Configuration Guide Configuring Syslog
Run the logging filter rule exact-match module module-name mnemonic mnemonic-name level level command in global
configuration mode to configure the exact-match rule.
Run the logging filter rule single-match { level level | mnemonic mnemonic-name | module module-name } command in
global configuration mode to configure the single-match rule.
7.3.5 Featured Logging
The featured logging functions include level-based logging, delayed logging, and periodical logging. If the RFC5424 log
format is enabled, logs can be sent in all directions, delayed logging is enabled, and periodical logging is disabled by default.
If the RFC5424 log format is disabled, level-based logging, delayed logging, and periodical logging are disabled.
Working Principle
 Level-based Logging
You can use the level-based logging function to send syslogs to different destinations based on different module and severity
level. For example, you can configure commands to send WLAN module logs of Level 4 or lower to the log server, and
WLAN module logs of Level 5 or higher to local log files.
 Delayed Logging
After generated, logs are not directly sent to the log server, and instead they are buffered in the log file. The device sends the
log file to the syslog server through FTP at a certain interval. This function is called delayed logging.
If the device generates too many logs, sending all logs to the server in real time may deteriorate the performance of the
device and the syslog server, and increase the burden of the network. In this case, the delayed logging function can be used
to reduce the packet interaction.
By default, the log file sent to the remote server is named File size_Device IP address_Index.txt. If the prefix of the log file
name is modified, the log file sent to the remote server is named Configured file name prefix_File size_Device IP
address_Index.txt. The file stored on the local Flash of the device is named Configured file name prefix_Index.txt. By
default, the file name prefix is syslog_ftp_server, the delayed logging interval is 3600s (one hour), and the log file size is 128
KB.
The maximum value of the delayed logging interval is 65535s, that is, 18 hours. If you set the delayed logging interval to the
maximum value, the amount of logs generated in this period may exceed the file size (128 KB). To prevent loss of logs, logs
will be written into a new log file, and the index increases by 1. When the timer expires, all log files buffered in this period will
be sent to the FTP or TFTP server at a time.
The Flash on the device that is used to buffer the local log files is limited in size. A maximum of eight log files can be buffered
on the device. If the number of local log files exceeds eight before the timer expires, all log files that are generated earlier will
be sent to the FTP or TFTP server at a time.
 Periodical Logging
Logs about performance statistics are periodically sent. All periodical logging timers are managed by the syslog module.
When the timer expires, the syslog module calls the log processing function registered with each module to output the
To Next Page
Loading...
Need help?
General
