I85PREP
⌘ K
Extreme Certified Professional - Extreme Switching study materials
Extreme Certified Professional - Extreme Switching study resources

Extreme Certified Professional - Extreme Switching: Monitoring, Troubleshooting, and Operations

Extreme Certified Professional - Extreme Switching · Work through your exam, one topic at a time.

All guide sections

Monitoring, Troubleshooting, and Operations

Domain 7 - Monitoring, Troubleshooting, and Operations. This domain tests the operational commands that separate a fast diagnosis from a guess: logging and syslog, counters, neighbour discovery, mirroring, and the support bundle you hand over when you escalate.

Where to look first

  • show version, show switch, show slot, show power, show fans, show temperature, show diagnostics cover hardware health and the running image.
  • show logging / show log for recent events; configure syslog add 10.1.1.50 ships them off-box so they survive a reload.
  • show ports <port> statistics, show ports <port> configuration, show ports <port> transceiver for physical-layer faults.
  • show fdb, show iparp, show iproute, show lldp neighbors (or EDP where LLDP is not enabled) reconstruct the topology.

Instrumentation

  • enable sflow with configure sflow for sampled traffic statistics; SNMP with enable snmp and configure snmp add community for polling.
  • Port mirroring: create mirror m1, configure mirror m1 add source port 1:5, configure mirror m1 add destination port 1:20, then enable it; the analyzer port normally cannot carry user traffic.
  • Escalation: show tech-support collects a full bundle. It is CPU-expensive on a busy switch, so capture it once you have narrowed the suspect area rather than in a loop.

Worked example

Users on one floor report slow transfers. show ports 1:5 statistics shows CRC/alignment errors climbing, show ports 1:5 configuration shows the port at 1 Gbps, and show log shows repeated link flaps on 1:5. Reasoning: CRC errors point at the physical layer - cable, patch panel, optic - not at a VLAN or routing problem, so replace the patch lead or swap the SFP, then re-check after clear counters 1:5. If counters were clean and only show fdb/show iparp looked odd, you would investigate Layer 2 learning or addressing instead.

Traps

  • Running clear counters before capturing evidence - the fault signature disappears.
  • Reading show configuration and believing it matches what will boot; unsaved changes and the wrong config bank both mislead.
  • Assuming a link flap is a software bug when the log shows it began at a specific cable move.
  • Keeping syslog local, so a crash or reboot wipes the record you needed.
  • Mirroring a busy port to an oversubscribed analyzer port and dropping the frames you wanted.