SYSLOG VS Logging Buffer

[jreed]

Can I have the data logged to syslog be level 6, but the data stored on the switch be level 4 or 5?

I'm managing several IOS and a bunch of CATOS switches. We're using Ciscworks and have the logging level set to severity 6 for everything, so Ciscoworks can analyze the data. The problem is the Logging Buffer on the switch goes about a day or so before it starts to wrap. If we want to do some quick analysis of something that happened a few days ago, the data has be overwritten. We see all the ports going up and down every day as people startup or shutdown. We see each VLAN going through STP phases and its just a bunch of cluter. Any suggestions on how to reduce the amount of data stored on the switch but still keeping a high level sent to syslog would be appreciated!

Thanks!!

Jeff

[a.awan]

Yes you can have different levels of logging for syslog servers and for local buffer logging. When you configure buffer logging you can define what severity level messages you want logged:

logging buffer

Additionally for your syslog server logging you can define the level of logging using:

logging trap

The sixe of the buffer can also be increased to accomodate more messages. The default buffer size varies by device type i think but can be altered using:

Logging buffered <

[jreed]

A.Awan thanks for the reply ...Looks like that works for IOS, but on the CATOS side w/7.6(6), I don't see the same extentions to the set logging command. I can set the buffer size, but not the severity. I can set the logging level all , but that's what I have now and its sent to both the buffer and syslog at the same level.

Am I missing somrthing? Thanks again for the help!

[glen.grant]

Think you are missing something, in catos you can set each individual parameter as seen below . Maybe I misunderstand you , but each one is customizeable to whatever level you want it to log , it does not have to be all the same . You can also have a different level be sent to the syslog server by using the set logging server severity command .

This is just a partial list . You should be able to see these in your config , if not you are probably using the "show config" command instead of the show config all command .

set logging server enable

set logging level cdp 4 default

set logging level mcast 2 default

set logging level dtp 5 default

set logging level dvlan 2 default

set logging level earl 2 default

set logging level ip 3 default

set logging level pruning 2 default

set logging level snmp 2 default

set logging level spantree 2 default

set logging level sys 5 default

set logging level tac 2 default