PIX syslog paradox

[mbalasubramanian]

We have a pix 515E pix fos ver 7 configured to syslog to 2 hosts on trap level info.We have noticed whenever any one syslog is stopped...and do a icmp debug trace..the pix is found to be receiving icmp voluminous destination unreachable from the syslog server which is down and the other syslog hosts register icmp type code 3 from the downed syslog server hitting the pix interface.This maked our PIX util peak to 99%

Does this mean PIX keeps

1)ICMP keepalives with every syslog hosts

2)And how is it when one syslog server is down the other syslog server registers icmp type 3 code requests from the syslog server whcih has been downed in such voluminous quantities that the PIX is overwhelmed

Normal syslog udp is being used in this setup , as soon as we drop the logging to warning..the problem disappears

Pls advise

[mheusinger]

Hello,

have you had a look at the number of syslog messages from the PIX and the content? Each syslog message and each ICMP message to the PIX have to be processed, many of them and you might have high CPU utilization.

I am assuming, that for each syslog message sent to the downed server you get a port unreachable back to the PIX. This means roughly twice the amount of CPU utilization compared to no ICMP (server nod being down). Are you sure about the ICMP message being really destination unreachable? Then I would assume a router to be the source of them. The PIX does not use ICMP keepalives with syslog servers, afaik.

Changing the logging level should simply reduce the number of messages logged and therefore reduce the CPU load. In case you do not need the info level messages this would be the recommendation - do not log, what you are not using in some way, it will only waste ressources like CPU in the PIX.

Hope this helps! Please rate all posts.

Regards, Martin

[mpalardy]

We had the same problem here when syslog server or snmp-server (trap) went under maintenance.

This command on the pix solved the issue.

icmp permit host _ip_server_ unreachable inside

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/gl.htm#wp1026574

HTH

Mike