ASDM and Internal Buffer Logging on Cisco ASA

[tanveer.baig1]

Hello Everyone,

I need some clarification on how ASA logs system messages and how they are displayed in ASDM. I have default buffer size of 4096 bytes and ASDM logging configured for a queue size of 100. What is the difference between these two settings?

Also, I've configured an external Syslog Server for message logging. What is the difference between messages displayed in Real-Time Log Viewer and Log Buffer?

Thank you in advance

[Marius Gunnerud]

There really is no difference other than what you configure it to be.  For example you could be logging debugging to the ASDM but to the buffer you might be logging informational or warning.

If you are logging debugging to ASDM and buffer then you will be able to view the same information in both realtime viewer and log buffer.  Biggest difference here is that in ASDM it is real time while in CLI you will need to issue show log each time to see new information.

--

Please remember to select a correct answer and rate helpful posts

[tanveer.baig1]

Thanks Marius.

What I find confusing are the two  settings i.e Buffer size and Queue size. If all system logs are going to one buffer, then one setting should be sufficient? What am I missing?

Tanveer

[Marius Gunnerud · Accepted solution]

Logging queue size and buffer size are two very different things.  The buffer size is the amount of space on the local flash that is allocated for storing log messages.  By default older messages will be overwritten once the buffer is full.

The queue size is for queuing logging bursts when sending to a syslog server.  If there are more logs than the ASA can handle it will queue them in the logging queue. If the logging queue fills up packets will be dropped (tail drop).

--

Please remember to select a correct answer and rate helpful posts