WLC Default Syslog Settings

[scot.bell1]

WLC 8510 running 8.0.121.0.

Currently I'm not capturing syslog to any external host, no IP address entered for a syslog server in Management => Logs => Config

Syslog level is set to ERRORS and Facility is "Local use 0"

WLC Config Analyzer 4.16 gives Best Practice message below:

20017,AP: Syslog messages are sent to broadcast address, if there are errors reported by many APs, and there are too many APs per vlan, this can cause broadcast storms. For best practices, it is better to configure to individual server.

How can I make sure the APs are not broadcasting the syslog messages ?   

[Rasika Nayanajith]

By using the below CLI command you can configure a syslog server IP for all your APs. This is the way to stop AP broadcasting syslog msgs

(WLC)> config ap syslog host global x.x.x.x

HTH

Rasika

*** Pls rate all useful responses ***

[scot.bell1]

Thank you Rasika,

My problem I don't have a Syslog server that can handle all the traffic from the APs.  

Are you suggesting setting an Address even if it is not a syslog server so at least the APs send to unicast on that address and stop broadcasting ?

[Rasika Nayanajith]

Yes, even if you put some dummy IP address AP will send syslog to that adress & your network will drop it.

HTH

Rasika

[Scott Fella]

Rasika is right... In all of my deployments, if there is no syslog server in the network, I have used a dummy IP address with the command Rasika mentions.

-Scott

*** Please rate helpful posts ***

[mohanak]

For VLANs with lots of APS, if there are broadcast traffic generating syslog alerts from the AP, as the APs will be generating syslog to a broadcast destination, this can generate a increase in the total broadcast traffic level on the VLAN. The syslog function is very useful for troubleshooting APs which have not joined controller, but for normal operation is better to have it pointing to a unicast server address.