More messages in buffer than on syslog server

Unanswered Question
Apr 7th, 2007
User Badges:

If I have buffer logging and syslog set to record debugging level 7 messages, why do I see more messages sent to the buffer than the syslog server. I would have thought this would be equal. Such as:

rtrx>sh log

Syslog logging: enabled (44 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns)

Console logging: disabled

Monitor logging: disabled

Buffer logging: level debugging, 160 messages logged

Logging Exception size (4096 bytes)

Count and timestamp logging messages: disabled

Persistent logging: disabled

Trap logging: level debugging, 192 message lines logged

Logging to 64.x.x.x, 69 message lines logged

Log Buffer (16384 bytes):

Above, what are the 44 messages dropped?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 3 (2 ratings)
aghaznavi Thu, 04/12/2007 - 06:11
User Badges:
  • Silver, 250 points or more

In this case you might have configured the system to log messages to the buffer with certain severity and to the logging server with certain severity.

Richard Burts Thu, 04/12/2007 - 17:55
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

The original post says that both buffer and syslog are set to level 7 messages. This appears to be confirmed in the output posted:

Buffer logging: level debugging, 160 messages logged

Trap logging: level debugging, 192 message lines logged

I wonder if it is a possibility that buffer logging was configured a bit later than syslog (trap) logging and that the 32 message difference is from the time difference in configuring?



tmarlow Fri, 04/13/2007 - 06:39
User Badges:

Don't look at the trap logging, look at the logging to host x.x.x.x, there is a significant difference in the amount of messages that it has sent during the same time, because the count is from after a reboot.


This Discussion