More messages in buffer than on syslog server

tmarlow · ‎04-07-2007

If I have buffer logging and syslog set to record debugging level 7 messages, why do I see more messages sent to the buffer than the syslog server. I would have thought this would be equal. Such as:

rtrx>sh log

Syslog logging: enabled (44 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns)

Console logging: disabled

Monitor logging: disabled

Buffer logging: level debugging, 160 messages logged

Logging Exception size (4096 bytes)

Count and timestamp logging messages: disabled

Persistent logging: disabled

Trap logging: level debugging, 192 message lines logged

Logging to 64.x.x.x, 69 message lines logged

Log Buffer (16384 bytes):

Above, what are the 44 messages dropped?

aghaznavi · ‎04-12-2007

In this case you might have configured the system to log messages to the buffer with certain severity and to the logging server with certain severity.

Richard Burts · ‎04-12-2007

The original post says that both buffer and syslog are set to level 7 messages. This appears to be confirmed in the output posted:

Buffer logging: level debugging, 160 messages logged

Trap logging: level debugging, 192 message lines logged

I wonder if it is a possibility that buffer logging was configured a bit later than syslog (trap) logging and that the 32 message difference is from the time difference in configuring?

HTH

Rick

HTH

Rick

tmarlow · ‎04-13-2007

Don't look at the trap logging, look at the logging to host x.x.x.x, there is a significant difference in the amount of messages that it has sent during the same time, because the count is from after a reboot.