Debug messages


no debug <debug-type>


When a match occurs on an ACL "deny" ACE (with log configured), the switch sends an ACL message to configured debug destinations. For information on ACLs, see the "Access Control Lists (ACLs)" in the latest version of the following guides:
  • IPv4 ACLs: access security guide

  • IPv6 ACLs: IPv6 configuration guide


ACE matches (hits) for permit and deny entries can be tracked using the show statistics <aclv4|aclv6> command.

(Default: Disabled—ACL messages for traffic that matches "deny" entries are not sent.)


Configures the switch to send all debug message types to configured debug destinations.(Default: Disabled—No debug messages are sent.)


Sends CDP information to configured debug destinations.


logging—Disables or re-enables syslog logging on one or more syslog servers configured with the logging <syslog-ip-addr> command.session—Assigns or re-assigns destination status to the terminal device that was most recently used to request debug output.buffer—Enables syslog logging to send the debug message types specified by the debug <debug-type> command to a buffer in switch memory.For more information on these options, see Debug destinations.


Configures the switch to send Event Log messages to configured debug destinations.

This value does not affect the reception of event notification messages in the Event Log on the switch.

Event Log messages are automatically enabled to be sent to debug destinations in these conditions:
  • If no syslog server address is configured and you enter the logging <syslog-ip-addr> command to configure a destination address.

  • If at least one syslog server address is configured in the startup configuration, and the switch is rebooted or reset.

Event log messages are the default type of debug message sent to configured debug destinations.
ip [fib | forwarding | packet | rip]

Sends IP messages to configured destinations.

  ip [fib [events]]

For the configured debug destinations:events—Sends IP forwarding information base events.

  ip [packet]

Enables the specified PIM message type.


ip [rip [database | event | trigger]]

rip {<database | event | trigger>} —Enables the specified RIP message type for the configured destination(s). database—Displays database changes. event—Displays RIP events. trigger—Displays trigger messages.

ipv6 [dhcpv6-client | nd | packet]


See the "IPv6 Diagnostic and Troubleshooting" in the IPv6 configuration guide for your switch for more detailed IPv6 debug options.

When no debug options are included, displays debug messages for all IPv6 debug options. dhcpv6-client [events | packet]—Displays DHCPv6 client event and packet data.nd—Displays debug messages for IPv6 neighbor discovery.packet—Displays IPv6 packet messages.


Enables all LLDP message types for the configured destinations.

security [arp-protect | dhcp-snooping | dynamic-ip-lockdown | port-access | port-security | radius-server | ssh | tacacs-server | user-profile-mib]

arp-protect— Sends dynamic ARP protection debug messages to configured debug destinations.dhcp-snooping—Sends DHCP snooping debug messages to configured debug destinations. agent—Displays DHCP snooping agent messages. event—Displays DHCP snooping event messages. packet—Displays DHCP snooping packet messages. dynamic-ip-lockdown—Sends dynamic IP lockdown debug messages to the debug destination.port-access—Sends port-access debug messages to the debug destination.radius-server—Sends RADIUS debug messages to the debug destination.ssh—Sends SSH debug messages at the specified level to the debug destination. The levels are fatal, error, info, verbose, debug, debug2, and debug3.tacacs-server—Sends TACACS debug messages to the debug destination.user-profile-mib—Sends user profile MIB debug messages to the debug destination.

services <slot-id-range>

Displays debug messages on the services module. Enter an alphabetic module ID or range of module IDs for the <slot-id-range> parameter.

snmp <pdu>

Displays the SNMP debug messages.pdu—Displays SNMP pdu debug messages.