Accounting, too many records

[Giuliano Gerardi]

Following best practices on cisco documentations we did set

aaa acounting update periodic 5

with 250 switches in the deployment every single switch is geneating and sending 9.990 acct records

this is too much

the new testing parameterswe are using is

aaa acounting update newinfo periodic 15

and this lowered accts by 2/3 (3500)

moreover from switch monitoring the most accts records sent by it are related to the trunk-port

any suggestion to mitigate this informations storm rather than raising the 15 min period to higher values?

are this records generating from the trunk port normal?

TY

[Jatin Katyal]

When using both the newinfo and periodic keywords, interim accounting records are sent to the accounting server  every time there is new accounting information to report, and accounting  records are sent to the accounting server periodically as defined by  the argument number. Yes, we should try to increase the time interval (say 30 mins) to cut down the accounting logs. No, this records should not be limited to only trunk ports.

Jatin Katyal


- Do rate helpful posts -