Logging Best Practice - NVRAM vs Syslog

[RobertWilkinson]

Hi Community,

A topic that i think will generate alot of discussion.

What level of logging to implement at the core, dist and edge and does it differ for NVRAM vs a Syslog server?

[RobertWilkinson]

Thanks Oscar.

Any recommendations on logging severity on each log type (NVRAM, Memory, Console Syslog)?

[Gabriel_G]

The defaults are fine.
Console -> Default Disabled -> Down to Severity Info
Memory-Buffer -> Default Enabled (show log) -> Down to Severity Debug-Data (Assuming log debug-mode is enabled)
NVRAM -> Default Enabled (show log messages nvram) -> Down to Severity Warning
Syslog -> Default Disabled -> Down to Severity Debug-Data (Assuming log debug-mode is enabled)


Notes:
-Debug logs only show when a debug log event has been added to the relevant log filter (not done by default), log debug-mode has been enabled (not done by default), and the log target is configured for debug level severities (done by default for memory-buffer and syslog). This is usually only needed for advanced troubleshooting. Optionally omit debug logs being sent to syslog by limiting the severity to 'info' in the 'configure log target syslog' command.
-You can increase the size of the memory-buffer up to 20000 messages with minimal impact on RAM usage:
configure log target memory-buffer number-of-messages 20000

Hope that helps!