Yes, Cisco 3850 switch logs can be retrieved for root cause analysis. It can be useful to review the switches’ logs for information regarding their operation, errors, and issues.
SSH or the command-line interface (CLI) are the two ways to retrieve Cisco 3850 logs. Here are the steps to follow:
SSH or console cable to connect to the switch.
Provide the appropriate credentials and enter the privileged EXEC mode.
Type configure terminal to enter global configuration mode.
Use the following command to enable logging: logging buffered <size> (replace <size> with the desired buffer size, for example, 4096).
Show logging displays the buffer logs. Most recent log entries will be displayed.
Save the logs to a file for further analysis by using the show logging | redirect <filename> command (replace <filename> with the desired file name).
Note: Logs are saved to flash memory by this command.
You can then copy the log file to an external device using the copy flash:<filename> <destination> command (replace <filename> with the log file name and <destination> with the destination location, such as an FTP or TFTP server).
Check the logs for errors, warnings, or events that preceded the switch hanging or amber lights. Using this information, you can identify the root cause.
Typically, Cisco switches store logs in different categories, including systems, interfaces, and spanning trees. By focusing on the relevant log category, you can narrow down your analysis.
You can find more details on logging commands and options in the Cisco documentation specific to your switch model.
I think it might be work !!
