logging history

[milan.kulik]

Could anybody explain the sense of "set logging history" CatOS command?

The command reference guide says:

"The Catalyst 4000 family switch holds syslog messages until the number of messages equals the defined size of the history log, once the defined size is met the messages are sent."

But Cisco Field Manual: Catalyst Switch Configuration says:

"Messages sent as traps to an SNMP management station can be lost. Therefore, messages that are less than or equal to the specified severity level can also be saved to a history table for future review."

So I'm confused:

Are the messages hold in history table syslog messages or traps?

Are they sent to management station and copied to the history table or are they hold in the history table and then sent to the management station?

Thanks,

Milan

[ecao]

Hi Milan,

The "set logging history" determines how many lines the switch will save in its buffer before sending them off to the syslog server, such as your Ciscoworks2000 or a UNIX syslog server. It has nothing to do with SNMP traps.

However, syslog messages can be forwarded as traps if you configure the following on the switch:

set snmp trap enable syslog

And yes, once the trap is sent out, it is considered lost because traps are UDP based (best effort). The switch has no way to tell if the trap receiver can get it or not.

Hope this helps.

--Eugene

[milan.kulik]

OK,

I understand that buffering syslog messages can be an advantage in a case of such an event when the syslog server is unaccessable.

An example: I set logging history 50, then all trunks from my switch to the core fail. The syslog messages are buffered on the switch and after connectivity to the core is repaired the buffer of 50 last messages is sent to the syslog server.

Nice. But it means that in the case of no problem looking to my syslog server I'm 50 messages late (up to last 49 messages are buffered on the switch instead of being sent to the syslog server).

Is my understanding correct?

If I want any syslog message to be immediately sent to the syslog server shall I set logging history to 1 or 0?

Another question:

If I set logging severity to 4 and logging server severity to 6 are level 5 and 6 messages sent to the syslog server? (My understanding is: no. What's the sense of "set logging server severity" command then?)

Thanks and regards,

Milan