Syslog in Cisco Prime

[richardfinnie]

Hi All!

We are currently planning a Cisco Prime installation in an effort to replace a sprawl of tools currently. One of the crucial pieces of our environment is syslog, and even though we are a small shop, we currently generate roughly 22million log entries daily. Looking at the syslog limits in Prime, it appears that this will be not even close to enough (and it also seems to be overkill, considering that our device counts line up with Prime Express). Anyone else have suggestions or willing to share how they've approached logging in their environments?

[Marvin Rhoads]

22 million daily from a small number of devices sounds like you are doing verbose log levels from a firewall or two. No way should a network of switches and routers generate that number of logs.

Is there a regulatory or legal requirement for you to collect that verbose a level of logging?

That aside, customers with that volume of messages typically use a separate dedicated tool such as Splunk to ingest that much data.