Information Loss on logging

[paulo.prista]

Dear friends,

We are using an external router (Cisco 1751) with the IOS Firewall.

As logging facility, we use a central sever which receives log from ACLs, Inspect Lists and IDS module configured in this router.

Frequently we can observe a message with this text above:

"access-list logging rate-limited or missed 6 packets" . Of course, the number of packet changes from message to message.

We have increased rate-limited up to 10000 (maximum allowed) but these messsages continue.

Is it normal?

Is there something we can do to avoid this loss of information?

Regards,

Paulo R.Prista

[yusuff]

10000 is the max, remember this threshhold is for messages per second limit, and if you are still getting the "access-list logging rate-limited" then it is not good. You might want to remove 'log' keyword from some of the permit ACL lines and leave it on deny statements only.

HTH

R/Yusuf

[paulo.prista]

This sounds good.

As we are in a test phase we did put a lot of logs.

At the end of this phase unnecessary logs will be removed.

Thanks, Paulo R. Prista