topic Re: PIX syslog servers in Network Security https://community.cisco.com/t5/network-security/pix-syslog-servers/m-p/469925#M534374 <HTML><HEAD></HEAD><BODY><P>Also, don't forget that unless you are using syslog over TCP, syslog is based on UDP (i.e. "spray and pray"). There is no guarantee of delivery with UDP, so occasional messages could be dropping within your network.</P></BODY></HTML> Tue, 16 Aug 2005 19:55:37 GMT tbissett 2005-08-16T19:55:37Z PIX syslog servers https://community.cisco.com/t5/network-security/pix-syslog-servers/m-p/469921#M534346 <P>Our pix is sending syslog messages to two servers. The servers archive messages every hour. Why would one server have 2% larger files than the other? Does the pix have a first choice server? thanks</P> Fri, 21 Feb 2020 08:19:28 GMT https://community.cisco.com/t5/network-security/pix-syslog-servers/m-p/469921#M534346 abevers 2020-02-21T08:19:28Z Re: PIX syslog servers https://community.cisco.com/t5/network-security/pix-syslog-servers/m-p/469922#M534355 <HTML><HEAD></HEAD><BODY><P>Is your syslog software configured the same on both machines? They could be logging at different log levels. The same goes for the PIX, it can log at different log levels to different syslog servers.</P></BODY></HTML> Wed, 10 Aug 2005 17:22:44 GMT https://community.cisco.com/t5/network-security/pix-syslog-servers/m-p/469922#M534355 Solace 2005-08-10T17:22:44Z Re: PIX syslog servers https://community.cisco.com/t5/network-security/pix-syslog-servers/m-p/469923#M534362 <HTML><HEAD></HEAD><BODY><P>The software (Kiwi) is configured the same but the machines are not. One is an XP workstation and one is a 2003 server. Is there a way to tell if messages are being dropped? maybe compare message count on the pix with message count on the servers?</P></BODY></HTML> Tue, 16 Aug 2005 17:40:57 GMT https://community.cisco.com/t5/network-security/pix-syslog-servers/m-p/469923#M534362 abevers 2005-08-16T17:40:57Z Re: PIX syslog servers https://community.cisco.com/t5/network-security/pix-syslog-servers/m-p/469924#M534367 <HTML><HEAD></HEAD><BODY><P>Are both disk partitions NTFS or FAT? If they are different file structures, then that would clearly explain it. It might also be the file structure on the server versus workstation. All things being equal, you should expect equal file sizes, but all things are not equal in your configuration.</P></BODY></HTML> Tue, 16 Aug 2005 19:40:24 GMT https://community.cisco.com/t5/network-security/pix-syslog-servers/m-p/469924#M534367 jphilope 2005-08-16T19:40:24Z Re: PIX syslog servers https://community.cisco.com/t5/network-security/pix-syslog-servers/m-p/469925#M534374 <HTML><HEAD></HEAD><BODY><P>Also, don't forget that unless you are using syslog over TCP, syslog is based on UDP (i.e. "spray and pray"). There is no guarantee of delivery with UDP, so occasional messages could be dropping within your network.</P></BODY></HTML> Tue, 16 Aug 2005 19:55:37 GMT https://community.cisco.com/t5/network-security/pix-syslog-servers/m-p/469925#M534374 tbissett 2005-08-16T19:55:37Z