Syslog Logging - Buffer

Unanswered Question
May 25th, 2007


I have syslog logging enabled on my test router here. I'm not forwarding the logs to a syslog server.

How do I view the logs that are stored on the router's buffer? I executed the sh loggign command but it only gives me 4 logging methods. How do I actually view the logs in detail?

Other than traffic logs, how do I view performance logs on the router if it's not running properly or experiencing some sort of issue? I have very terrible ping responses this morning on the router, so how can I tell what the problem is?


I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
spremkumar Fri, 05/25/2007 - 04:56

Hi Danny

with show logging and logs taken out from router i dont think you will be able to troubleshoot performance related issues..

You need to execute few other commands like show process cpu / show interface serial,fastethernet and also if possible you can enable netflow and find out whether you router is not handling any worm/virus traffic...

Need more info like on the connectivity on the router and the usage pattern as well as the other end of the connectivity..


mohammedmahmoud Fri, 05/25/2007 - 05:26


You must enable logging to the router buffer first using "logging buffered" before using show logging, or it will give you the result you see.

HTH, please do rate all helpful replies,

Mohammed Mahmoud.

Richard Burts Fri, 05/25/2007 - 05:55

I believe that there is some ambiguity in this situation. In his original post Dan says: "I have syslog logging enabled on my test router here." But as Mohammed points out the symptoms sound like logging to the buffer is not configured. Perhaps Dan could post the output of "show run | include logging" and this would show exactly what is configured. Posting the output of "show log" would also be helpful and would help us to see what logging is enabled.

I wonder if there is a slightly different possibility of an explanation. When you do show log it displays the first set of lines which describe what is enabled for logging and displays a "more" prompt. If you type anything other than the space bar or the enter key then the display is terminated. Which would produce the symptoms described. (I have had experience with some terminal emulators which would frequently send something that is interpreted as a key stroke and would terminate show displays. Perhaps Dan could clarify whether there was a more prompt when he does the show log command?



danny9797 Fri, 05/25/2007 - 07:30

Sorry for the confusion guys and thanks for the replies.

If I issue the sh log command, it states Syslog logging: enabled.

It wasn't going to the buffer though. So I just enabled the logging to go to the buffer but it's still not doing anything.

If I issue the command sh logging, I just get an extra line - %SYS-5-CONFIG_I: Configured from consol by vty0

Richard Burts Fri, 05/25/2007 - 07:56


As you have discovered having syslog enabled is one thing and controlling what it is sent to is something else. Syslog messages go to the console by default and may also go the the monitor (to the vty sessions when terminal monitor is enabled), to the logging buffer, and to a syslog server.

The fact that you got the line:

%SYS-5-CONFIG_I: Configured from consol by vty0

is an indication that logging to the buffer is working. It sounds like you are expecting other things in the log. Can you tell us what you were expecting that is not there? Your original post mentioned something about performance logs, but I am not clear what you are describing as performance logs.



danny9797 Fri, 05/25/2007 - 08:42

Is the sh logging command used to execute the logs in the buffer? I thought I would get more useful information out of the logging, all it tells me is 12 messages logged for console and 16 messages for trap logging. What good is this info?

When I mentioned performance logs, I meant overall health and performance of the router. I know about the cpu and memory commands but are there any logs that indicate communication issues with another link, slowness and congestion on the line, etc.

I had some very poor ping responses from the router this morning, many crc errors, aborts,etc, how can this be troubleshooted on the router and what may be causing it?


Richard Burts Fri, 05/25/2007 - 08:50


Most of what you are looking for are things that will not be in the logs. The logs are good for things like interfaces up or down. If you are running a dynamic routing protocol, there are sometimes routing protocol messages (warnings or errors) that are written to syslog. But things like CRC errors, or interfaces resets, or line congestion are not written to syslog. You need other monitoring or troubleshooting tools and approaches for that.




This Discussion