DNA Center syslog

[Janvandergraaf1]

If logging to a syslog server is enabled on DNA center, what is the amount of daily log volume we could expect?

I suppose this will also be related to the number of devices (switches, clients) managed by DNAC. Are there any guidelines for calculating the log volume?

[Johannes_Grimm]

Hi Jan,

do you want to export the System Syslog messages from the DNA Center? If so, as far as I know you have to do this in /etc/rsyslog.conf. To get a rough idea of how many messages there will be you can analyze the /var/log/syslog file. In my experience there are a lot of messages, so it will probably be too much for the syslog server.

If you simply add a syslog server to the Network Settings (Design -> Network Settings -> Network), the DNA Center will only add the logging host when provisioning. I think the critical trap level will be configured. Then you have the normal amount of syslog messages a switch produces.

Small tip:

Since the DNA user logs on to the device very often, I recommended to remove the logging process from the local buffer. This simplifies the local troubleshooting later.

logging discriminator dna-user msg-body drops dna-user has exited|user: dna-user
logging buffered discriminator dna-user

Best regards,

Johannes

[sivathot]

The log files are created and stored in a centralized location on your Cisco DNA Center host. From this location, the Cisco DNA Center can query and display them in the GUI. The total compressed size of the log files is 2 GB. If the log files that are created are in excess of 2 GB, the pre-existing log files are overwritten with the newer log files.

[wwvan]

is this the Audit Logs on DNA center? Or where do I see the syslog