06-05-2013 06:00 AM
Hi there. I'm just wondering what the references to "aggregated" means when i run a sh logging command.
For example, here's some of the results I get back:
03-Jun-2013 18:11:35 :%SNTP-D-NTPBADVER: NTP server version not compatible, aggregated (9)
03-Jun-2013 18:07:01 :%SNTP-D-NTPBADVER: NTP server version not compatible
I've checked the admin guide and it says the following:
Syslog Aggregation—Select to enable the aggregation of SYSLOG
messages and traps. If enabled, identical and contiguous SYSLOG
messages and traps are aggregated over an interval of time and sent in a
single message. The aggregated messages are sent in the order of their
arrival. Each message states the number of times it has been aggregated.
For network newbies like me, does this basically mean that various SYSLOG messages are combined together and returned as one entry?
If this is correct, is it fair to say that have this setting turned on means that the logs will take longer to return? What does the value (9) refer to?
Also someone mentioned that aggregation only applies to remote logging but the section on syslog aggregation in the manual appears not in the Remote Logging but the "setting system log settings" section...
Here's why I'm asking all these questions. I'm trying to determine why the switch takes so long to respond to certain commands. And if we have unnecessary settings turned on, I'd like to turn them off. But I'm not a network person so I'm not very conversant on what's what.
Thank you.
06-05-2013 02:11 PM
wild ass guess here, but i think the aggregated (9) refers to the same message being duplicated 9 times, and only the one message was written to logs, in order to save space.
06-10-2013 01:01 PM
Is this calculated dynamically? Meaning, each time i run the show log command, is this data recalculated?
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide