I would like to define a general policy for our company to set the log buffer ("logging buffered xxx"). Currently, most of our configs use the default value of 4096, which does not store much of the history. I'd like to see more, when logged onto a router. We are using different router platforms (from old 1700 up to 39xx oder 72xx) Can you give me any hints, how large the buffer can be set on a platform? Which checks should I do to determine, how large I can set the buffer?
Here's an example of a Cisco 1720 router:
Head Total(b) Used(b) Free(b) Lowest(b) Largest(b)
Processor 81AECE9C 17803244 5548816 12254428 12010916 11815908
I/O 2B43000 4968448 1560416 3408032 3374144 3396668
Cisco says: "Total = the total amount of memory available after the system image loads and builds its data structures."
So, in this example, the total bytes are 17803244, which is ~ 16.9 Mbyte. So, if I allocate 64000 bytes, my total buffer will decrease to ~16,3 Mbyte.
I my calculation above is correct, I see no problem in defining a standard value of "logging buffered 64000" for every router platform - even under high load conditions. Since 64 kbytes is a very small value compared to the total usable memory of a Cisco 1720, newer platforms should not have any problems either.
Do you agree with my thoughts? Should I take anything else into account?#
Thanks in advance!
That's an excellent choice, pretty close to the "logging buffered 50000" we use, from the 2800s to the 6500s and 7200s. Of course, logging buffer should ideally be used in conjuction with logging to multiple external syslog servers (logging host x.x.x.x) for long-term log warehousing.