Cisco switch logging buffer size

[jdesaul]

Hi,

I'd like to know approximately how many days of logs can be kept within the logging buffer on a Cisco switch. For example, if the switch has 16 GB of memory, and I configure the following command:

logging buffered  3000000000  6

This will ensure that the logs with severity-levels 0, 1, 2, 3, 4, 5 and 6 are stored in the memory buffer, which has a maximum size of 3 Gigabytes. 

I'm wondering how long will it take before the logging buffer is overwritten; 3 days, 3 weeks, 3 months (roughly)? I know that it really varies based on how many logging events occur but I'm just looking for a rough guideline.

This will indicate the log retention timeline that is applicable to the device's log buffer.

Thanks,

jdesaul

[Francesco Molino · Accepted solution]

Hi

Honestly it's hard to say how many days because it depends on how many logs you're receiving. However with 3G it could be somewhere to 3 months I would say.

My point is just to avoid doing large buffer size because the router can go out of memory.

You have several choices to keep log histories by using a syslog server. You can have free linux machine working as syslog server. If you don't have the possibility to have a server, you have use the command logging persistent to backup all log in the buffer to a file stored in your device flash.
Here a Cisco doc if you're interested: https://www.cisco.com/c/en/us/support/docs/voice/telephony-signaling/212102-Configure-Persistent-Logging-on-Cisco-IO.html