04-07-2007 04:31 PM
If I have buffer logging and syslog set to record debugging level 7 messages, why do I see more messages sent to the buffer than the syslog server. I would have thought this would be equal. Such as:
rtrx>sh log
Syslog logging: enabled (44 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns)
Console logging: disabled
Monitor logging: disabled
Buffer logging: level debugging, 160 messages logged
Logging Exception size (4096 bytes)
Count and timestamp logging messages: disabled
Persistent logging: disabled
Trap logging: level debugging, 192 message lines logged
Logging to 64.x.x.x, 69 message lines logged
Log Buffer (16384 bytes):
Above, what are the 44 messages dropped?
04-12-2007 06:11 AM
In this case you might have configured the system to log messages to the buffer with certain severity and to the logging server with certain severity.
04-12-2007 05:55 PM
The original post says that both buffer and syslog are set to level 7 messages. This appears to be confirmed in the output posted:
Buffer logging: level debugging, 160 messages logged
Trap logging: level debugging, 192 message lines logged
I wonder if it is a possibility that buffer logging was configured a bit later than syslog (trap) logging and that the 32 message difference is from the time difference in configuring?
HTH
Rick
04-13-2007 06:39 AM
Don't look at the trap logging, look at the logging to host x.x.x.x, there is a significant difference in the amount of messages that it has sent during the same time, because the count is from after a reboot.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: