About logging buffer 1

[ironrlo]

Hi...My I´m working with a Cisco 2811, I´m looking to set logging buffer. My question is How I can determinet the size of the buffer?? It will affect the operational processes in the Router??

Cisco 2811 (revision 53.51) with 251904K/10240K bytes of memory.
Processor board ID FTX1143A1D3
2 FastEthernet interfaces
1 Serial(sync/async) interface
4 Voice DID interfaces
DRAM configuration is 64 bits wide with parity enabled.
239K bytes of non-volatile configuration memory.
62720K bytes of ATA CompactFlash (Read/Write)

Thank for your comments...

 

[burtsbees]

Edge(config)#logging buffered ?
<0-7> Logging severity level
<4096-2147483647> Logging buffer size
alerts Immediate action needed (severity=1)
critical Critical conditions (severity=2)
debugging Debugging messages (severity=7)
emergencies System is unusable (severity=0)
errors Error conditions (severity=3)
filtered Enable filtered logging
informational Informational messages (severity=6)
notifications Normal but significant conditions (severity=5)
warnings Warning conditions (severity=4)
xml Enable logging in XML to XML logging buffer


I would just log to 4096 and log to a syslog server, like kiwi (free). Also, after the buffer size, you need to set the level at which it logs...

Edge(config)#logging buffered 4096 ?
<0-7> Logging severity level
alerts Immediate action needed (severity=1)
critical Critical conditions (severity=2)
debugging Debugging messages (severity=7)
emergencies System is unusable (severity=0)
errors Error conditions (severity=3)
informational Informational messages (severity=6)
notifications Normal but significant conditions (severity=5)
warnings Warning conditions (severity=4)


Burt

 

[burtsbees]

Also, for syslog server, you set the host and the level.

Edge(config)#logging trap debugging
Edge(config)#logging on
Edge(config)#logging host 10.68.68.3


Burt

 

[ironrlo]

THANKS... FOR YOU ANSWER...

I whis to know what is the optimal size for the buffer logging..??... or what kind of considerations I will take when i set the log buffer..??

 

[burtsbees]

Well, how many messages are you expecting? Usually people set them to 64000. Like I said, I would just set up Kiwi and log to it, though the buffer still has to be set---if you do this, you can set it to 4096.

Burt

 

[vipergg]

I would use something bigger than the default of 4096 , this will give you very little to look at in the buffer before it overwrites itself . Generally we use 3 times the default of 4096 or 12288 . I have seen some as big as over 500K , have not seen any issue with using one that big but it gives you a huge buffer to look thru if you are looking for something in particular.

 

[burtsbees]

Well, my point is that if you have it going to a syslog server, then that will save and timestamp all messages, so what if the buffer overwrites itself---everything is saved in the syslog server.

Burt

 

[jneiberger]

If you're doing troubleshooting on a router or switch, it's far easier to look at the logs on the device than to jump out to a syslog server, at least for me. I usually set the buffer to 8000-10000 or so. That seems to work well. I say set it for whatever size is useful to you.

 

[vipergg]

I agree with jneiberger , it easier to look thru the logs on the device itself . If the buffer is setup correct , its also timestamped with the correct day and time. We use both but it is a heck of lot easier just to look thru the device logs versus looking thru multiple months of logs on a syslog server .

 

[burtsbees]

That is true---I have one router and one switch in my network...

Burt

 

[ironrlo]

THANK YOU FOR THE TIPS...!!!