Reading the System log using logging buffer in Cisco Catalyst device

[santoshkumarpanda07930]

Hi,

We want to process the Cisco Catalyst device system logs for our NMS application. As per the Cisco document, Logging buffer is circular and it overwrites the older log with the newer log if the buffer size exceed the specified limit. If this overwrites the older log message with newer message, Do I need to change anything in reading approach.

Suppose in the buffer we have message 1,2,3,4,5 and the buffer size full. when the new message comes it will overwrite the older one with new one, So the message buffer looks like 6,2,3,4,5. In such can If I give "show logging buffer -1" will be return 5 or 6. 

Do I need to take care of anything during reading the log or catalyst will provide the latest message when I give "show logging buffer -1".

Second question : does this logging buffer supported from specific version of catalyst device or this is support for all 3X to 6X devices.

Thanks & Regards

Santosh

[Mohammed al Baqari]

Hi, you need to send the logs to logging server using logging host command.
You can retrieve a log from buffer if its overwritten. Logging buffer is
supported for all types of catalyst switches

**** please remember to rate useful posts

[santoshkumarpanda07930]

Thanks Baqari for quick response.

I want clarification on below query. For example I have below system log output

Console> (enable) show logging buffer -5

000001: 1999 Apr 16 08:40:11 %SYS-5-MOD_OK:Module 1 is online
000002: 1999 Apr 16 08:40:14 %SYS-5-MOD_OK:Module 3 is online
000003: 1999 Apr 16 08:40:14 %SYS-5-MOD_OK:Module 2 is online
000004: 1999 Apr 16 08:41:15 %PAGP-5-PORTTOSTP:Port 2/1 joined bridge port 2/1
000005: 1999 Apr 16 08:41:15 %PAGP-5-PORTTOSTP:Port 2/2 joined bridge port 2/2

The buffer size full and new system log raised. in that case the system log with sequence number 000001 will be overwritten by new one with sequence number 000006. in such can what will be the out of show logging buffer -5

Console> (enable) show logging buffer -5

000002: 1999 Apr 16 08:40:14 %SYS-5-MOD_OK:Module 3 is online
000003: 1999 Apr 16 08:40:14 %SYS-5-MOD_OK:Module 2 is online
000004: 1999 Apr 16 08:41:15 %PAGP-5-PORTTOSTP:Port 2/1 joined bridge port 2/1
000005: 1999 Apr 16 08:41:15 %PAGP-5-PORTTOSTP:Port 2/2 joined bridge port 2/2

000006: 1999 Apr 16 08:40:18 %SYS-5-MOD_OK:Module 1 is online

OR 

Console> (enable) show logging buffer -5

000006: 1999 Apr 16 08:40:18 %SYS-5-MOD_OK:Module 1 is online

000002: 1999 Apr 16 08:40:14 %SYS-5-MOD_OK:Module 3 is online
000003: 1999 Apr 16 08:40:14 %SYS-5-MOD_OK:Module 2 is online
000004: 1999 Apr 16 08:41:15 %PAGP-5-PORTTOSTP:Port 2/1 joined bridge port 2/1
000005: 1999 Apr 16 08:41:15 %PAGP-5-PORTTOSTP:Port 2/2 joined bridge port 2/2

Based on this output our parsing logic will change.

Thanks & Regards

Santosh 

[Roger Kallberg]

You’re likely would be better off to ask this line off question in another forum in this community more fitting than IP Telephony and Phones.

[santoshkumarpanda07930]

Sorry Roger, 

This is for the first time posting the query. Next time onward I will take care of this.

Regards

Santosh 

[Roger Kallberg]

No need to be sorry. It was meant to be a friendly advice.