REPORT_NAME> is the name of the archive to be deleted. To delete all archives, use the delete report all command.

ecorouter#show reports 
report-20171107T143644UTC-3.2.3.9.11254-develop.tar.xz: 181 KB 2017-10-07 14:36:45
report-20171107T143606UTC-3.2.3.9.11254-develop: 174 KB 2017-10-07 14:36:07
ecorouter#delete report report-20171107T143644UTC-3.2.3.9.11254-develop.tar.xz
ecorouter#show reports 
report-20171107T143606UTC-3.2.3.9.11254-develop.tar.xz: 174 KB 2017-10-07 14:36:07
ecorouter#delete report all 
ecorouter#show reports 
No reports found!
ecorouter#

Upload log archive to external server

A log archive can be uploaded to external FTP/TFTP-server. The command looks as following:

copy report {ftp | tftp} <REPORT_NAME> <URL>[<NEW_FILENAME>] {mgmt | vr default | vr <VRNAME>}

Here <REPORT_NAME>  is the log archive name to be uploaded, <URL> - server address with the user name and password, <NEW_FILENAME> - the new filename of log archive (in case there is a need to save it on the server under the name, different from the original).

The various use of the copy report command is shown in the table below.

copy report ftp REPORT_NAME ftp://user:password@xxx.xxx.xxx.xxx/ mgmt

copy report ftp REPORT_NAME ftp://user:password@xxx.xxx.xxx.xxx/filename vr default

copy report tftp REPORT_NAME tftp://xxx.xxx.xxx.xxx/ vr vrname

copy report tftp REPORT_NAME tftp://xxx.xxx.xxx.xxx/filename mgmt