Switching

Hi,

I have a 2xEX2300-48p virtual-chassi that sends these syslog messages 24/7 (around 128K per day):

Mar  8 15:06:11 *hostname* dc-pfe: ifd null, port 29
Mar  8 15:06:11 *hostname* fpc0 ifd null, port 29
Mar  8 15:06:15 *hostname* dc-pfe: ifd null, port 28
Mar  8 15:06:15 *hostname* fpc0 ifd null, port 28
Mar  8 15:06:16 *hostname* dc-pfe: ifd null, port 28
Mar  8 15:06:16 *hostname* fpc0 ifd null, port 28
Mar  8 15:06:17 *hostname* dc-pfe: ifd null, port 29
Mar  8 15:06:17 *hostname* fpc0 ifd null, port 29
Mar  8 15:06:17 *hostname* dc-pfe: ifd null, port 28
Mar  8 15:06:17 *hostname* fpc0 ifd null, port 28
Mar  8 15:06:18 *hostname* dc-pfe: ifd null, port 29
Mar  8 15:06:18 *hostname* fpc0 ifd null, port 29
Mar  8 15:06:19 *hostname* dc-pfe: ifd null, port 29
Mar  8 15:06:19 *hostname* fpc0 ifd null, port 29
Mar  8 15:06:24 *hostname* dc-pfe: ifd null, port 28
Mar  8 15:06:24 *hostname* fpc0 ifd null, port 28
Mar  8 15:06:25 *hostname* dc-pfe: ifd null, port 28
Mar  8 15:06:25 *hostname* fpc0 ifd null, port 28
Mar  8 15:06:25 *hostname* dc-pfe: ifd null, port 29
Mar  8 15:06:25 *hostname* fpc0 ifd null, port 29
Mar  8 15:06:26 *hostname* dc-pfe: ifd null, port 28
Mar  8 15:06:26 *hostname* fpc0 ifd null, port 28
Mar  8 15:06:26 *hostname* dc-pfe: ifd null, port 29
Mar  8 15:06:26 *hostname* fpc0 ifd null, port 29
Mar  8 15:06:27 *hostname* dc-pfe: ifd null, port 29
Mar  8 15:06:27 *hostname* fpc0 ifd null, port 29
Mar  8 15:06:32 *hostname* dc-pfe: ifd null, port 28
Mar  8 15:06:32 *hostname* fpc0 ifd null, port 28
Mar  8 15:06:33 *hostname* dc-pfe: ifd null, port 28
Mar  8 15:06:33 *hostname* fpc0 ifd null, port 28
Mar  8 15:06:33 *hostname* dc-pfe: ifd null, port 29
Mar  8 15:06:33 *hostname* fpc0 ifd null, port 29
Mar  8 15:06:34 *hostname* dc-pfe: ifd null, port 28
Mar  8 15:06:34 *hostname* fpc0 ifd null, port 28
Mar  8 15:06:34 *hostname* dc-pfe: ifd null, port 29
Mar  8 15:06:34 *hostname* fpc0 ifd null, port 29
Mar  8 15:06:35 *hostname* dc-pfe: ifd null, port 29
Mar  8 15:06:35 *hostname* fpc0 ifd null, port 29

What on earth does it mean?

show interface ifd-index 28:

root@hostname> show interfaces ifd-index 28
  Logical interface .local..0 (Index 0) (SNMP ifIndex 0)
    Flags: Down Point-To-Point Encapsulation: Unspecified
    Protocol inet, MTU: Unlimited
      Flags: None
      Addresses, Flags: Is-Primary
        Local: 10.1.1.4
    Protocol iso, MTU: Unlimited
      Flags: None
    Protocol inet6, MTU: Unlimited
    Max nh cache: 0, New hold nh limit: 0, Curr nh cnt: 0, Curr new hold cnt: 0, NH drop cnt: 0
      Flags: None
    Protocol mpls, MTU: Unlimited, Maximum labels: 3
      Flags: None
    Protocol eth-switch, MTU: Unlimited
      Flags: None
    Protocol 56, MTU: Unlimited
      Flags: None
    Protocol 57, MTU: Unlimited
      Flags: None
    Protocol 60, MTU: Unlimited
      Flags: None
    Protocol 61, MTU: Unlimited
      Flags: None

show interface ifd-index 29:

root@hostname> show interfaces ifd-index 29
  Logical interface .local..0 (Index 0) (SNMP ifIndex 0)
    Flags: Down Point-To-Point Encapsulation: Unspecified
    Protocol inet, MTU: Unlimited
      Flags: None
      Addresses, Flags: Is-Primary
        Local: 10.1.1.4
    Protocol iso, MTU: Unlimited
      Flags: None
    Protocol inet6, MTU: Unlimited
    Max nh cache: 0, New hold nh limit: 0, Curr nh cnt: 0, Curr new hold cnt: 0, NH drop cnt: 0
      Flags: None
    Protocol mpls, MTU: Unlimited, Maximum labels: 3
      Flags: None
    Protocol eth-switch, MTU: Unlimited
      Flags: None
    Protocol 56, MTU: Unlimited
      Flags: None
    Protocol 57, MTU: Unlimited
      Flags: None
    Protocol 60, MTU: Unlimited
      Flags: None
    Protocol 61, MTU: Unlimited
      Flags: None

my irb.500 interface, which I use for management has IP 10.1.1.4.

root@hostname> show interfaces irb.500
  Logical interface irb.500 (Index 651) (SNMP ifIndex 717)
    Flags: Up SNMP-Traps 0x4004000 Encapsulation: ENET2
    Bandwidth: 1000mbps
    Routing Instance: default-switch Bridging Domain: MGMT-INTERNAL
    Input packets : 224490
    Output packets: 6157558
    Protocol inet, MTU: 1500
      Flags: Sendbcast-pkt-to-re, Is-Primary
      Addresses, Flags: Is-Default Is-Preferred Is-Primary
        Destination: 10.1.1/24, Local: 10.1.1.4, Broadcast: 10.1.1.255

How do I stop these messages from being generated? And if I can't and there's nothing to worry about, how do I stop them from being sent to my syslog server?

thanks in advance

best regards,

Peter

These are non-impacting logs, Do you see any impact due to these logs?

you can suppress them using below kb if you wish.

https://kb.juniper.net/InfoCenter/index?page=content&id=KB22177

You can refer to this PR as well

https://prsearch.juniper.net/InfoCenter/index?page=prcontent&id=PR1295711

Hi,

I don't see any impact at all. I have now exluded the log messages from local messages and being sent to my syslog server.

Thank you so much for answering my questions and making me aware of Problem report search 🙂

Best regards,

Peter

I'm having this same issue. I already added something to filter them out from the switch logs when I look at them locally, but for some reason I still get thousands of them in my syslog server. 

Do I need to do something different to filter them from syslog? 

Thank you

Hello trink,

Suggest you take this to another post if you have tried this and it didn't work:

https://kb.juniper.net/InfoCenter/index?page=content&id=KB22177

Hope this helps.

Regards,
-r.

--------------------------------------------------

If this solves your problem, please mark this post as "Accepted Solution."
Kudos are always appreciated :).

When you filter messages in syslog you need the match conditions to appear under BOTH the file stanza and the syslog server stanza for it to affect both.

In other words the match condition limits only apply to the specific section of logging where they appear in the stanza.

Thanks guys,

Below is what I have in the config to filter this message and a few others I was getting, it seems to work for my other juniper switches, only one of the stacks is filling my syslog with that error.

set system syslog file messages match "! (ifd null) | (pfe_bcm_l2_mac_delete|pfe_bcm_l2_mac_add) | (.*loadDefaultService:: supported on tomca t only.*)"

set system syslog file messages match "! (ifd null) | (pfe_bcm_l2_mac_delete|pfe_bcm_l2_mac_add) | (.*loadDefaultService:: supported on tomca t only.*)"

This stanza is not sending any syslog to an external server as it is not configured only the local file.

There will be an additional section with server and the ip address for those forwarding syslog.  In those cases you need to include this same match condition under the server section in addition to the one under file.