Key Syslog Messages:

Key Syslog Messages Logged By IPSO Appliance In IPSO 4.2 Version

Version 1.0 Date 10/12/2006

COPYRIGHT 2006 Nokia. All rights reserved. Rights reserved under the copyright laws of the United States. RESTRICTED RIGHTS LEGEND Use, duplication, or disclosure by the United States Government is subject to restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS 252.227-7013. Notwithstanding any other license agreement that may pertain to, or accompany the delivery of, this computer software, the rights of the United States Government regarding its use, reproduction, and disclosure are as set forth in the Commercial Computer Software-Restricted Rights clause at FAR 52.227-19. IMPORTANT NOTE TO USERS This software and hardware is provided by Nokia Inc. as is and any express or implied warranties, including, but not limited to, implied warranties of merchantability and fitness for a particular purpose are disclaimed. In no event shall Nokia, or its affiliates, subsidiaries or suppliers be liable for any direct, indirect, incidental, special, exemplary, or consequential damages (including, but not limited to, procurement of substitute goods or services; loss of use, data, or profits; or business interruption) however caused and on any theory of liability, whether in contract, strict liability, or tort (including negligence or otherwise) arising in any way out of the use of this software, even if advised of the possibility of such damage. Nokia reserves the right to make changes without further notice to any products herein. TRADEMARKS Nokia is a registered trademark of Nokia Corporation. Other products mentioned in this document are trademarks or registered trademarks of their respective holders.

IPSO Key Syslog Messages

IPSO Key Syslog Messages

Nokia Contact Information Corporate Headquarters Web Site http://www.nokia.com

Telephone 1-888-477-4566 or 1-650-625-2000 Fax 1-650-691-2170

Mail Address Nokia Inc. 313 Fairchild Drive Mountain View, California 94043-2215 USA Regional Contact Information Americas Nokia Inc. 313 Fairchild Drive Mountain View, CA 94043-2215 USA Tel: 1-877-997-9199 Outside USA and Canada: +1 512-437-7089 email: info.ipnetworking_americas@nokia.com Europe, Middle East, and Africa Nokia House, Summit Avenue Southwood, Farnborough Hampshire GU14 ONG UK Tel: UK: +44 161 601 8908 Tel: France: +33 170 708 166 email: info.ipnetworking_emea@nokia.com Asia-Pacific 438B Alexandra Road #07-00 Alexandra Technopark Singapore 119968 Tel: +65 6588 3364 email: info.ipnetworking_apac@nokia.com Nokia Customer Support Web Site: Email: https://support.nokia.com/ tac.support@nokia.com

Americas Europe Voice: 1-888-361-5030 or 1-613-271-6721 Voice: Fax: 1-613-271-8782 Asia-Pacific Voice: +65-67232999 Fax: +65-67232897

+44 (0) 125-286-8900 Fax: +44 (0) 125-286-5666

IPSO Key Syslog Messages

IPSO Key Syslog Messages

INTRODUCTION The purpose of this document is to record important syslog messages logged by an IPSO appliance in IPSO 4.2 version. Most of these syslog messages are self-descriptive, others have a description attached to it. The document is organized as follows: o Syslog Overview o o o o What is syslog? What is the format of a syslog message? What are the key syslog messages logged by IPSO appliance in IPSO 4.2 version?

Syslog messages logged by IPSO appliance

SYSLOG OVERVIEW What is syslog? Syslog protocol allows a machine to send system notification messages either to a remote syslog server or locally to a /var/log/messages file. These messages are useful in monitoring the state of an appliance and also for troubleshooting in case of failures. What is the format of a syslog message? The format of a syslog message is as follows: <Date> <Time> <Level> <Daemon/Process><Process ID>: <Syslog message> Where, Date and Time consitutes the timestamp of the logged syslog message. Level is defined as: LOG_EMERG: A panic condition LOG_ALERT: An alert notification like corruption in database LOG_CRIT: Critical conditions like hard disk errors LOG_ERR: Errors LOG_NOTICE: Notifications LOG_INFO: Informational messages LOG_DEBUG: Debugging messages

Daemon/Process indicates source of a syslog message

IPSO Key Syslog Messages

IPSO Key Syslog Messages

Process ID is the PID of the daemon/process, which is generating syslog messages and it is optional Syslog message is the information logged.

What are the key syslog messages logged by an IPSO appliance in IPSO 4.2 version? Key syslog messages logged by IPSO appliance and their description are given below. The string "<>" depicts the text specific to the message. For example, for the syslog message "Telnet from <IP address>", you would see the corresponding message as "Telnet from 10.10.10.12" in the appliance. SYSLOG MESSAGES LOGGED BY IPSO APPLIANCE Please find below a table of syslog messages which are logged by the IPSO appliance. Syslog Message Login/Logout HTTP Session had expired for user: <username> HTTP login denied from <ip address> for <username> HTTP: User <username> forced to change password at Voyager login (by password expiration, etc). Error changing password for [<username>]: <Error String> Password change for user <username> succeeded. HTTP login from <IP address> as <username> HTTP logout from <IP address> as <username> HTTP access denied to <username> for <URI> ANONYMOUS FTP LOGIN REFUSED FROM <IP address> FTP LOGIN REFUSED FROM <IP address>, <username> FTP LOGIN FAILED FROM <IP address>, <username> ANONYMOUS FTP LOGIN FROM <IP address>, <username> FTP LOGIN FROM <IP address> as <username> FTP LOGOUT from <IP address> as <username> Telnet from <IP address> Description

Voyager session was expired for user <username> Voyager access was denied from <IP address> for user <username>

Error String: 1. error contacting xpand (configuration daemon) 2. error acquiring administrative permissions with xpand 3. internal error formatting password change request for xpand

Voyager access to the appliance Voyager logout from the appliance Voyager access to a particular page was denied Appliance's FTP server refused anonymous FTP login from <IP address> Appliance's FTP server refused FTP login from <IP address> with user <username> FTP login to appliance's FTP server was failed Anonymous FTP login to appliance's FTP server was successful FTP login to appliance's FTP server was successful FTP client logged out from appliance's FTP server Telnet connetion from <IP address> to the appliance was successful

IPSO Key Syslog Messages

IPSO Key Syslog Messages

CLISH: User <username> logged in with <read/write> permission CLISH: User <username> logged out from CLI shell CLISH: User <username> logged out due to an error from CLI shell authentication failure; root(uid=0) -> <username> for login service Console login on ttyd0 as <username> User <username> logged out from CSH shell User admin logged out from SH shell Login from <IP address> as admin PAM_unix: auth could not identify password for [<username>] <number> LOGIN FAILURE FROM <IP address> PAM_unix: (<program name>) session opened for user admin by root(uid=0) PAM_unix: (<program name>) session closed for user <username> PAM_unix: check pass; user unknown sshd-x: Accepted password for <username> from <IP address> port <SSH client port> ssh2 sshd-x: Failed password for <username> from <IP address> port <SSH client port> ssh2 sshd-x: Disconnecting: Too many authentication failures for <username> Dialup login on ttyd1 as <username> Configuration Changes INTERFACE_CONFIG: Created a new logical interface <ifname>

User <username> logged into IPSO CLI shell

Authentication failure for user <username> Number of login failures from <IP address> Session opened for SSH (or other program) Session closed for SSH (or other program) Invalid user.

Login to appliance using modem connected to AUX port. When "System configuration audit log in textual format" is enabled, all configuration changes related syslog messages are logged in *_CONFIG format. When "System configuration audit log in textual format" is disabled, all configuration changes related syslog messages are logged in configuration database binding format: "t" indicates transient configuration. Eg. when "Apply" button is pressed on Voyager. This configuration resides in the memory database. "p" indicates permanent configuration. Eg. when "Save" button is pressed on Voyager. This configuration resides in the memory database and also in a persistent location which is /config/active configuration file. "+" indicates addition of the configuration "-" indicates deletion of configuration setting from the database Binding Format

<username> <from IP address> t +interface:<ifname> <value> <username> <from IP address> t interface:<ifname> <username> <from IP address> p +interface:<ifname> <value> <username> <from IP address> p interface:<ifname> A few examples of configuration changes in text and binding format are given below: Text Format

IPSO Key Syslog Messages

IPSO Key Syslog Messages

INTERFACE_CONFIG: Logical interface (eths1p1c0) is configured with IP address 1.1.1.1/24 INTERFACE_CONFIG: Physical interface (<ifname>) speed is set to 100M INTERFACE_CONFIG: Logical interface (<ifname>) Link Trap is set to off ARP_CONFIG: Keep time is set to 60 seconds DNS_CONFIG: Deleted DNS domain name DNS_CONFIG: Deleted secondary DNS server DNS_CONFIG: Deleted tertiary DNS server HOST_CONFIG: Deleted host test.ipso.com Interface Physical interface <interface name> state is changed to UP Physical interface <interface name> state is changed to DOWN invalid logical interface name <interface name> Logical interface <interface name> state is changed to UP Logical interface <interface name> state is changed to DOWN DHCP Server Packet from unknown subnet: <Ip address> DHCPDISCOVER from <MAC address> via <server interface name>: network <subnet>: no free leases DHCPDISCOVER from <MAC address> via <server interface name> DHCPOFFER on <IP address offered> to <client MAC address> via <interface name> DHCPREQUEST for <requested IP address> (<server IP address>) from <client's MAC address> via <server interface name> DHCPACK on <requested IP address> to <client MAC address> via <server interface name> DHCPREQUEST for <requested IP address> from <client MAC address> via <server interface name>: lease <requested IP address> unavailable. DHCPNAK on <requested IP address> to <client MAC address> via <server interface name> DHCPREQUEST for <requested IP address> from <client MAC address> via <server interface name>: ignored (not authoritative).

admin localhost t +interface:eth-s1p1c0:ipaddr:1.1.1.1:mask 24 admin localhost t +ifphys:<ifname>:speed 100M admin localhost t +snmp:interface:<ifname>:trapstate off admin localhost t +ip:arp:keep_time 60 admin localhost t -resolv:domain:1 admin localhost t -resolv:resolver:2 admin localhost t -resolv:resolver:3 admin localhost p -hosts:test.ipso.com

All the IP addresses in the appliance's server's address pool are exhausted.

DHCP server doesn't have address pool configured for the requested IP address

IPSO Key Syslog Messages

IPSO Key Syslog Messages

DHCPRELEASE of <IP address> from <client MAC address> via <server interface name> (not found) Abandoning IP address <IP address>: pinged before offer DHCPREQUEST for <requested IP address> from <client MAC address> via <server interface name>: unknown lease <IP address>. DHCP Client DHCPACK from <IP address> DHCPNAK from <IP address> No DHCPOFFERS received. bound to <IP address> -- renewal in <number> seconds. BOOTREPLY from <IP address> rejected.

DHCP server doesn't have address pool configured for the requested IP address

IP address is already in use, hence abondon the lease

<DHCP type> from <IP address> rejected. DHCPDISCOVER on <client interface name> to <IP broadcast address> port 67 interval <number> DHCPOFFER from <server IP address> DHCPREQUEST on <client interface name> to <IP broadcast address> port 67 DHCPDECLINE on <client interface name> to <server IP address> port 67 DHCPRELEASE on <client interface name> to <server IP address> port 67 DHCPACK from <server IP address> Device Maintenance rebooted by <username> Configuration changed from <IP address> by user <username> Halted by <username> Boot image will be <Image name> Transaction <transaction id> started Rolling back Transaction <transaction id> reboot with image <image name> System reboots in approximately 2 seconds sshd-x: Server listening on <IP address> port 22. CONFIGSET_CONFIG: Selected file <config filename> as configuration database file CONFIGSET_CONFIG: Deleted configuration database file <config filename>

DHCP message type: DHCP OFFER DHCP NACK DHCP ACK

Appliance was rebooted by user <username>

IPSO Key Syslog Messages

IPSO Key Syslog Messages

CONFIGSET_CONFIG: Saved current configuration state to new configuration database file <config filename> CONFIGSET_CONFIG: Created new factory default configuration database file <config filename> Mirror is synced. IMAGE_MGMT_CONFIG: Deleted image <image filename> PACKAGE_MGMT_CONFIG: Deleted package <package filename> date set BACKUP_RESTORE_CONFIG: Manual backup filename is set to <filename> BACKUP_RESTORE_CONFIG: Scheduled backup filename is set to <filename> BACKUP_RESTORE_CONFIG: Deleted backup file <filename> BACKUP_RESTORE_CONFIG: Restoring file <filename> Upgrade/Downgrade No config database version string in <config file name>. Assuming database is current. Initiating upgrade process Checking validity of the image /var/tmp/ipso.tgz. Image ipso.tgz is valid. Continuing... Image upgrade successful. Select the new image /image/<image path>/ipso.tgz for next reboot. Couldn't upgrade config file <config file name> from <DB version in the file> to <DB version of config file of the upgraded image>. Using factory defaults. Couldn't fallback to config database <config file name> Upgrade: Failed.More than two images cannot be installed on a flash based system. Upgrade: Failed. The signature of the system image is invalid. The image may be corrupted. Upgrade: Failed. No version info. This may be an incompatible version of IPSO. Upgrade: Failed. This may be an incompatible Flash based image of IPSO. Upgrade: It is a downgrade operation. A new configuration set with connectivity information will be created. All other configuration changes will be lost. It is recommended that the testboot feature is used to test the newly installed image and configuration.

Date/Time of the appliance is changed

Reset to factory defaults configuration.

IPSO Key Syslog Messages

IPSO Key Syslog Messages

Upgrade: Failed. Insufficient space to load a new image. Upgrade: Failed. Image file not found. Upgrade: Failed. Error in extracting image. Upgrade: Failed. IPSO image <image> and this Nokia device <product_id> are not compatible. Upgrade: Upgrading boot manager. Upgrade: Boot manager upgrade successful. Upgrade: Failed. Boot manager upgrade unsuccessful due to disk errors. Upgrade: Failed. Boot manager upgrade unsuccessful due to invalid checksum. Upgrade: Restoring old boot manager. Upgrade: Failed to restore old boot manager due to disk errors. Upgrade: Failed. Insufficient space to load a new image. Available space on /image is <size> KB while space required to untar ipso image is <size> KB Next image <image name> and current image <image name> are same. dbup_downgrade: Couldn't determine current db version No downgrade is required for db version <version number> Cannot save active file link to <config file name> Package Installation Not enough space to unpack <package name> verify_diskspace: invalid uncompressed size of <package name> unpack_newpkg: Invalid file <package name> install_newpkg: Run <install script> PRE /opt/<package directory> <package name> <manifest file> xpand install_newpkg: Run <upgrade script> PRE <old package dir> /opt/<package directory> <package name> <manifest file> xpand install_newpkg: Run /opt/<package directory>/UPGRADE POST <old package directory> /opt/<package directory> <package name> /opt/<package directory>/MANIFEST xpand Run /opt/<package directory>/INSTALL POST /opt/<package directory> <package name> /opt/<package directory>/MANIFEST xpand Run <Uninstall or Bootstrap or START or STOP script >

Execute Pre-Install script of the new package being installed Execute Pre-Upgrade script of the new package being installed

Execute Post-Upgrade script of the new package being installed Execute Post-Install script of the new package being installed

IPSO Key Syslog Messages

IPSO Key Syslog Messages

User management USER_CONFIG: Added a new user <username> with UID <uid>, home directory <directory path> USER_CONFIG: Deleted user <username> from the password database USER_CONFIG: Password changed for user <username> by <username> GROUP_CONFIG: Deleted user '<username>' from group '<group name>' GROUP_CONFIG: Added user '<username>' to group '<group name>' GROUP_CONFIG: Added a new group '<group name>' with GID <id> GROUP_CONFIG: Deleted group '<group name>' SNMP No load average information available Received request with invalid community Trap sent to <Trap receiver's IP address>: Version - <version>, Type - <trap type>, <trap description> Sending <number> bytes to <ip address>:<port> The corresponding interface may be down Kernel Messages releng 1515 07.04.2006-160002 CPU: 721-MHz Pentium-III w ATC (686-class CPU) real memory = 268435456 (256M bytes) avail memory = 250376192 (238M bytes) LM87 environmental monitor rev 6, chip 0 Motherboard revision code = 1, VID4 inversion =0 Baja Motherboard chip0 <Intel 82443BX (PAC) PCI/Memory Controller > rev 3 on pci0:0:0 piix0 <Intel 82371AB (PIIX4) PCI to ISA bridge> rev 2 on pci0:7:0 piix1 <Intel 82371AB (PIIX4) PCI to ISA bridge Function> rev 1 on pci0:7:1 npx0 on motherboard npx0: INT 16 interface superio0 at 0x0 on isa

For Example, SNMP process shutdown trap will be logged as: Trap sent to 172.30.180.246: Version - 1, Type - Enterprise Specific Trap, System SNMP process Shutdown

Date/Time of IPSO image built. CPU information Total Physical memory (RAM) Physical memory available to kernel

Network processor information

IPSO Key Syslog Messages

IPSO Key Syslog Messages

piix2 <Intel 82371AB (PIIX4) PCI to ISA bridge Function> rev 1 on pci0:7:2 piix3 <Intel 82371AB (PIIX4) PCI to ISA bridge Function> rev 2 on pci0:7:3 tulip0 <Digital DC21143 Fast Ethernet> rev 65 int a irq 11 onboard 1 tulip1 <Digital DC21143 Fast Ethernet> rev 65 int a irq 12 onboard 2 chip1 <Intel 82443BX (PAC) AGP Controller > rev 3 on pci0:1:0 pcidec0 <DEC 21150B PCI-PCI bridge> rev 6 on pci1:0:0 tulip2 <Digital DC21143 Fast Ethernet> rev 65 int a irq 6 onboard 3 tulip3 <Digital DC21143 Fast Ethernet> rev 65 int a irq 10 onboard 4 fxp0 <Intel EtherExpress Pro 10/100B Ethernet> rev 16 int a irq 9 onboard 1 fxp1 <Intel EtherExpress Pro 10/100B Ethernet> rev 16 int a irq 10 onboard 2 fxp2 <Intel EtherExpress Pro 10/100B Ethernet> rev 16 int a irq 11 onboard 3 fxp3 <Intel EtherExpress Pro 10/100B Ethernet> rev 16 int a irq 12 onboard 4 ubsec0 <Broadcom 5823 Encryption Accelerator> rev 1 int a irq 5 on pci1:0:0 pcic0 <TI PCI-1225 PCI-CardBus Bridge> rev 1 int a irq 6 on pci0:15:0 pcic1 <TI PCI-1225 PCI-CardBus Bridge> rev 1 int a irq 6 on pci0:15:1 changing root device to wd0f RTC: 08/07/06 10:08:05, A=26, B=42, C=00, sec=0x44d71105 kernel: sio0 at 0x3f8-0x3ff irq 4 on isa sio0: type 16550A sio1 at 0x2f8-0x2ff irq 3 on isa sio1: type 16550A wdc0 at 0x1f0-0x1f7 irq 14 on isa wdc0: unit 0 (wd0): <SanDisk SDCFB-16>, LBA wd0: 16MB (31360 sectors), LBA geometry: 31 cyls, 16 heads, 63 S/T wd0: Physical geometry: 490 cyls, 2 heads, 32 S/T wdc0: unit 1 (wd1): <ST340014A>, LBA, DMA, SMART wd1: 40020MB (78165360 sectors), LBA geometry: 4865 cyls, 255 heads, 63 S/T

Ethernet driver information

Ethernet driver (fxp) information

Encryption Chip information

10

IPSO Key Syslog Messages

IPSO Key Syslog Messages

wd1: Physical geometry: 16383 cyls, 16 heads, 63 S/T netlog:eth4 .. enabling 10baseT/UTP port in half duplex mode netlog: Unknown mode in autoneg! syncing disks... done system is flash-based, running in diskless mode The operating system has halted. Trap type 1 3 6 7 9 10 12 14 18 19 20 21 22 23 24 25 26 27 Trap Message privileged instruction fault breakpoint instruction fault arithmetic trap system forced exception general protection fault trace trap page fault alignment fault integer divide fault non-maskable interrupt trap overflow trap FPU bounds check fault FPU device not available double fault FPU operand fetch fault invalid TSS fault segment not present fault stack fault

Fatal trap <trap type>: <trap message> while in <user/kernel> mode duplicate IP address <IP address>! sent from mac address: <MAC address> arp: ether address is broadcast or multicast for IP address <IP address>! arp: MAC address is broadcast or multicast for IP address <IP address>! pppoe, negotiation unsuccessful, disconnecting for pppoe0c<unit> pppoe, PPPoE session up for pppoe0c<unit> pppoe, ipcp_up: some error in adding addresses to PPPoE dynamic interface pppoe0c<unit><error code> pppoe, Successfully added addresses to PPPoE dynamic interface pppoe0c<unit> pppoe, PPPoE session down for pppoe0c<unit> in_ppp_pppoe_event:pppoe0c<unit>: PPP_LINK_DOWN n_ppp_pppoe_event:pppoe0c<unit>: PPP_LINK_READY, peer-mru <mru>

Error code: EINVAL ENOENT ENOPROTOOPT EEXIST

11

IPSO Key Syslog Messages

IPSO Key Syslog Messages

in_ppp_open_pppoe:pppoe0c<unit>: Error in opening port on ifphys pppoe flowpath activated flowpath de-activated FW-1: Nokia IPSO SecureXL device detected. MCC POST Success(0), Rev 1.3 MCC client at 0x4000, HSSI ser-s1p1: SDLcomm 800 Adapter 0 port 0 (Interface type HSSI). VRRP firewall state not okay: cannot continue as master interface <interface name>, VRID <vrid>: state=INIT interface <interface name>, VRID <vrid>: state=BACKUP interface <interface name>, VRID <vrid>: firewall state not okay: cannot become master interface <interface name>, VRID <vrid>: state=MASTER VRRP Router is shutting down due to: <reason> If we are now monitoring Firewall and previously we were not, and Firewall is actually installed on the box, then check if another master is already there and also whether fw sync interface is ready or not. VRRP router with Interface and VRRP vrid is in INIT state. VRRP router with Interface and VRRP vrid is in BACKUP state. If VRRP is monitoring the state of the Firewall and Firewall is actually installed and appliance cannot become master. VRRP router with Interface and VRRP vrid is in MASTER state. Reason for VRRP router shuting down: 1. HDD failure 2. Cold Start delay Config type: Code Meaning 1 VRRP ID 2 VRRP Priority 3 Advertisement interval 4 Routerdead interval 5 No preempt 6 VRRP IP address 7 Authentication 8 Monitor 9 VMAC

vrrp_config_free: unknown config type(<config type>) vrrp_recv: packet received on interface (<interface name>) with no VRRP state, ignoring vrrp_recv: discarded truncated IP packet from <Source IP address> vrrp_recv: discarded packet from <Source IP address> bad VRRP checksum vrrp_recv: discarded packet from <Source IP address> due to packet header truncated vrrp_recv: discard VRRP version <version> packet from <Source IP address> vrrp_recv: discarded unknown VRID <vrrp id> packet from <Source IP address>

12

IPSO Key Syslog Messages

IPSO Key Syslog Messages

vrrp_recv: discarded local loopback for VRID <vrrp id> from <Source IP address> vrrp_recv: discarded packet from <Source IP address> with TTL <ttl> vrrp_recv: discarded truncated VRRP packet from <Source IP address> (got <vrrp packet length>, expected <vrrp packet length>) vrrp_recv: discarded packet from <Source IP address> with NoAuthentication, expected <Auth type> vrrp_recv: discarded packet from <Source IP address> with SimpleTextPassword, expected <Auth type> rrp_recv: discarded packet from <Source IP address> with incorrect SimpleTextPassword vrrp_recv: discarded packet from <Source IP address> with unknown authentication type(<Auth type in hex>) vrrp_recv: discarded packet from <Source IP address> with bad advertiseinterval (got <advertiseinterval value>, expected <advertiseinterval value>) vrrp_recv: discarded packet from <Source IP address> attempting to take over interface <interface name>, VRID <vrrp id> while local router is master CLUSTERING Protocol interface changed for member(<interface ip address>) in cluster(<cluster id>) with member id(<member id>) ErrCode 0 5 8 46 80 Reason string Undefined Error Input/Output error Exec format error Protocol family not supported Authentication Error

The remote router was trying to take over a virtual router while the local router is master

Reject member (<member ip address>), ErrorCode = < Error code> ErrReason = <Reason string> Cluster state is set to DOWN FireWall check not required Cluster state is set to UP New member(<ip address>) joined cluster(<cluster id>) with member id(<member id>). Initialized as master in cluster(<cluster id>). Initialized as member (<member id>) in cluster(<cluster id>). Cluster: Failed to send packet on <interface>: No route to host
13

IPSO Key Syslog Messages

IPSO Key Syslog Messages

Cluster: Failed to send packet on ae8c0: Device not configured Cluster: Failed to send last <number> packets on <interface name>: last error: Device not configured libremote init error:Node:<ip address>, Secure socket connect error: (node <ip address>) Operation timed out. Member(<ip address>) member id(<member id>) left cluster(<cluster id>): Syncing configuration with peer (<ip address>) Initializing config-BootStrapping with node: <cluster ip address> Remote config sync Error:Unable to establish connection with <cluster IP address>. Please check the address and make sure the password is correct. Remote config sync Error:Unable to sync configuration with cluster <cluster id>. Please make sure the password is correct. libremote init error:Unable to establish secure connection: Password mismatch. Member <member id> leaving cluster <cluster id> libremote init error:Node:<ip address>, Unable to establish secure connection: Password mismatch. Received Zero bytes from remote node(<Cluster IP address) for config sync. IP Cluster: integrity checksum failed from <cluster member ip address> IP Cluster: Unknown Cluster Manager packet type <type in hex> IP Cluster: Couldn't get IPv4 Multicast Address on <interface name>, Protocol family not supported IP_Cluster: Cannot forward packets on <interface name> Cluster: Failed to send packet on <interface name>: No such interface" Cluster: Not Enough Memory IP Cluster: truncated protocol message received from <IP address> Cluster: Failed to add Multicast Address to <interface name> IP Cluster: Bad ttl in packet received from <ip address> BGP

Receiving Zero bytes is not an error if appliance is already a member. There could be no features that are clonned.

14

IPSO Key Syslog Messages

IPSO Key Syslog Messages

bgp_connect_start: connect <IP address> (External AS <AS number>): Can't assign requested address bgp_peer_init: BGP peer <IP address> (External AS <AS number>) local address <IP address> not found. Leaving peer idled bgp_set_peer_if: BGP peer <IP address> (External AS <AS number>) interface not found. Leaving peer idled bgp_peer_init: BGP peer <IP address> (External AS <AS number>): local address <IP address> is not cluster master. Leaving peer idled bgp_recv_open: peer <IP address> (External AS <AS number>) claims AS <AS number>, <AS number> configured NOTIFICATION sent to <IP address> (External AS <AS number>): code 2 (OpenMessageError) subcode 2 (bad AS number) data bgp_traffic_timeout: holdtime expired for <IP address> (External AS <AS number>) PIM PIM: No cluster IP found for interface <logical interface name> pim_dm_recv_state_refresh: ignoring state refresh message <IP address>,<multicast group address>/<prefix> received on <interface name> ttl:0 Local address <IP address> configured for interface <interface name> is not a valid nonvirtual address pim_dm_rt_lookup: Route lookup for source <IP address> failed PIM: Begin of instance 0 termination pim_sm_instance_terminate: termination of instance 0 PIM: No valid non-virtual address found for interface ser-s3p1c0 IGMP igmp_recv_leave_group: ignoring leave group from <IP address>, group <multicast address> is not in active group database igmp_recv: packet from non-local neighbor <IP address> igmp_recv_leave_group: malformed leave group group address (<IP address>)

15

IPSO Key Syslog Messages

IPSO Key Syslog Messages

Multicast Forwarding Cache (MFC) mfc_resolve_sg: no multicast routing enabled on <logical interface name> for (<multicast group address>, <source IP address>) mfc_resolve_sg: duplicate xresolve for (<multicast group address>, <source IP address>)/<prefix length> OSPF OSPF IO: <IP address>-><Multicast address> unknown area ID <IP address> in Hello packet OSPF IO: Hello interval mismatch on interface <IP address>(<interface name>) got <hello interval> expected <hello interval> OSPF IO: <IP address>-><multicast address>: authentication failed (10) in Hello packet COPS Diffserv Interface (<interface name>) changed role from <role name> to <role name> Interface (<interface name>) has not changed role diffserv PIB qosShapingRateEntry not supported. Policy rejected! ipFilter IP address (<IP address>/<mask>) invalid. Policy rejected! ipFilter DNS address value not supported. Policy rejected! Invalid qosMeter parameter (<type>). Policy rejected! qosMeter fail path not supported. Policy rejected! qosAction next parameter not supported. Policy rejected! Unsupported drop algorithm. Policy rejected! Unsupported drop algorithm (tail). Policy rejected! Unsupported drop algorithm (head). Policy rejected! Unsupported drop algorithm (random). Policy rejected! Unsupported drop algorithm (unknown). Policy rejected! Unknown policy type. Policy rejected! Received rollback from DS layer for request [<requested handle>]

16

IPSO Key Syslog Messages

IPSO Key Syslog Messages

Received unsolicited decision for request [<requested handle>] Received solicited decision for request [<requested handle>] Received client close messsage, COPS connection closed Received client accept messsage, COPS connection established Received unsupported syncronisation request from PDP Received unknown response type (<type>) from PDP Filesystem Mount/Umount mount: Executing command: mount uw / mount: mount command executed successfully. mount: <name of device file> on <mount point>: No such file or directory mount: <name of device file> on <mount point>: mount table full mount: <name of device file> on <mount point>: Specified device does not match mounted device mount: Unknown special file or file system mount: <name of device file> on <mount point>: Device busy mount: <mount point> is not a directory umount: <mount point>: Not currently mounted umount: <mount point>: Unknown mount type umount: <mount point>: Not a directory or a special device umount: <mount point>: Not a supported filesystem

17

IPSO Key Syslog Messages