cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1404
Views
0
Helpful
2
Replies

understanding sf300's logs

juleedev
Level 1
Level 1

Hi there. I'm just wondering what the references to "aggregated" means when i run a sh logging command.

For example, here's some of the results I get back:

03-Jun-2013 18:11:35 :%SNTP-D-NTPBADVER: NTP server version not compatible, aggregated (9)

03-Jun-2013 18:07:01 :%SNTP-D-NTPBADVER: NTP server version not compatible

I've checked the admin guide and it says the following:

Syslog Aggregation—Select to enable the aggregation of SYSLOG

messages and traps. If enabled, identical and contiguous SYSLOG

messages and traps are aggregated over an interval of time and sent in a

single message. The aggregated messages are sent in the order of their

arrival. Each message states the number of times it has been aggregated.

For network newbies like me, does this basically mean that various SYSLOG messages are combined together and returned as one entry?

If this is correct, is it fair to say that have this setting turned on means that the logs will take longer to return?  What does the value (9) refer to?

Also someone mentioned that aggregation only applies to remote logging but the section on syslog aggregation in the manual appears not in the Remote Logging but the "setting system log settings" section...

Here's why I'm asking all these questions.  I'm trying to determine why the switch takes so long to respond to certain commands.  And if we have unnecessary settings turned on, I'd like to turn them off.  But I'm not a network person so I'm not very conversant on what's what.

Thank you.

2 Replies 2

Brendan Kearney
Level 1
Level 1

wild ass guess here, but i think the aggregated (9) refers to the same message being duplicated 9 times, and only the one message was written to logs, in order to save space.

Is this calculated dynamically?  Meaning, each time i run the show log command, is this data recalculated?