Cisco Logs Question

[thawk10]

I am recieving the following logs on my syslog server from a few of my Cisco Switches. Has anybody seen these? If so, could you please explain what these mean? Is this a problem with my switches?

May 9 21:33:28 10.10.10.37 49: 11w3d: %RTD-1-ADDR_FLAP: GigabitEthernet0/1 relearning 5 addrs per min
May 10 08:33:37 10.10.10.29 71074: 46w4d: %RTD-1-ADDR_FLAP: GigabitEthernet0/2 relearning 5 addrs per min
May 10 08:33:43 10.10.10.37 50: 11w3d: %RTD-1-ADDR_FLAP: GigabitEthernet0/1 relearning 5 addrs per min
May 10 15:33:39 10.10.10.29 71088: 46w4d: %RTD-1-ADDR_FLAP: GigabitEthernet0/2 relearning 5 addrs per min
May 10 23:00:16 10.10.10.37 51: 11w4d: %RTD-1-ADDR_FLAP: GigabitEthernet0/1 relearning 5 addrs per min

I have been looking on the internet for answers but have been unable to find a good explanation. Any help would be appreciated.

 

[JOAMON]

RTD Messages
This section contains the Runtime Diagnostic (RTD) error messages.

Error Message RTD-1-ADDR_FLAP [chars] relearning [dec] addrs per min

Explanation Normally, MAC addresses are learned once on a port. Occasionally, when a switched network reconfigures, due to either manual or STP reconfiguration, addresses learned on one port are relearned on a different port. However, if there is a port anywhere in the switched domain that is looped back to itself, addresses will jump back and forth between the real port and the port that is in the path to the looped back port. In this message, [chars] is the interface, and [dec] is the number of addresses being learnt.

Recommended Action Determine the real path (port) to the MAC address. Use the debug ethernet-controller addr privileged EXEC command to see the alternate path-port on which the address is being learned. Go to the switch attached to that port. Note that the show cdp neighbors command is useful in determining the next switch. Repeat this procedure until the port is found that is receiving what it is transmitting, and remove that port from the network.

Error Message RTD-1-LINK_FLAP [chars] link down/up [dec] times per min

Explanation This message means that an excessive number of link down-up events has been noticed on this interface: [chars] is the interface, and [dec] is the number of times the link goes up and down. This might be the result of reconfiguring the port, or it might mean a faulty device at the other end of the connection.

Recommended Action If someone is reconfiguring the interface or device at the other side of the interface, ignore this message. However, if no one is manipulating the interface or device at the other end of the interface, it is likely that the Ethernet transceiver at one end of the link is faulty and should be replaced.

 

[ADB100]

This could be a unicast flooding issue, which is quite common in Layer-2 networks with multiple switches:

http://www.cisco.com/en/US/products/hw/switches/ps700/products_tech_note09186a00801d0808.shtml

If it is this then you can tweak the ARP & CAM timers to try to compensate but really the network should be designed and implemented correctly to avoid these issues.

If this isn't your problem it could be a server or appliance clustering issue where an application (or server etc) shares a common MAC address across multiple hosts and/or NICs?


Andy

 

[thawk10]

Joamon,

I have put in the "debug ethernet-controller addr" command. Shouldn't I recieve some output? Sorry, I'm not very Cisco "savvy".

Thanks for all your help.

 

[ADB100]

Are you on the console or telnet? If the console check the fisrt bit of the output of the 'show log' command and make sure logging to the console is enabled. If you are telnet'd in then type 'terminal monitor' to enable the debug commands to be sent to the telnet sesssion.

Andy