Hello. is there a way to get 24 logs on a cisco switch port?

[hamsini0992]

Is there a way to get 24 hour logs on a switch port?. I had been doing something like sh log | i month date. I need a way to checking 24 hours logs every day. 

[Leo Laohoo]

Syslog

[hamsini0992]

Thank you for your reply. Is there any other way to get the logs through a command in cisco? 

[Leo Laohoo]

---

@hamsini0992 wrote:

Thank you for your reply. Is there any other way to get the logs through a command in cisco? 

---

Default log buffer is only 4096.  Increase that value to, say, 409600.

[hamsini0992]

Thank you for your reply. Can I try anything like sh log i <interface_name | i May 13 | i May 14. Will this give me logs of two dates? 

[Kasun Bandara]

@hamsini0992 

check below post.

https://superuser.com/questions/995051/cisco-show-logging-command-filtered-by-specific-date

[Leo Laohoo]

---

@hamsini0992 wrote:

Thank you for your reply. Can I try anything like sh log i <interface_name | i May 13 | i May 14. Will this give me logs of two dates? 

---

How many ports are you trying to "target"?
If there is only one port, I have a very simple idea:  Disable interface port logging except for the one target port.

[hamsini0992]

Thank you for the response. I am trying to look for specific patterns in an interface. I want to track this down status over a  period of 24 hours without any syslogs. If I do only May 13, it will fetch me the result only for May 13. But I want to look for pattern for the last 24 hours. 

eg., sh log | count May 13.*"***DOWN*** <interface_name>

Is there any way, I could give from and to dates

eg, sh log | count May 13.*"***DOWN*** <interface_name> ..(May 14) - Like between May 13 and May 14

I tried doing something like 

sh log | count May 13.*"***DOWN*** <interface_name> | count May 14.*"***DOWN*** <interface_name> . But this gave me 0 matches. 

[Leo Laohoo]

How many ports?

[hamsini0992]

Per switch one interface. There are more than 2000 switches 

[Leo Laohoo]

One port only? 

Disable link logging to every ports except this one.  

[balaji.bandi]

If you have more than 2000 switches, I suggest having SYSLOG Server and Role over the Syslog every 24 hours for each device, From all devices send interface activity logs to the Syslog server.  Write a small script (your own comfort programming, I prefer Python here) . grep all the Logs, (if the interface number matches in the Log, extract the Logs stored in a database or CSV format. you can extract reports based on the data collected in due course of time.