ACS log retention time

[riteshmalpani]

.

Hi,

I have ACS SE 1120 appliance running version 4.2. My customer wants to know for how long he can preserve logs in ACS. I checked various other posts  they speak that " When a log file reaches 10 MB in size, ACS starts a new log file. ACS retains the seven most recent log files for each CSV log. "

However when i tried to view logs for failed authentication past one month. I was able to see them .

I dont understand how long ACS preserve logs.

Regards

Ritesh

[Vinay Sharma]

Hi Ritesh,


The ACS appliance 1111, 1112 and 1113 cannot handle too many internal logs like the 1120 or 1121, that's why
we have the option to send the logs to the remote agent for example which
stores the ACS logs on a Windows server.

About how the ACS stores the logs, here is the documentation:

http://tools.cisco.com/squish/c14F5

Extracted from previous link:
"CSV Log Size and Retention

For each CSV log, ACS writes a separate log file. When a log file size
reaches 10 MB, ACS starts a new log file. ACS retains the seven most recent log files for each CSV log."

thanks,

Vinay

_______________

If  this helps you and/or answers your question please mark the question as  "answered" and/or rate it, so other users can easily find it.

[riteshmalpani]

Hi Vinay,

I am still not answerable to my customer as for, how long logs will retain in ACS.

Regard

Ritesh

[Eduardo Aliaga]

Hello Ritesh. This is not a matter of time but of disk space. If your appliance constantly generates lots and lots of logs, then it will create several CSV logs, and when there would be more than 7, then old logs will be deleted to create space for newer logs.

On the other hand, if your appliance generates few logs, then those logs could remain for several weeks or several months.

[Vinay Sharma · Accepted solution]

Hi Ritesh,

it is not the matter of time but it is related to the size of the file. If you are able to check the fialed logs from last month, that shows that the failed logs file has not crossed the size of 10MB. once the size will cross 10MB, it will genrate another file.

thanks,

Vinay

____________________

If  this helps you and/or answers your question please mark the question as  "answered" and/or rate it, so other users can easily find it.

[riteshmalpani]

Actually, I have purchase new ACS appliance (1113 and 1120), and I want to generate CSV files on daily basis for local logging. Is it Possible with these Appliacnce and version 4.2.1

I was able to do same with ACS v3.3 windows software version.

Regards

Ritesh

[darpotter]

If you're at all worried by log retention issues on the appliance, check out extraxi csvsync (www.extraxi.com/csvsync.htm) which is our http client that can be used to perform hourly, daily, weekly (etc) bulk downloads of csv data off the ACS.

CSVSync works with ACS v3.x upto 4.x, and handles mixed ACS versions and platforms (sw & appliance)

Once you have the logs downloaded you can archive or import into extraxi aaa-reports! (www.extraxi.com/aaare.htm) for all your reporting needs.

Free 60 day trials available too.