04-13-2022 11:09 AM
Hello Everyone,
I am getting a logging error 414002 in my ASA. I see that disk0:/syslog is full of files on some of my ASA's and some have zero files int the disk0:/syslog. Here are the error message(s) I am getting. They are similar, but just a little different with both have the 414002 error:
"Failed to save logging buffer to flash:/syslog directory using file name: filename: xxxxx: [Isufficient space, buffer size: 16384 bytes, requires additional 1734983680 bytes]"
I currently have 4,572,041216 bytes available. There are no logs in the disk0:/syslog folder on the ASA
OR
"Failed to save logging buffer to flash:/syslog directory using file name: filename: xxxxx: [File creation error]"
I currently have 4,033,310,720 bytes available. There are A LOT of logs in the disk0:/syslog
Here is my logging config:
logging enable
logging timestamp
logging buffer-size 16384
logging buffered informational
logging trap informational
logging history informational
logging asdm informational
logging mail emergencies
logging from-address FIELDOFFICEASA@YAHOO.COM
logging recipient-address HELPDESKEMAIL@YAHOO.COM level emergencies
logging queue 1024
logging device-id hostname
logging host SYSLOG_SERVER 192.168.1.45 6/1514
logging flash-bufferwrap
logging flash-minimum-free 2000
logging flash-maximum-allocation 2000000
logging permit-hostdown
logging class auth history informational
I understand that's a lot of logging, but I have an IA department to keep happy and this amount of logging is required.
I know I can issue the no logging message 414002, but would like a better solution if possible. Thoughts, ideas, suggestions?
Solved! Go to Solution.
04-14-2022 01:56 PM
After a discussion with IA, I was able to remove the following line:
no logging flash-bufferwrap
This resolved the issue and calmed down the alerts.
04-13-2022 01:40 PM
i would suggest to store only required logs to flash, rest all send to Syslog server
04-13-2022 03:26 PM
BB....what config changes to I need to make?
04-14-2022 01:56 PM
After a discussion with IA, I was able to remove the following line:
no logging flash-bufferwrap
This resolved the issue and calmed down the alerts.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: