常见日志说明

 

 接口上电后提示信息，为正常信息：

 *Jan  1 08:02:16: %LINK-3-UPDOWN: Interface GigabitEthernet 0/0, changed state to up.

 *Jan  1 08:02:16: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet 0/0, changed state to up.

 

 Telnet用户登录信息 ：

 *Oct 12 01:57:30: %LOGIN-5-LOGIN_SUCCESS: User (admin) login from vty0(172.25.0.191) OK.

 *Oct 12 02:08:29: %LOGIN-5-LOGOUT: User (admin) logout from vty0(172.25.0.191).

 

 内网环路报错（接口G0/0收到的数据报文超过了接口缓存）：

 拓扑环境：路由器内网口与二层口自环

 *Jan  1 08:08:30: %DEV_AUDIT-4-HIGH_NO_BUFFER: Warning! The number of no buffer of interface GigabitEthernet 0/0 exceeded threshold 50000. 1117767 no   buffers increased within 1 minute.

 

 内网环路报错（提示收到内网口攻击，ip为内网口地址）：

 拓扑环境：路由器下连交换机自环

 *Jan  1 08:35:36: %EF_RNFP-5-ATTACK: System attack record at 1970-01-01 08:35:27, System was attacked for 9s. Total 3664 pkts, 234496 bytes. TOP1  ip.192.168.1.1: 3664 pkts, 234496 bytes, from Gi0/0.

Ruijie#show arp-suspect ----->查看arp嫌疑主机

IP address      MAC address

192.168.1.1     5869.6c14.ca47

 

 内网地址与接口地址冲突提示信息（内网mac地址为6ce8.7348.54b4的主机与内网口地址冲突，建议排查内网环境）：

 *Oct  8 19:58:32: %ARP-4-DUPADDR: Duplicate address 192.168.2.1 on GigabitEthernet 0/1, sourced by 6ce8.7348.54b4.

 *Oct  8 19:56:50: %ARP-4-DUPADDR: Duplicate address 192.168.2.1 on GigabitEthernet 0/1, sourced by 6ce8.7348.54b4.

 

 ARP欺骗日志（内网mac为 507a.55a3.d2eb的主机存在ARP欺骗嫌疑，建议排查内网）：

*Oct 12 07:17:03: %ARP-4-ATTACK: The host whose mac is 507a.55a3.d2eb, may be an arp spoof host..

*Oct 12 07:16:51: %ARP-4-ATTACK: The host whose mac is 507a.55a3.d2eb, may be an arp spoof host..

 

 受攻击日志：

 *Oct 12 11:39:45: %EF_RNFP-5-ATTACK: System attack record at 2016-10-12 11:39:39, System in attack 6s.

  通过以下命令查看攻击主机以及判断攻击来自内网还是外网：

      Ruijie#show attack-info history

System attack record at 2016-10-12 11:39:39, System in attack 6s

ALL: 570 packets, 38352 bytes

PROTOCOL         packets        bytes

ARP              506            30360        

TCP              2              128          

UDP              59             7570         

other            3              294          

TOP10 IP attack:

IP               packets        bytes            interface

192.168.1.29     62             3720             Gi0/0

192.168.1.3      60             3600             Gi0/0

192.168.1.12     60             3600             Gi0/0

 

设备提示冷启动( 冷启动是设备下电后重启；热启动是web界面上重启（软件重启)

 *Nov  8 14:09:04: %SYS-5-COLDSTART: System coldstart

 

 NBR启机出现bcm53115寄存器读写失败 ，是硬件问题，建议送修

 .GE_SWITCH-3-BCM53115: read error at line 65

 .GE_SWITCH-3-BCM53115: read error at line 65

 .GE_SWITCH-3-BCM53115: read error at line 65

 .GE_SWITCH-3-BCM53115: read error at line 65

 .GE_SWITCH-3-BCM53115: read error at line 65

 .GE_SWITCH-3-BCM53115: read error at line 65

 .GE_SWITCH-3-BCM53115: read error at line 65

 .GE_SWITCH-3-BCM53115: read error at line 65

 .Main Program File Name rgos.bin, Load Main Program ... 

 

内存芯片的问题，我们设置的参数的容错率不够，DDR芯片换了。升级到P5或者P6版本可以解决。

 ECC: Double bit error

        Failing dimm:   0

        Failing rank:   1

        Failing bank:   0

        Failing row:    0xdd

        Failing column: 0x600