Investigating IOS logs for a Cisco 3750x switch/router.

[kecksysadmin]

I'd like to look at the IOS logs and noticed that the "show log" command only shows a few lines but it says that "console" and "buffers" messages have a 2K+ lines in it.  How do I see the "buffer" messages?  I'm assuming the console ones have scrolled on by?  but if not, I guess I'd like to see it as well, they have the same number of message lines, so I bet they are the same.

thanks!

jc

[Richard Burts]

jc

You use the command show log to see the content of the logging buffer, assuming that the buffer has not been cleared.

HTH

Rick

[Vinit Jain]

Adding to what Richard mentioned, by default buffer logging has a small buffer. If there are more logs than the buffer can store it will keep overriding the logs. You can increase the buffer logging size using "logging buffered 100000 debugging".

For console logging, you will have to connect a console cable to capture the logs. In production, its not really a good idea to keep the console logging enabled. It should be used for troubleshooting purposes. Also, if you are using console logging, keep the logging level for informational, not debugging.

Hope this helps.

Vinit

[kecksysadmin]

Thanks Richard and Vinit!  I guess that confirms what I was worried about, the logs are gone although the "buffer" and "console" message count says 5000+.  Mahalo!

[Richard Burts]

jc

As Vinit has explained the logging buffer is treated as a circular buffer. IOS writes messages into the buffer and when the buffer gets full then IOS overwrites the oldest message in the bufffer with the new message. There are several things that can clear the messages in the logging buffer: 1) a reboot will clear the buffer (but if it indicates 5000 messages then it is not a matter of a reboot). 2) configuring the buffer (changing the size of the buffer, changing the severity level of the buffer, disabling/enabling logging buffer) will clear the buffer 3) the clear log command will clear the buffer.

HTH

Rick