Syslog Buffering

[andymorph]

We have syslog set up on a remote site - we've got an issue with ISP line going down, so obviously so does our tunnel, and then we lose syslog back to our central site.  Is there away to set up the syslog messages from a firewall so that it buffers logs for a while before sending ? Or something like this ?

Just trying to find a away of seeing the syslog messages for when the issue occurs

[Seb Rupik]

Hi there,

You could create an EEM script which checks for reachability to your syslog server. In the event of an ISP failure it could count to 60 and then dump the current logging buffer to disk:

copy logging system disk0:/foo.log

You could then retrieve this at a later time.

cheers,

Seb.