Logging Buffer

mjgoodman · ‎04-05-2007

I'd like to make sure my logging buffer in my switches save enough entries. I found the following line of configuration that I had on some older switches. What will this do?

logging buffered 5000 debugging

Also, can I increase this? I have a a couple of 6500's and several 2970's in my network. All logging is local to the switches as I do not have a syslog server.

Danilo Dy · ‎04-05-2007

Hi,

usage: logging buffered buffer_size severity_level

example: logging buffered 10000 debugging

- The "logging buffered" argument will log messages to internal buffer

- The "debugging" argument will log messages up to Level 7 (debugging)

- The "buffer-size" argument is the size of the buffer from 4096 to 4,294,967,295 bytes. The default size varies by platform. Most commonly use is 10000 or 16384

If you don't have a syslog server and is logging local to the device, I advice the following to minimize the logs;

- Don't create a config that will generate logs, like putting log in an ACL

- Try not to use severity_level debugging. Use severity_level warnings - this includes important messages like emergencies, alerts, critical, errors, and warnings, it does not includes notifications and informational

mjgoodman · ‎04-09-2007

Thanks for this information folks.

Richard Burts · ‎04-05-2007

Michael

in the logging buffered command the number that is referenced is the amount of memory to allocate to the logging buffer (in your case 5000). The amount of memory allocated controls how many log messages it can contain before it fills up and starts to overwrite the older messages. If you want more messages then allocate more memory. Be aware that the memory that you allocate to the logging buffer reduces memory available for other tasks. So you might want to check on your memory utilization as you start to change the amount of memory allocated for logging.

You might also want to think about the logging level that you specify. As currently configured with level of debugging, you will get ALL messages (and the buffer will fill more quickly). You might think about what messages you would miss if you made the level informational (level 6) or notification (level 5) etc. As you change the logging level you eliminate some volume of messages but the messages that are generated will be in the buffer longer. So it is a tradeoff to be considered.

HTH

Rick

HTH

Rick

Amit Singh · ‎04-05-2007

Hello,

This will enable system message logging to local buffer and limits messages logged to the buffer to 5000 on severity level debugging. All the messages which are equal to or lower than debugging levels will be loggged to the local buffer.

Yes, you can increase the size to a max size of 4,294,967,295 bytes.

HTH,Please rate if it does.

-amit singh