Index
System Logs
Audit Logs
What is system log?
System log file or syslog is record of all logging-enabled transactions of various process in a switch. Syslog alerts are generated for significant events on the system. They include events such as, memory utilization, disk partition utilization, CPU thresholds, and so on.
System logs are enabled by default. This information can help the switch administrator troubleshoot issues related to switch and network.
Log messages are classified based on severity level.
The log message levels are:
Severity |
Level |
Debugging |
7 |
Informational |
6 |
Notification |
5 |
Warnings |
4 |
Errors |
3 |
Critical |
2 |
Alerts |
1 |
Emergencies |
0 |
How to view System log messages
Dell Networking SONiC system logs can be viewed using the below command:
Sample Output
show logging
DELLSONiC# show logging
Jul 04 17:22:05.528854+00:00 2023 sonic NOTICE syncd#syncd: :- setPort: setting admin UP on eth1 Eth1/1 portId oid:0x100000001
Jul 04 17:22:05.531292+00:00 2023 sonic NOTICE l2mcd#l2mcmgrd: :- doL2McInterfaceUpdateTask: L2MCD_CFG: IF:Eth1/1 op:SET oper:0
Jul 04 17:22:05.535991+00:00 2023 sonic NOTICE l2mcd#Logs: l2mcd_port_list_update PortInfo RX: Eth1/1, ifidx:4096 oper:1 is_add:1 is_lag:0, kif:29 rx_sock:56
Jul 04 17:22:05.536061+00:00 2023 sonic NOTICE syncd#syncd: :- syncOnLinkMsg: newlink: ifindex: 3, ifflags: 0x1103, ifname: eth1
Jul 04 17:22:05.536185+00:00 2023 sonic NOTICE syncd#syncd: :- asyncOnLinkMsg: received RTM_NEWLINK ifname: eth1, ifflags: 0x11143, ifindex: 3
Jul 04 17:22:05.537401+00:00 2023 sonic NOTICE swss#orchagent: :- doTask: Get port state change notification id:1000000000002 status:1
Jul 04 17:22:05.537401+00:00 2023 sonic NOTICE swss#orchagent: :- updatePortOperStatus: Port Eth1/1 oper state set from down to up
How to view System log messages count
Dell SONiC stores a lot of log messages. To view the number of log messages, use the below command:
Sample Output
show logging count
DELLSONiC# show logging count
438
How to view latest System log messages
Often it is useful to see the latest log messages. Use the below command to view the messages:
Sample Output
show logging lines <Number of log messages>
DELLSONiC# show logging lines 3
Jul 04 17:24:18.550108+00:00 2023 sonic NOTICE syncd#syncd: :- process_packet_for_fdb_event: Learn New MAC V:1 P:1/0/0
Jul 04 17:24:18.550108+00:00 2023 sonic WARNING syncd#syncd: :- findBridgeVlanForPortVlan: failed to find bv_id for vlan 1 and port_id oid:0x100000001
Jul 04 17:24:18.550108+00:00 2023 sonic WARNING syncd#syncd: :- process_packet_for_fdb_event: skipping mac learn for {"bvid":"oid:0x0","mac":"00:00:5E:00:01:01","switch_id":"oid:0x2100000000"}, since BV_ID was not found for mac
How to view log messages with a specific pattern
You can grep ( | ) to search for Log messages of a specified pattern. Use the below command to grep:
In bellow example, we are viewing log messages which have a pattern Eth1/1.
Sample Output
show logging | grep <pattern>
DELLSONiC# show logging | grep Eth1/1
Jul 04 17:22:01.141637+00:00 2023 sonic NOTICE l2mcd#l2mcmgrd: :- doL2McInterfaceUpdateTask: L2MCD_CFG: IF:Eth1/1 op:SET oper:0
Jul 04 17:22:01.142410+00:00 2023 sonic NOTICE l2mcd#l2mcmgrd: :- doL2McInterfaceUpdateTask: L2MCD_CFG: IF:Eth1/1 op:SET oper:0
Jul 04 17:22:01.142410+00:00 2023 sonic NOTICE l2mcd#Logs: l2mcd_port_list_update PortInfo RX: Eth1/1, ifidx:4096 oper:0 is_add:1 is_lag:0, kif:29 rx_sock:56
Jul 04 17:22:01.151251+00:00 2023 sonic NOTICE macsec#hostapdmgrd: :- processHostapdConfigPortTblEvent: Received Eth1/1 as key and SET as OP
How to send log message to remote Syslog server
Dell SONiC can send system logs to a remote server. Use the below command:
In bellow sample command, we are sending log messages to remote syslog-server 192.168.1.10. If you are specifying a hostname, ensure to configure name server.
Sample Output
logging server <ip-address/hostname>
DELLSONiC#
DELLSONiC# configure terminal
DELLSONiC(config)# logging server 192.168.1.10
You can also specify port number, source interface, severity, or vrf.
How to clear system logs
To clear system log files, use the below command:
Sample Output
clear logging
DELLSONiC# clear logging
What is audit Log?
All User activity in a Dell SONiC switch like a login, configuration changes is recorded in audit logs. An audit log is handy while doing security audits.
The audit log records the following:
- User Login and logout using SSH or Console
- All show commands and configuration run using Dell SONiC CLI, gNMI, and REST API operations.
How to view audit Logs
Use the below command to view audit logs
Sample Output
show audit-log
DELLSONiC# show audit-log
Jul 04 17:31:40.664313+00:00 2023 DELLSONiC INFO mgmt-framework#sonic-cli: User "admin" command "exit" status - success
Jul 04 17:31:32.701465+00:00 2023 DELLSONiC INFO mgmt-framework#sonic-cli: User "admin" command "exit" status - success
Jul 04 17:31:31.206452+00:00 2023 DELLSONiC INFO mgmt-framework#sonic-cli: User "admin" command "no shutdown" status - success
Jul 04 17:31:29.227217+00:00 2023 DELLSONiC INFO mgmt-framework#sonic-cli: User "admin" command "interface Eth1/1" status - success
Jul 04 17:31:25.474110+00:00 2023 DELLSONiC INFO mgmt-framework#clish[161]: User "admin" command "configure terminal" status - success
Jul 04 17:31:23.480896+00:00 2023 DELLSONiC INFO mgmt-framework#clish[161]: User "admin" command "startup" status - success
Jul 04 17:31:23.455134+00:00 2023 DELLSONiC INFO mgmt-framework#sonic-cli: message repeated 2 times: [ User "admin" command "exit" status - success]
Jul 04 17:31:19.567044+00:00 2023 DELLSONiC INFO login[21895]: pam_unix(login:session): session opened for user admin by LOGIN(uid=0)
We can see from the above output that user admin has shutdown interface Eth1/1 on July 04 17:31.
How to clear audit logs.
Use the below command to clear audit logs:
Sample Output
clear audit-log
DELLSONiC# clear audit-log
We can see the clear audit-log is cleared and the first entry shows audit-log is cleared and the time
DELLSONiC# show audit-log
Jul 04 17:32:47.835891+00:00 2023 DELLSONiC INFO mgmt-framework#sonic-cli: User "admin" command "clear audit-log" status - success
DELLSONiC#
NOTE: Only users with admin role can view and clear the audit log.
For further assistance, see
Dell Support Enterprise SONiC Distribution Product Page to view Enterprise SONiC User Guide Release Documentation or reach out to Dell Technologies Support.