Retaining system logging message history after reboot

[Keith Rance]

Folks, for some reason I am unable to retain the system message logging and config archive references after a reboot of the router. I need to be able track config changes and retain the ability for the customer to recover the original config should they destroy the config through any misguided fiddling on their part. There is no remote management and these router need to be recoverable. I know this used to configured by default on earlier routers as I've checked on teh ones we have, but checking through the configuration has not helped and i have everything configured the same but system messages are still lost on reboot. Im using Cisco 3845 running IPbase 12.4(3) and the config i have is shown below.   anyone any ideas????

Logging buffered 4096 debugging

no logging console

!

!

Archive

Log config

  Logging enable

  Logging size 100

  Notify syslog

  Hidekeys

Path flash:archive-config

!

Logging history size 200

Logging facility local6

!

!

Many thanks

Keith

[Richard Burts]

Keith

If you are depending on logging buffered and show log to see a record of changes there is not a way to preserve the log messages over a reboot. The logging buffer is recreated (empty) at boot time. If you need to maintain the log messages over a reboot then you need to have a log server to which you send the log messages.

HTH

Rick

Sent from Cisco Technical Support iPhone App

[Keith Rance]

Hi Rick, yes happy with that, but i know that older routers used to retain the a system message history straight out the box, i assume by automatically writing the logging buffer to flash on each entry or periodically writting it out - effectivley using the flash as a local syslog storage. I am unaware that this feature has been removed from the IOS and indeed would be very surprised if it where.

My other issue is similar, in that having archived a config and proving it is avaialble by using the 'sh archive' command it is clearly displayed, yet after a reboot that reference is gone but the file is in flash. if i know reboot the router and check the 'sh archive' its gone. If i know archive another config it gives the same name as the previuos archive and just overwrites the old one and i've lost my rollback option. such a pain!

[Vishnu Vardhan S]

Hi Richard,

I faced same issue for my customer could you please help me how to check if my customer have log server or not. I have CPE access and PE access.

Any commands you suggest to verify this at CPE level.

[Julio E. Moisa]

Hi

Usually the logs are deleted once the device has been rebooted, try to apply the logger persistent:

http://www.cisco.com/c/en/us/td/docs/ios/12_2sr/12_2sra/feature/guide/srmgtint.html

Hope it is useful

:-)

[Joseph W. Doherty]

On an IOS platform, you might look for in config:

logging <IP Addr>

or in a show log output:

Logging to <IP Addr>

[Richard Burts]

There are at least two ways to understand this question " check if my customer have log server or not."

1) check if a log server is configured. This is quite possible. The easy way would be to use this command

show run | include log

then look in the output and see is a logging host is configured

Note that seeing if the logging host is configured is a first step. You would also probably want to verify that a host is at that IP address and is reachable from the IOS device.

2) see if the customer actually has a logging server. This would be more complicated and would require more access than CPE and PE access.

HTH

Rick

[gnijs]

I still don't know why Cisco doesn't have persistent logging to flash.

There is a flash in each switch/router. Why why can't it save the log there and why does it remove the log on boot ?

Everyone has experienced this problem: an Access switch looses its uplinks (and hence also connectivity to the log server). Only way to recover = hard boot. Not everyone has the possibility to first connect a console ! But what was the reason for the fiber disconnect ? Impossible to know. Often it was an err-disable on the fibers, but no way of knowing that after a reboot. So 1990 that this is still not solved in 2020 !

[mscott21]

could you explain how you answer contrasts with this documentation? Configure Persistent Logging on IOS Platforms 

example:

 Router(config)#logging buffer 20000000 debugging
 Router(config)#logging persistent url flash0:/MYDEBUGS size 104857600 filesize 5242880