This documentation is for the extended support release (ESR) version of Cumulus Linux. We will continue to keep this content up to date until 21 February, 2023, when ESR support ends. For more information about ESR, please read this knowledge base article.

If you are using the current version of Cumulus Linux, the content on this page may not be up to date. The current version of the documentation is available here. If you are redirected to the main page of the user guide, then this page may have been renamed; please search for it there.

Troubleshooting Log Files

The only real unique entity for logging on Cumulus Linux compared to any other Linux distribution is switchd.log, which logs the HAL (hardware abstraction layer) from hardware like the Broadcom or Mellanox Spectrum ASIC.

This guide on NixCraft is amazing for understanding how /var/log works. The green highlighted rows below are the most important logs and usually looked at first when debugging.

Log	Description	Why is this important?
/var/log/alternatives.log	Information from the update-alternatives are logged into this log file.
/var/log/apt	Information the `apt` utility can send logs here; for example, from `apt-get install` and `apt-get remove`.
/var/log/audit/*	Contains log information stored by the Linux audit daemon, `auditd`.
/var/log/auth.log	Authentication logs. Note that Cumulus Linux does not write to this log file; but because it's a standard file, Cumulus Linux creates it as a zero length file.
/var/log/autoprovision	Logs output generated by running the zero touch provisioning script.
/var/log/boot.log	Contains information that is logged when the system boots.
/var/log/btmp	This file contains information about failed login attempts. Use the `last` command to view the `btmp` file. For example: `cumulus@switch:~$ last -f /var/log/btmp \| more`
/var/log/clagd.log	Logs status of the clagd service.
/var/log/dmesg	Contains kernel ring buffer information. When the system boots up, it prints number of messages on the screen that display information about the hardware devices that the kernel detects during boot process. These messages are available in the kernel ring buffer and whenever a new message arrives, the old message gets overwritten. You can also view the content of this file using the `dmesg` command. Note that Cumulus Linux does not write to this log file; but because it's a standard file, Cumulus Linux creates it as a zero length file.
/var/log/dpkg.log	Contains information that is logged when a package is installed or removed using the `dpkg` command.
/var/log/faillog	Contains failed user login attempts. Use the `faillog` command to display the contents of this file. Note that Cumulus Linux does not write to this log file; but because it's a standard file, Cumulus Linux creates it as a zero length file.
/var/log/fsck/*	The `fsck` utility is used to check and optionally repair one or more Linux filesystems. Note that Cumulus Linux does not write to this log file; but because it's a standard file, Cumulus Linux creates it as a zero length file.
/var/log/installer/*	Directory containing files related to the installation of Cumulus Linux.
/var/log/lastlog	Formats and prints the contents of the last login log file.
/var/log/netd.log	Log file for NCLU.
/var/log/news/*	The `news` command keeps you informed of news concerning the system. Note that Cumulus Linux does not write to this log file; but because it's a standard file, Cumulus Linux creates it as a zero length file.
/var/log/ntpstats	Logs for network configuration protocol.
/var/log/openvswitch/*	`ovsdb-server` logs.
/var/log/frr/*	Logs for FRRouting.	This is how NVIDIA troubleshoots routing. For example an md5 or mtu mismatch with OSPF.
/var/log/rdnbrd.log	Logs for redistribute neighbor.
/var/log/snapper.log	Log file for snapshots.	These logs are valuable for the snapshots you take on your switch.
/var/log/switchd.log	The HAL log for Cumulus Linux.	This is specific to Cumulus Linux. Any `switchd` crashes are logged here.
/var/log/syslog	The main system log, which logs everything except auth-related messages.	The primary log; it's easiest to `grep` this file to see what occurred during a problem.
/var/log/wtmp	Login records file.

Troubleshooting Log Files

Products

Solutions

Learn