Command how to get log specific date

[samudro94]

Hello All,

I use Cisco 4506E with VSs, is there a command to get logs based on date, for example I want to get logs for the last week

Thank You

[acampbell]

Hi,

This will all depend on the size of your logging buffer but you could try something like this to start from the day you want

sh logg | be Dec 23

Hope this helps

[balaji.bandi]

below example :

#show logging | begin Dec 29
Dec 29 11:43:39.902 GMT: %PIM-SW2-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Dec 29 11:44:39.903 GMT: %PIM-SW2-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

if you do not have long buffer the logs overwrite always - better to use syslog server if you looking more archieved logs.

[Ruben Cocheno]

@samudro94 

Check the clock to confirm that NTP is synced before you look at logs.

An example of Including logs since 28

show logging | begin "Dec 28"

An example of Including logs since 28 Dec but excluding day 29

show logging | begin "Dec 28" | ex "Dec 29"

[MHM Cisco World]

last week internal Log I dont think the buffer keep this old log. 
show loggin 
check the log message store in buffer 
MHM

[pieterh]

I agree a syslog server is the most versatile solution,
but if you do not have one, you can check if the 4506E understands persistent logging like this
     Router(config)#logging buffer 20000000 debugging
     Router(config)#logging persistent url flash0:/MYDEBUGS size 104857600 filesize 5242880
Above command creates a directory called MYDEBUGS on the router's disk 0 and allocates 104857600 bytes (100MB) disk space for log messages and specifies an individual file size of 5MB.

of course you need to tune the size of the allocated space to the free space on the flash 
leave enough free space to perform image upgrades etc.
you can more easily filter files on date created/modified to select the last week than on timestamp in the log 

[MHM Cisco World]

Friend sure you are right' but buffer as much as it large if you have any issue in your network that full this buffer with log then sure there are some log you will missing see it.

With syslog the storage size is much much big than buffer.

MHM

[pieterh]

I do not agree, if you have an issue in the network, then your syslog message may not arrive at the syslog server at all!

I have found this persistent logging useful on a VPN router over 4G,
where  I can see what the routers log reports after the 4G connection has been interrupted and restored again

[MHM Cisco World]

Issue in network make SW generate log not network issue with syslog.

MHM