Build the Next-Generation Data Center
6 week online course starting in spring 2017

How do I detect router restarts?

Mike Nipp has wondered which syslog message to use to reliably detect router reload under all circumstances:

The problem I had with the SYS-5-RESTART message is I don't think you will get one if the power is suddenly pulled from the router. It does do a SNMP-5-COLDSTART and SYS-6-BOOTTIME on boot up.

I did an actual power-cycle test of a router (we can do that remotely in our labs, so I didn't have to touch the box :) and the SYS-5-RESTART message is reliably generated at every startup, be it from the power cycle or the reload command (I was not able to provoke an on-demand crash ;).

This article is part of You've asked for it series.


  1. Perhaps test crash command could be accurate for your tests if it haven't his own syslog messages.

  2. Have you tried the core dump?

  3. I think what fropert was referencing was the undocumented "test crash" IOS cli command...

    T1Router#test crash
    WARNING: Command selections marked with '(crash router)' will crash
    router when issued. However a selection 'C' will need to
    be issued IMMEDIATELY before these selections to enable them.

    Type the number for the selected crash:
    1 (crash router) Bus Error, due to invalid address access
    2 (crash router) Bus Error, due to parity error in Main memory
    3 (crash router) Bus Error, due to parity error in I/O memory
    4 (crash router) Address Error, due to fetching code from odd address
    5 (crash router) Jump to zero
    6 (crash router) Software forced crash
    7 (crash router) Illegal read of address zero
    8 (crash router) Divide by zero
    9 (crash router) Corrupt memory
    C Enable crash router selection marked with (crash router)
    R (crash router) User enter read bus error address
    U (crash router) User enter write bus error address
    W (crash router) Software watchdog timeout (*** Watch Dog Timeout ***)
    w (crash router) Process watchdog timeout (SYS-2-WATCHDOG)
    d Disable crashinfo collection
    e Enable crashinfo collection
    i Display contents of current crashinfo flash file
    m Write crashinfo on crashinfo RAM
    n Change crashinfo flash file name
    q Exit crash menu
    s Save crashinfo to current crashinfo flash file
    c Close current crashinfo flash file
    t Write crashinfo on console TTY
    x Exit crash menu

    T1Router uptime is 31 minutes
    System returned to ROM by error - a Software forced crash, PC 0x80204EEC at 04:46:03 UTC Thu Apr 28 2005

  4. Another option is to use the @reboot cron specification with a cron timer EEM policy.

  5. Ivan/mtimmsj

    The @reboot command is nice, but have had issues getting it to work as expected. In the below example, the EEM script runs and the syslog msg (action 10) gets generated, but the route doesn't get put in. It seems like the syslog can be written, but the CLI can not. I've tried inserting 'wait' actions between 10 and 20 with sometimes successful results. Is there a better syslog message or another way to trigger the eem execution as soon as the CLI is available for EEM? This is the same case using the 'SYS-5-RESTART' trigger Ivan demonstrated. If it makes any difference, this is on the 4500E platform - we have triggered off of SSO being reached, but that is too late for what we are trying to do.

    Thanks for any input

    event manager applet eemscript authorization bypass
    description This applet executes a CLI command after a switch reboot.
    event timer cron cron-entry "@reboot" maxrun 100
    action 10 syslog msg "EEM script has started."
    action 20 cli command "enable"
    action 30 cli command "configure terminal"
    action 40 cli command "ip route (network) (mask)"


You don't have to log in to post a comment, but please do provide your real name/URL. Anonymous comments might get deleted.