I am brand new to this (Cisco Log Analysis) and I need some help with the meaning of Cisco Log messages. I have read a bit on the Cisco website and got up to speed but I need a bit of fine tuning so please indulge me.

Specifically, I have two lines pasted below from one of my logs.

2463: 006076: Dec 28 22:35:08: %LINK-3-UPDOWN: Interface FastEthernet0/33, changed state to down
2464: 006077: Dec 28 22:35:12: %LINK-3-UPDOWN: Interface FastEthernet0/33, changed state to up

The way I have understood it is that the first numbers are sequence numbers followed by the date stamp. After the % sign, there is the source, the severity and a mnemonic code that is related to the message, followed by the detailed message itself. In this case, severity '3' refers to 'error condition'

Question 1 - what would cause the link to change state to 'down' ? Question 2 - why should it be an 'error' when the interface changes state from down to up ?


When the link goes down the cable was removed, damaged or the other side shut (disabled) the port.

The severities are exactly that, Ciscos estimate on how severe a condition is. It may not be an "error" in your case but when a port suddenly goes down (especially without apparent reason) this could be something severe in many situations.

If you don't think that this is an error in your setup (for example when the interface connects to a host that is turned off/rebooted regularly) you can always disable logging of this message with the following command:

conf t
interface FastEthernet0/33
 no logging event link-status
  • Thanks Sebastian for answering Question 1. Any ideas on question 2 ? – user15282 May 6 '15 at 12:56
  • 1
    Don't think of logs as a set of error messages. They're used to record all relevant events that happened. A port changing its state usually is, so it's logged. – Teun Vink May 6 '15 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.