06-13-2012 09:04 AM
Dear Experts,
I would like to define a general policy for our company to set the log buffer ("logging buffered xxx"). Currently, most of our configs use the default value of 4096, which does not store much of the history. I'd like to see more, when logged onto a router. We are using different router platforms (from old 1700 up to 39xx oder 72xx) Can you give me any hints, how large the buffer can be set on a platform? Which checks should I do to determine, how large I can set the buffer?
Here's an example of a Cisco 1720 router:
Cisco1720#sh mem
Head Total(b) Used(b) Free(b) Lowest(b) Largest(b)
Processor 81AECE9C 17803244 5548816 12254428 12010916 11815908
I/O 2B43000 4968448 1560416 3408032 3374144 3396668
Cisco says: "Total = the total amount of memory available after the system image loads and builds its data structures."
So, in this example, the total bytes are 17803244, which is ~ 16.9 Mbyte. So, if I allocate 64000 bytes, my total buffer will decrease to ~16,3 Mbyte.
I my calculation above is correct, I see no problem in defining a standard value of "logging buffered 64000" for every router platform - even under high load conditions. Since 64 kbytes is a very small value compared to the total usable memory of a Cisco 1720, newer platforms should not have any problems either.
Do you agree with my thoughts? Should I take anything else into account?#
Thanks in advance!
Solved! Go to Solution.
06-14-2012 02:58 PM
That's an excellent choice, pretty close to the "logging buffered 50000" we use, from the 2800s to the 6500s and 7200s. Of course, logging buffer should ideally be used in conjuction with logging to multiple external syslog servers (logging host x.x.x.x) for long-term log warehousing.
06-14-2012 02:58 PM
That's an excellent choice, pretty close to the "logging buffered 50000" we use, from the 2800s to the 6500s and 7200s. Of course, logging buffer should ideally be used in conjuction with logging to multiple external syslog servers (logging host x.x.x.x) for long-term log warehousing.
06-15-2012 03:26 AM
OK, I tested this on a Cisco 1721, which already had most of its memory used. After increasing the buffer, I filled up the log with "debug icmp" and 1000 pings to my loopback interface.
_______ before (logging buffered 4096) _____________
#sh mem
Head Total(b) Used(b) Free(b) Lowest(b) Largest(b)
Processor 8238F928 17368432 12767960 4600472 4359884 4524832
I/O 3333400 13421568 1746744 11674824 11630848 11644028
_______ after (logging buffered 64000) _____________
#sh mem
Head Total(b) Used(b) Free(b) Lowest(b) Largest(b)
Processor 8238F928 17368432 12889100 4479332 4210520 4395940
I/O 3333400 13421568 1799992 11621576 11621576 11615740
The difference in "Used(b)" is only 121140 bytes, which is about 118 kbytes. Still there are 4.2 Mbytes free memory to use for other stuff.
I'll set "logging buffered 64000" as default.
Thanks!
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide