Maximum Log Buffer for various Router platforms

Answered Question
Jun 13th, 2012

Dear Experts,

I would like to define a general policy for our company to set the log buffer ("logging buffered xxx"). Currently, most of our configs use the default value of 4096, which does not store much of the history. I'd like to see more, when logged onto a router. We are using different router platforms (from old 1700 up to 39xx oder 72xx) Can you give me any hints, how large the buffer can be set on a platform? Which checks should I do to determine, how large I can set the buffer?

Here's an example of a Cisco 1720 router:

Cisco1720#sh mem

                Head    Total(b)     Used(b)     Free(b)   Lowest(b)  Largest(b)

Processor   81AECE9C    17803244     5548816    12254428    12010916    11815908

      I/O    2B43000     4968448     1560416     3408032     3374144     3396668

Cisco says: "Total = the total amount of memory available after the system image loads and builds its data structures."

So, in this example, the total bytes are 17803244, which is ~ 16.9 Mbyte. So, if I allocate 64000 bytes, my total buffer will decrease to ~16,3 Mbyte.

I my calculation above is correct, I see no problem in defining a standard value of "logging buffered 64000" for every router platform - even under high load conditions. Since 64 kbytes is a very small value compared to the total usable memory of a Cisco 1720, newer platforms should not have any problems either.

Do you agree with my thoughts? Should I take anything else into account?#

Thanks in advance!

I have this problem too.
0 votes
Correct Answer by yjdabear about 1 year 10 months ago

That's an excellent choice, pretty close to the "logging buffered 50000" we use, from the 2800s to the 6500s and 7200s. Of course, logging buffer should ideally be used in conjuction with logging to multiple external syslog servers (logging host x.x.x.x) for long-term log warehousing.

  • 1
  • 2
  • 3
  • 4
  • 5
Average Rating: 5 (1 ratings)
Correct Answer
yjdabear Thu, 06/14/2012 - 14:58

That's an excellent choice, pretty close to the "logging buffered 50000" we use, from the 2800s to the 6500s and 7200s. Of course, logging buffer should ideally be used in conjuction with logging to multiple external syslog servers (logging host x.x.x.x) for long-term log warehousing.

sebastian.lemke Fri, 06/15/2012 - 03:26

OK, I tested this on a Cisco 1721, which already had most of its memory used. After increasing the buffer, I filled up the log with "debug icmp" and 1000 pings to my loopback interface.

_______ before (logging buffered 4096) _____________

#sh mem

                Head    Total(b)     Used(b)     Free(b)   Lowest(b)  Largest(b)

Processor   8238F928    17368432    12767960     4600472     4359884     4524832

      I/O    3333400    13421568     1746744    11674824    11630848    11644028

_______ after (logging buffered 64000) _____________

#sh mem

                Head    Total(b)     Used(b)     Free(b)   Lowest(b)  Largest(b)

Processor   8238F928    17368432    12889100     4479332     4210520     4395940

      I/O    3333400    13421568     1799992    11621576    11621576    11615740

The difference in "Used(b)" is only 121140 bytes, which is about 118 kbytes. Still there are 4.2 Mbytes free memory to use for other stuff.

I'll set "logging buffered 64000" as default.

Thanks!

Actions

Login or Register to take actions

This Discussion

Posted June 13, 2012 at 9:04 AM
Stats:
Replies:2 Avg. Rating:5
Views:1035 Votes:0
Shares:0

Related Content

Discussions Leaderboard

Rank Username Points
1 2,483
2 1,624
3 1,445
4 861
5 578