cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1255
Views
0
Helpful
4
Replies

Syslog traps

vnealy
Level 1
Level 1

Does anyone know if there is a way to have more than 3 syslog destinations on a Cisco device. It is my understanding that only the first 3 are used in a device config. Can wildcards be used or are there any other work arounds?

Thanks.

4 Replies 4

nhabib
Level 9
Level 9

There is no limit. My RSM had 2 defined and I just addedd 3 more:

nms-5500a-rsm#show logg

Syslog logging: enabled (0 messages dropped, 6 messages rate-limited, 0 flushes, 0 overruns)

Console logging: level debugging, 12744 messages logged

Monitor logging: level debugging, 0 messages logged

Buffer logging: level debugging, 12750 messages logged

Logging Exception size (4096 bytes)

Trap logging: level informational, 25449 message lines logged

Logging to 172.18.124.170, 25449 message lines logged

Logging to 172.18.123.49, 25449 message lines logged

Logging to 10.10.10.10, 1 message lines logged

Logging to 10.10.10.11, 1 message lines logged

Logging to 10.10.10.12, 1 message lines logged

Thanks.

Then it must be CATs only that have this limit. I just tried adding a new address and here is what I got: eccsedg1> (enable) set logging server 10.30.59.20

System logging server table is full. 10.30.59.20 not added into system logging server table.

This is a 6513 running 8.4.3.

CatOS has this limit.

There is no limit like this in IOS, so Cat switches running IOS would be OK with more than 3 syslog servers.

However, I generally discourage more than 4. There are obvious reasons for having more (lots of NM tools doing a lot of Syslog analysis), however, I'd start to investigate Syslog repeaters like Syslog-NG, if you really had that need.

You'd rather have a router/switch doing it's fundamental job rather than repeating a similar message over and over...

I worked with a customer that had 9 syslog receivers and 9 SNMP trap receivers. It was quite interesting seeing the message rate out of these boxes on Monday morning when all the users started up (Spanning Tree messages)...

That makes perfect sense to me.

Thank you.