Documentation for syslog logging persistent

[pingduck]

I want to write syslogs to flash. But The only document I found online is:

https://www.cisco.com/c/en/us/support/docs/voice/telephony-signaling/212102-Configure-Persistent-Logging-on-Cisco-IO.html

Which doesn't say much about what options are available and what it does.

(config)#logging persistent ?

  batch      Set batch size for writing to persistent storage

  filesize   Set size of individual log files

  immediate  Write log entry to storage immediately (no buffering).

  notify     Notify when show logging [persistent] is activated.

  protected  Eliminates manipulation on logging-persistent files.

  size       Set disk space for writing log messages

  threshold  Set threshold for logging persistent

  url        URL to store logging messages

  <cr>

Specifically, I am not sure what batch and threshold are used. Also, if I reload, the unwritten logs in buffer are gone. Is there a way to flush the logs manually?

[Giuseppe Larosa]

Hello @pingduck ,

the document provides examples and explanations of almost all parameters.

The most important is threshold that establish the disk quota you can use for log files

When exceeding quota the oldest log file will be deleted to leave space to the newest log file.

The network device flash disk is not intended for this kind of use.

It would be better to have an external syslog server  to a server that may be co-located if you have concerns about connectiivty to a branch site (i.e. you know this branch site connectivity is not stable).

If you have ever examined a show tech of a Cisco device you will see that messages are written to the local buffer and sent to external syslog before going down unless a power outage happens and there is no UPS protection.

Be also aware that the document refers to IOS, the current network devices run IOS XE or NX-OS or IOS XR.

Hope to help

Giuseppe

[pingduck]

I have to disagree with you that the document is comprehensive. Parameters like "protected", "immediate", "notify", "alert", even "batch" aren't explained at all. That is more than 2/3 of the available parameters. Not to mention this is the only document I found. I can't even find the logging persistent command in CLI reference!

The "size" and "threshold" parameters are also not clear. Through other means I figured out threshold is a percentage. But what does the "threshold" applies to? Is it to the buffer in RAM? Or threshold of total size? Or threshold to batch size? The document says:

"When the allocation threshold is exceeded, the oldest log file in the directory is deleted to make room for new system logging messages"

I don't think that refers the threshold parameter. As it just have to remove 1 oldest log when the limit is reached.

I am using it on a Classic IOS router. But the same CLI is available on IOS-XE as well.

[mario.jost]

So i stumbled on this old topic and basically had the same issue as pingduck. This command is documented horribly. Worse even, that certain commands have vanished in IOS-XE. I did some testing and will contribute my part to a customer-based-documentation-in-form-of-a-community-entry.

protected - This will lock the log file so you cannot access it from the CLI (cannot copy or do a "more" command to read content) IOS will give you following error:

%Error opening bootflash:bufferlogs/log_20250508-152821 (No such file or directory)

immediate - This will write every single log line to your buffer (RAM) and into the log file in the flash at the same time. This results in alot of write access on the flash, therefore wearing down its lifetime. But this command ensures that the last log entries are on the flash in case of a power outage.

batch - This command is important if you do not want to use the immediate keyword. Default here is 4096bytes. You can verify this value by issuing "show logging" and check:

roTST11#show logging | include Persistent
Persistent logging: enabled, url bootflash:/bufferlogs, disk space 10485760 bytes, file size 1048576 bytes, batch size 4096 bytes

So what this means is, that every 4096bytes written into the logging buffer in the RAM, it will take the logs and add them to the log file in the flash. Then, it waits for another 4096bytes fo logs in the RAM, and add all these buffered lines to the flash stored log file again. This results into far fewer read/write access to the file in the flash and therefore increases its lifetime (compared to immediate).

In a common encoding like ASCII or UTF-8 for basic English characters, each character typically takes up 1 byte of storage. So you can think of like, if you loose power to your device, you could loose a maximum of 4096 characters from the flash stored log. You can adjust this value to any higher value up until 2GB if you wish to do so. 4096 is already the smallest amount.

4096bytes correspond to around 35-40 lines of typical logging entries. This depends on the type of logs so you may have to your own evaluation on how many logging lines this translates to in your own environment.

alert - This command is gone on IOS-XE therfore i wont go into further detail about this one

notify - didnt have the time to look into this further, maybe someone else can chip in and explain this.