syslogging 1

[doubleJ]

I have set up a syslog server running window 2k. I also have installed kiwi for the log files. My question is what else would I need "programs" "services" etc. that would make this server complete? My primary use for the server is for logging of two Cisco 2600 routers and any other servers in my network that is set up for logging. Also, what is the recommended amount of data to log? I don’t want to chew up cpu on the routers. Looking forward to your help!

doublj

 

[DuMan]

doubleJ

You shouldnt need anything else for the server. As far as logging history I personaly keep up to 3 to 4 weeks. That depends on what you are watching from the routers, what level of logging. Informational logging can be overwhelming (keep that in mind). The cpu on the routers should be fine. I watch over 300 2610's and 11's. Never had any problems whith chewing up the cpu. Need anything else let me know. Happy logging.

 

[doubleJ]

Thanks, I guess I'll go ahead and set the routers up for logging. When you Talk about the level of logging what do you recommend? I'm not sure what I'm looking for or what I can gain from logging. Can you clarify why logging is a good thing on Cisco Routers!

Appreciate the help!

 

[DuMan]

There are differnt severity levels. They go as followed.
0 - emergency
System unusable

1 - alert
Immediate action needed

2 - critical
Critical condition

3 - error
Error condition

4 - warning
Warning condition

5 - notification
Normal, but significant, condition

6 - informational
Informational message only

7 - debugging
Appears during debugging only

Since your only logging 2 routers I would go ahead and set logging on all levels. Just so you can see what each level puts out. As for why logging is a good thing, it helps you troubleshoot. Keep in mind not all system error messages indicate problems with your system. Some are purely informational, while others may help diagnose problems with communications lines, internal hardware, or the system software. Also be aware of "false positives", that depends on what level of IOS your running on your routers. There are some bugs in Cisco's IOS that will put out those "false positives".

If you need help with anything let me know.

sd@gceng.net

 

[doubleJ]

thanks much! I will keep your e-mail on file for future use. It's always good to have someone to bounce ideas off of.

JJ