Logging buffer size

[Andy White]

Hello,

We have a few switches that only show a small amount of info when I run the command 'show logging' maybe only 50 lines, I would like to keep a few days worth, do I need to change the buffer size at the moment it is 4096 bytes?

I am aleady sending the logs to a syslog server, but I had a switch lose network connectivity and the local log info was to small.

Thanks

[glen.grant · Accepted solution]

  just increase the logg buffer size.  You should be able to increase it by a factor of 10 safely .  The default is 4096 , just increase by a factor of ten and that should give you a good size logg .

[Andy White]

I will increase it by 10% then to 4505 (unless you mean multiply).  Is this taken from the memory in the 'sh version'

cisco WS-C3560-24TS (PowerPC405) processor (revision E0) with 131072K bytes of memory.

[Sandeep Choudhary]

Hi,,

Log messages to an internal buffer on the switch  or on a standalone switch or, in the case of a switch stack, on the  stack master. The range is 4096 to 2147483647 bytes. The default buffer  size is 4096 bytes.

Note

Do not make the buffer size too large because the switch could run out of memory for other tasks. Use the show memory privileged EXEC command to view the free processor memory on the  switch. However, this value is the maximum available, and the buffer  size should  not be set to this amount.

Example: logging buffered 10000 debugging

- The "logging buffered" argument will log messages to internal buffer

- The "debugging" argument will log messages up to Level 7 (debugging)

-  The "buffer-size" argument is the size of the buffer from 4096 to  4,294,967,295 bytes. The default size varies by platform. Most commonly  use is 10000 or 16384

Regards

[Andy White]

Hi,

So the free mem is 55339228?

Sh version is:

cisco WS-C3560-24TS (PowerPC405) processor (revision E0) with 131072K bytes of memory.

sh memory

                    Head        Total(b)        Used(b)      Free(b)        Lowest(b)      Largest(b)

Processor    4057D08    75379192    20039964    55339228    41845416      16768896

      I/O        6800000     8388608      3578600     4810008      4761856        4808672

Driver te       2E00000    1048576      44              1048532     1048532         1048532

[Sandeep Choudhary]

HI Andy,

Andy White wrote:
cisco WS-C3560-24TS (PowerPC405) processor (revision E0) with 131072K bytes of memory.
sh memory
                    Head        Total(b)        Used(b)      Free(b)        Lowest(b)      Largest(b)
Processor    4057D08    75379192    20039964    55339228    41845416      16768896
      I/O        6800000     8388608      3578600     4810008      4761856        4808672
Driver te       2E00000    1048576      44              1048532     1048532         1048532

so this suggest that you can not set more then this size as buffer.

You can use:

logging buffered 1024000 debugging.  It is more than adequated in most situations.

Do not make the buffer size too large because the switch could run out of memory for other tasks.

Hope it helps.

Regards

Please rate it if you got your answer.

[Joseph W. Doherty]

Disclaimer

The  Author of this posting offers the information contained within this  posting without consideration and with the reader's understanding that  there's no implied or expressed suitability or fitness for any purpose.  Information provided is for informational purposes only and should not  be construed as rendering professional advice of any kind. Usage of this  posting's information is solely at reader's own risk.

Liability Disclaimer

In  no event shall Author be liable for any damages whatsoever (including,  without limitation, damages for loss of use, data or profit) arising out  of the use or inability to use the posting's information even if Author  has been advised of the possibility of such damage.

Posting

So the free mem is 55339228?
Sh version is:
cisco WS-C3560-24TS (PowerPC405) processor (revision E0) with 131072K bytes of memory.
sh memory
                    Head        Total(b)        Used(b)      Free(b)        Lowest(b)      Largest(b)
Processor    4057D08    75379192    20039964    55339228    41845416      16768896
      I/O        6800000     8388608      3578600     4810008      4761856        4808672
Driver te       2E00000    1048576      44              1048532     1048532         1048532

Yes, but the largest free block is 16768896.

PS:

And to an earlier question, the recommendation was 10x the default, not default plus 10%.

Typically on newer platforms 100K, or less, internal syslogs don't risk taking too much memory from the device.

[Andy White]

So is the largest block the one to look our for?  So we can't exceased that block size?

I will increase to 40960 and see how it goes, what method would use use to see if the increase was causing an issue?

[Joseph W. Doherty]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

So is the largest block the one to look our for?  So we can't exceased that block size?

I don't believe syslog is restricted to using a continuous free block.  However, (many/all?) Cisco devices don't perform memory compression, so it's possible to run out of sufficiently large free space while still having free space.  Some IOS features will fail when this happens, so that's another reason to not have an excessively large memory allocation for the syslog.

40K should be fine.  The 4K default, I believe, goes way, way back (i.e. when network devices had much, much less memory).

[glen.grant]

  I agree with Joe.  multiply by 10 .  If you make it a million like a suggestion, the logg buffer will be huge and will take you forever to run thru looking for things. A million byte logfile can have literally mutliple years worth of info. Have seen this on 3750's with that much allocated. You don't have to worry about a 40960 byte logfile.

[Andy White]

I was thinking of using 'logging buffered 40960 debugging' or is notification better to not stress the CPU?

[Richard Burts]

Writing to memory is a pretty low impact activity. Be much more concerned about the impact of writing to the console which is higher impact. Writing to the monitor is less impact than console and somewhat more than writing to memory.

HTH

Rick

[raghavendra.kulkarni]

Is the buffer size in bits or bytes?

[Richard Burts]

The buffer size is in bytes. You can verify this if you want using the command show logging and then look for the line that shows the size of the logging buffer. On one switch this is the output that I get

Log Buffer (65535 bytes):

HTH

Rick