Extreme 3804 Supplementary Manual

Advanced System Diagnostics and Troubleshooting Guide

93

Syslog Servers

Log information is critical not only to troubleshoot a failed system, but also to identify contributing 
conditions that might lead to future failures. One major problem with internal switch logs is that only a 
limited amount of memory can be allocated for logs. After 1,000 messages, the log wraps and the first 
messages are lost. Normally, this is not an issue, but in case of failure, a failure might be recorded in the 
log, but lost because subsequent messages cause the earlier, true cause of the failure to be purged.

Another important fact to consider when designing for effective recovery is that network device logs 
might be lost after a catastrophic failure.

Syslog servers are an effective and inexpensive way to address both of the internal log capacity 
limitation and the risk of loss in a catastrophic failure. Syslog servers receive and store log messages 
from network devices. With the use of syslog servers, information remains intact after failure and no 
buffer threshold will be reached, allowing administrators or Extreme Networks TAC representatives to 
identify the triggering event in a failure. Syslog servers also offer the added advantage of integrated 
tools to store, sort, scan, and issue alerts on configured error conditions. This capability enables greater 
control of the networking environment, especially when planning for effective recovery.

enable syslog

disable syslog

configure syslog {add} <host name/ip> {: <udp-port>} [local0 ... local7] {<severity>}

configure syslog delete <host name/ip> {: <udp-port>} [local0 ... local7]

To enable logging to a remote syslog server, use this command:

enable syslog

To disable logging to all remote syslog server targets, use this command:

disable syslog