I'm unable to see any new logs about from Mar 8 in Cisco Nexus C9372PX my logging configuration is as follows:

CORENEXUS02# show logging 

Logging console:                enabled (Severity: critical)
Logging monitor:                enabled (Severity: notifications)
Logging linecard:               enabled (Severity: notifications)
Logging timestamp:              Seconds
Logging source-interface :      enabled (Interface: loopback11)
Logging server:                 enabled
        server severity:        notifications
        server facility:        local7
        server VRF:             lan
        server port:            5560
Logging logflash:               enabled (Severity: notifications)
Logging logfile:                enabled

CORENEXUS02# show  running-config | include logging
logging level snmpd 3
ntp logging
logging server 5 port 5560 use-vrf lan
logging source-interface loopback11

No logs are sent to syslog or shown is in show logging.

Seems like the logging process is stopped or not working at all. What can i do to troubleshoot?

  • Seems good. Try to set Informational level and check it. And question not related with Your problem, what Syslog server You use?
    – OlegPowerC
    Dec 16, 2019 at 14:14
  • is there any single command to enable logging level informational ? We're using Kibana's somewhat logging plugin.
    – Edvinas
    Dec 16, 2019 at 15:19
  • Which vrf is the loopback1 interface configured to use? Since you specify using the lan vrf in the logging server config, the source interface also needs to be part of that vrf.
    – YLearn
    Dec 16, 2019 at 15:47
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 17, 2020 at 14:31

3 Answers 3


I think you're using NX-OS, and at least some of the replies assume IOS.

One thing that's not related to your question... you're calling this a "core" nexus. I assume that means N7k or 9500. Does a 9500 support VDCs? At least the 7k does, and it's recommended to create an "admin" VDC. That admin VDC is where wou configure NTP; it seems like NTP is configured within a production VDC.

Anyway, back to the question at hand:

Looking at your output, it seems like you're only logging the SNMPd process. There's a decent chance there's just nothing to log.

Also, are you sure you're sending your logging traffic to the correct VRF? You've used VRF "lan" - is it setup correctly?

This is my (working) configuration on my Nexus 7010. I've redacted the router name and the IPs, but you get the idea.

N7k# sh run all | inc ^logging
logging message interface type ethernet description
logging event link-status default
logging event trunk-status default
logging event link-status enable
logging event trunk-status enable
logging server [redacted] 7 use-vrf management facility local4
logging source-interface loopback0
logging monitor 5
N7k# sh run vrf management

!Command: show running-config vrf management
!Time: Mon Dec 16 14:42:25 2019

version 7.3(3)D1(1)

interface mgmt0
  vrf member management
vrf context management
  ip route [redacted]

N7k# sh run int lo0

!Command: show running-config interface loopback0
!Time: Mon Dec 16 14:43:45 2019

version 7.3(3)D1(1)

interface loopback0
  ip address [redacted]/32
  ipv6 address [redacted]/128

N7k# sh logg last 5
2019 Dec 16 14:44:01 N7k %L2FM-2-L2FM_CONTINUOUS_MAC_MOVE: Mac Address (0050.569e.214d) in Vlan 1210 is moving continuously
2019 Dec 16 14:44:43 N7k %L2FM-2-L2FM_CONTINUOUS_MAC_MOVE: Mac Address (0050.569e.789d) in Vlan 1210 is moving continuously
2019 Dec 16 14:45:41 N7k %L2FM-2-L2FM_CONTINUOUS_MAC_MOVE: Mac Address (0050.568b.7bd2) in Vlan 1204 is moving continuously
2019 Dec 16 14:46:43 N7k %L2FM-2-L2FM_CONTINUOUS_MAC_MOVE: Mac Address (0050.56b5.02f4) in Vlan 1204 is moving continuously
2019 Dec 16 14:46:55 N7k %L2FM-2-L2FM_CONTINUOUS_MAC_MOVE: Mac Address (0050.569e.1507) in Vlan 1225 is moving continuously
  • Please do not use answers to ask clarifying questions. Comments (like this) are for that purpose.
    – Ron Trunk
    Dec 16, 2019 at 20:09

logging server xx.xx.xx.xx 6 use-vrf default

  • xx.xx.xx.xx Your syslog server
    – OlegPowerC
    Dec 16, 2019 at 16:07

Perform a show system internal flash to view how much space you have left internally. When the system fills its logs to 100% it is unable to perform any logging function. My recommendation would be to turn off logging on the device and log to a syslog server only.

  • thanks, but there're no such command: (config)# logging on ^ % Invalid command at '^' marker.
    – Edvinas
    Dec 16, 2019 at 15:19
  • can you do a 'show logging module' or 'show logging info' anything like that? Dec 16, 2019 at 15:28
  • I also found this and it might be helpful - cisco.com/c/en/us/support/docs/switches/… Dec 16, 2019 at 15:34
  • show system internal flash shows: none 51200 51200 0 100% /var/volatile/log seems like it's used 100%. Strange, why that file doesnt overwrites with newer logs ? Added full paste here: pastebin.com/DwRYx6bk `
    – Edvinas
    Dec 16, 2019 at 15:47
  • 2
    @CrazyHorse019 You should edit your answer (or create a new one) with the correct diagnosis and fix. That way, others can benefit from your answer.
    – Ron Trunk
    Dec 16, 2019 at 17:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.