ESA IronPort C190 ver: 10.0.0-203

[steven2018]

Syslog internal buffer overflow. Some data may be dropped. this may be because server () is not accepting data fast enough or because data is being generated more quickly than can be accommodated by the syslog protocol. Is there a Cisco Bug associated with the ESA like the Cisco Web Security Appliance Bug CSCve96173?

[Ken Stieers]

Yes. CSCve18276, CSCvg34484 look to be related/similar.

[steven2018]

Thanks Ken. 

[Paul Thomas Cyblue]

We have all logs via Syslog TCP on very heavy servers. Including LDAP Debug and SMTP logs.
Do not try UDP - that simply hides the issue and data loss.

The problem is as it states, the receiver is not fast enough ( Rsyslog queues forming or not enough TCP threads or heavy logging server that needs another NIC etc.)
There is no bug as such, just an enhancement to follow WSA capability. It would be good for a larger buffer in times of small outages - as even a Load-balancer takes a while to figure out a destination Syslog server is down.