How not to lose LOG messages from the router

[jindrichneumann]

Hello,

it would be possible to recommend the best backup solution on the router log messages in case of failure uplink connectivity or reboot the router? In case of failure of connectivity and reboot the router would not want to lose log messages and at best is additionally send the syslog server for further processing. I know I can send log messages to as FLASH memory, but can also reverse router to send these messages to a Syslog server communication has been reestablished?

[John Blakley]

You can send logs to the syslog server at the same time of logging in memory. Does that help?

HTH,
John

*** Please rate all useful posts ***

[jindrichneumann]

Ok, what if I have a router unavailable for some time as I can arrange to re-logs sent to syslog server. It helps me syslog over TCP?

[Richard Burts]

I do not believe that syslog over TCP would help. Using TCP will use a reliable transport and if the first attempt to send is not successful then the router would retry. But there is a limit to the number of retries and then the router will drop the syslog packet. What you are looking for would be something that would store log packets until connectivity is restored. I believe that it would be possible to write something using EEM that would satisfy your requirements. I would think that EEM could use IP SLA to track reachability of the syslog server and during periods when it was not reachable could write syslog records to a file in flash and when connectivity was restored could transmit the records.

HTH

Rick

[John Blakley]

Maybe this link will help:

http://www.cisco.com/en/US/docs/ios/12_0s/feature/guide/cs_sysls.html

HTH,
John

*** Please rate all useful posts ***

[John Blakley]

And what Rick states would work as well. You would need two scripts from what I figure though: 1 to start writing logs to flash when syslog stops responding, and then another script to copy that file somewhere for later merging/analysis.

HTH,
John

*** Please rate all useful posts ***

[Richard Burts]

John

I agree that 2 scripts would probably be needed.

The link that you provided for writing syslog to flash is an interesting alternative and certainly would provide a solution to the issue of router reboot since the recent log messages would be in flash after a reboot. I notice that what they show as the way to copy syslog from flash to an external receiver is using a manual entered command. I would think that some way to automate that would be very helpful to provide a complete solution to the requirements of the original poster.

HTH

Rick

[jindrichneumann]

Thanks so much to everyone

I think my requirements are correctly understood. Unfortunately scripting in Cisco understand, but if anyone knows the solution I will be very happy. Once again, if the disintegration of the line then move the logs somewhere (eg flash) and at a later reconnect to send everything to the syslog server. The same in case of rebooting the box. Thanks a lot.