Syslog Server Disk Space with ASA5510

[Infrastructure Group]

Hi,

i'm about to configure a syslog server to receive syslog messages from a Cisco ASA5510 and being it a one week test I was wondering how much space should I allocate on the machine hosting the tool (kiwi syslog).

I see that the ASA fills the internal syslog buffer to 4MB and then it overrides it. How many messages would those 4MB be?

Thanks for your help.

[mirober2]

Hello,

I copied 30 messages off my firewall into a text file and it's a little over 3 KB in size (which averages out to about 100 bytes per message). That means that 4 MB would be about 40,000 messages. As a side note, the ASA's maximum local buffer size is about 1 MB, rather than 4 MB.

How much disk space you should allocate for log storage will depend greatly on what level of syslogging you're doing, how much traffic the firewall sees, and how long you want to keep the logs for. Hopefully the above numbers will give you a rough idea of a baseline that you can expand on to meet your requirements.

Hope that helps.

-Mike

[Collin Clark]

We had to log at the debug level for security purposes and a 5510 running at about 40% would create a daily log file of about 4GB.