Syslog internal buffer overflow

[spacemeb]

Hello,

Another error that we observed when we executed the displayalerts command.

Multiple syslog servers which are used for the log subscriptions experience the "syslog internal buffer overflow"

Is there any way to deal with it? I saw some bugs that are related to this behavior but there was no workaround/fix.

Thanks a lot!

[balaji.bandi]

what device and what code running, as you mentioned there is bugs, then suggest to raise an TAC case to investigate for you.

or uplift to any latest version of code to see if that fix the issue.

[fw_mon]

Hello @spacemeb 

I saw these alerts if the dest syslog server wasn't reachable. It is not about "buffer overflow" in a software context, i.e. it is not a bug. I believe it is about a syslog sending queue - an internal syslog buffer that store unsent message if the dest server isn't reachable and this buffer get full (overflown) if WSA cannot send events for some time. Another case will be if WSA sending events at very high rate that cannot be handled by receiver.

[amojarra]

check this Defect Please :

CSCvn77673 : Bug Search Tool (cisco.com)

mostly this happens when the syslog server is not responding correctly 

sometimes the syslog server is too busy, sometime the connectivity had some issue, sometimes the amount of logs which you are pushing to syslog server is too much, and you might need to reduce or distribute the logs. 

it is better to check the resource utilization of the syslog server as well