undebug all
Disables all active debug operations on the router, used to stop debugging output and reduce CPU load.
Definition: undebug all is a Cisco IOS privileged exec command. Disables all active debug operations on the router, used to stop debugging output and reduce CPU load.
Overview
The `undebug all` command is a critical tool in the Cisco IOS troubleshooting arsenal, used to disable all active debug operations on a router. Debugging is a powerful feature that allows network engineers to monitor real-time events, such as routing protocol updates, packet forwarding, or error conditions. However, debug commands consume significant CPU resources because they generate continuous output for every matching event. If left running, especially in production environments, they can degrade router performance, cause packet loss, or even crash the device. The `undebug all` command provides a single, reliable way to stop all debugging activity, restoring normal operation and reducing CPU load. It is the equivalent of a 'kill switch' for debug sessions.
In the context of network troubleshooting, debugging is typically used after initial analysis with `show` commands has narrowed down a problem. For example, if OSPF neighbor adjacencies are flapping, an engineer might enable `debug ip ospf adj` to see the exact exchange of hello packets and database descriptors. Once the issue is identified and resolved, `undebug all` is used to halt the debug output. This command is preferred over disabling individual debugs because it ensures no stray debug processes remain active, which is especially important when multiple debugs have been enabled during complex troubleshooting.
A key behavior of `undebug all` is that it does not affect the running configuration; debug settings are not saved to NVRAM. However, if debug commands are entered via the command line, they remain active until explicitly disabled or the router reloads. The command requires privileged EXEC mode (enable mode), as debugging is a high-privilege operation. Output from debug commands is sent to the console by default, but can be redirected to a buffer or syslog server using `logging buffered` or `logging host`. When using `undebug all`, any buffered output continues to be written until the buffer is cleared, but no new debug messages are generated.
Alternatives to `undebug all` include `no debug all` (which is identical), or disabling specific debugs with `no debug <protocol> <option>`. The latter is useful when you want to keep some debugs running while stopping others. However, `undebug all` is the safest choice when you are unsure which debugs are active or when multiple engineers have enabled debugs. It is also commonly used in scripts or automated troubleshooting to ensure a clean state.
In the broader workflow, `undebug all` is typically the final step in a debug session. The sequence is: identify the problem, enable relevant debugs, observe output, resolve the issue, then immediately disable debugs. Best practice is to use `undebug all` as soon as the necessary information is collected, to minimize performance impact. For CCNA and CCNP candidates, understanding this command is essential for lab exams and real-world network management, as leaving debugs enabled is a common mistake that can lead to router instability.
undebug allWhen to Use This Command
- After troubleshooting a routing protocol issue, disable all debugs to return the router to normal operation.
- When debugging output is overwhelming the console or causing performance degradation, quickly stop all debugs.
- Before performing a critical configuration change, ensure no debugs are running to avoid log interference.
- When a junior engineer left debugs enabled, use undebug all to clean up the session.
Command Examples
Disabling all active debugs
Router# undebug allAll possible debugging has been turned off
The output confirms that all debug operations are now disabled. No further debug messages will be displayed.
Verifying debugs are off after undebug all
Router# show debugRouter#
After undebug all, show debug returns no output, indicating no debugs are active.
Understanding the Output
The output of 'undebug all' is a single confirmation line: 'All possible debugging has been turned off'. This indicates that all debug commands previously enabled (e.g., debug ip ospf events, debug ip rip) are now disabled. In a real network scenario, after issuing this command, you should verify with 'show debug' that no debugs remain.
If the router continues to show debug messages, it may indicate that some debugs are persistent or that the command was not executed in privileged EXEC mode. Good practice is to always run 'undebug all' after troubleshooting to prevent CPU overload.
Configuration Scenarios
Stopping all debug operations after OSPF troubleshooting
After debugging OSPF neighbor issues on a router, you need to disable all active debugs to prevent CPU overload and return the router to normal operation.
Topology
R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2Steps
- 1.Step 1: Enter privileged EXEC mode: Router> enable
- 2.Step 2: Verify active debugs: Router# show debug
- 3.Step 3: Disable all debugs: Router# undebug all
- 4.Step 4: Confirm no debugs are active: Router# show debug
! No configuration changes are made; this command only affects runtime debug state. Router# undebug all All possible debugging has been turned off
Verify: Use 'show debug' to confirm that no debug conditions are set. Expected output: 'No active debug conditions'.
Watch out: If you have enabled debug logging to a buffer, the buffer will still contain previous debug output. Use 'clear logging' to clear the buffer if needed.
Disabling debugs after EIGRP route troubleshooting
While troubleshooting EIGRP route propagation, multiple debugs were enabled. After resolving the issue, all debugs must be stopped to free CPU resources.
Topology
R1(Gi0/0)---192.168.1.0/30---(Gi0/0)R2---192.168.2.0/30---(Gi0/0)R3Steps
- 1.Step 1: Enter privileged EXEC mode: Router> enable
- 2.Step 2: Check active debugs: Router# show debug
- 3.Step 3: Disable all debugs: Router# undebug all
- 4.Step 4: Optionally, clear the logging buffer: Router# clear logging
! No configuration changes. Router# undebug all All possible debugging has been turned off
Verify: Run 'show debug' to ensure no debugs are active. Also monitor CPU usage with 'show process cpu' to see reduced load.
Watch out: If you have enabled 'debug ip packet' or other high-impact debugs, the router may become unresponsive. Always use 'undebug all' as soon as possible. In extreme cases, you may need to reload the router if it becomes too slow to accept commands.
Troubleshooting with This Command
The `undebug all` command is primarily used to stop debugging, not to diagnose issues. However, it plays a crucial role in the troubleshooting workflow by ensuring that debug overhead does not interfere with router performance or skew results. When troubleshooting, a network engineer should first use `show debug` to list all active debug conditions. If the router is experiencing high CPU utilization (e.g., above 70% consistently), and debugs are active, `undebug all` is the first step to reduce load. After disabling debugs, the engineer can use `show process cpu` to verify that CPU usage drops. If CPU remains high, other issues (e.g., routing loops, broadcast storms) should be investigated.
A common symptom that prompts the use of `undebug all` is a router that becomes sluggish or drops console connections. This often occurs when a junior engineer enables `debug ip packet` without an access list, causing the router to generate output for every packet. In such cases, the engineer may not be able to type commands quickly enough to disable the debug. A best practice is to always have a pre-staged `undebug all` command in a text file or use the `reload in` command as a safety net. If the router is still responsive, `undebug all` will immediately stop the output.
Another scenario is when multiple debugs are enabled during a troubleshooting session, and the engineer wants to start fresh. Using `undebug all` is more efficient than disabling each debug individually. After disabling, the engineer can re-enable only the necessary debugs with more specific parameters (e.g., `debug ip ospf adj` instead of `debug ip ospf events`).
Correlating `undebug all` with other commands: Before disabling debugs, it is wise to save the debug output if it contains valuable information. This can be done by enabling `logging buffered` and then using `show log` after disabling debugs. Alternatively, if `terminal monitor` is used, the output is displayed on the current terminal session. After `undebug all`, the engineer can review the captured output to analyze the problem.
In summary, `undebug all` is a troubleshooting command in the sense that it is used to clean up after diagnostic activities. It ensures that the router returns to a stable state, allowing further troubleshooting without the noise of debug messages. For CCNA and CCNP candidates, mastering the use of `undebug all` is essential for lab exams, as leaving debugs enabled can cause the router to become unresponsive and waste valuable exam time.
CCNA Exam Tips
CCNA exam tip: Remember that 'undebug all' is equivalent to 'u all' (short form).
CCNA exam tip: Debug commands are CPU-intensive; always disable them after use to avoid performance issues.
CCNA exam tip: You must be in privileged EXEC mode to use 'undebug all'; it will not work in user EXEC mode.
CCNA exam tip: The exam may test that 'undebug all' disables all debugs, including those enabled in other sessions.
Common Mistakes
Mistake 1: Typing 'no debug all' instead of 'undebug all' — 'no debug all' is not a valid command; use 'undebug all' or 'u all'.
Mistake 2: Forgetting to disable debugs after troubleshooting, leaving them running and degrading router performance.
Mistake 3: Assuming 'undebug all' only affects the current session; it actually disables debugs globally for all sessions.
undebug all vs debug ip ospf events
These commands are often compared because they represent the two ends of the debugging workflow: enabling and disabling debug output. While debug ip ospf events activates targeted debugging for OSPF events, undebug all is a global stop-all command that can inadvertently turn off other necessary debugging.
| Aspect | undebug all | debug ip ospf events |
|---|---|---|
| Scope | Global (all debug types) | Specific to OSPF events |
| Configuration mode | Privileged EXEC | Privileged EXEC |
| Persistence | Immediate; non-persistent (stops all debug) | Immediate; non-persistent (until manually disabled or reload) |
| Precedence | Overrides all active debug commands | Can be overridden by undebug all or undebug ip ospf events |
| Typical use | Stop all debugging when output is overwhelming or CPU impact is high | Troubleshoot OSPF neighbor adjacency, route propagation, or state changes |
| Effect on CPU | Reduces CPU load by stopping all debug output | Increases CPU load due to real-time event logging |
Use undebug all when you need to immediately stop all debugging activity to reduce CPU load or eliminate console clutter, especially during production outages.
Use debug ip ospf events when you need to monitor OSPF protocol events like neighbor state changes or LSAs to diagnose adjacency or routing issues.
Platform Notes
In Cisco IOS-XE (e.g., on Catalyst 9000 switches or ISR 4000 series routers), the `undebug all` command behaves identically to classic IOS. The syntax and output are the same. However, on newer IOS-XE versions (16.x and later), the command may also be available in the `debug` sub-mode if you are in a debug session, but the standard privileged EXEC mode command works universally.
For NX-OS (Cisco Nexus switches), the equivalent command is `no debug all` or `undebug all`. The syntax is the same, and it disables all active debug sessions. NX-OS also supports `show debugging` to list active debugs. Note that NX-OS has a different debug architecture; some debugs may be module-specific, but `undebug all` disables all debugs across all modules.
On Cisco ASA firewalls, the equivalent command is `no debug all` or `undebug all`. ASA uses a similar debug system, and the command stops all debugging output. However, ASA also has the `debug` command with many protocol-specific options. The `undebug all` command is available in privileged EXEC mode.
In IOS-XR (e.g., on ASR 9000 or CRS routers), the command is `no debug all` or `undebug all`. IOS-XR uses a different debug infrastructure, but the command works similarly. Note that IOS-XR often requires entering a specific debug context (e.g., `debug ospf`), and `undebug all` disables all debugs regardless of context.
Behavior differences across IOS versions: In older IOS 12.x, the output of `undebug all` was simply 'All possible debugging has been turned off'. In IOS 15.x and later, the output may include a summary of which debugs were disabled. However, the core functionality remains unchanged. Always verify with `show debug` after issuing the command, regardless of platform.
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions