We have 2 2901 routers which have BGP and IPsec running with customer devices. we have configured the following commands on the routers for them to send the syslogs to our syslog server.

no logging console

no logging monitor

logging 192.168.x.x

logging trap debugging

But we do not get more then 20 messages on the syslog server in an entire day. With these protocols running there has to be syslog messages for exchanges go between our devices and customer devices. In case of a BGP flap or Tunnel going down syslog messages are sent. Please share your thoughts on this issue. Thank you!

  • Did you enable logging to the buffer and compare what is in the buffer to what is on the syslog server?
    – Ron Maupin
    Feb 6 '18 at 20:07
  • Yes buffer is enabled. And Buffer has few messages like 11 as of this moment
    – jani
    Feb 6 '18 at 20:09
  • 1
    You may just not be generating many messages. What do you think should be logged that isn't being logged?
    – Ron Maupin
    Feb 6 '18 at 20:10
  • Does the message counter show anything missing? Feb 6 15:29:35 **88**: Feb 6 15:29:34.870: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer1:...
    – jonathanjo
    Feb 6 '18 at 20:21
  • @jani same as Ron on What is the logging you think is missing? Any logs you expect for granted that should have been triggered but did not do so?Do you have any point of reference? Repeated logs may end up been counted as one if repeat during x amount of time and bypassing a threshold. Unless more information is provided, this scenario seems harmless.
    – DRP
    Feb 6 '18 at 22:44

With these protocols running there has to be syslog messages for exchanges go between our devices and customer devices.

"logging trap debugging" 

This command means that every log message is allowed to be sent to syslog server. However to generate the debug logs in first place, you need to enable debugging itself with debug command

For example to enable KEEPALIVE packet logging for all bgp neighbors:

#debug ip bgp keepalives
  • Turning on debugging will greatly slow a router, and it should only be used for troubleshooting, then disabled. This is not something to leave on during normal production.
    – Ron Maupin
    Feb 6 '18 at 20:54
  • I think the order in which Ron inquired about the required syslogs is correct and then it is summarized well by pulsar12. We currently have a bunch of snmp traps configured on other devices which are sending logs to the server, so we had a impression that something was wrong with these routers. I appreciate your responses to my query, and admit my lack of awareness about the same. Thank you Ron & pulsar12
    – jani
    Feb 7 '18 at 0:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.