Syslog of standby unit

Question

Trying to figure out why i'm not seeing syslog messages coming from my standby unit of an active/passive pair of 4700 ACE Appliances.
ACE-4710-K9
Version A3(2.4)
I have syslog configured
failover is functioning
i see log messages sent (UDP514) to the syslog server from the primary
Standby logging is enabled.
However, i see no log messages being generated to the syslog.
Am I missing something in this scenario?
Thanks.
Bruce

Answer 1

Hi Bruce,
Did you try clear logging? If not, i would suggest to do the same.
Please do "show logging statistics" in affected contexts and see if the counters like "host" are increasing. Also, please do "show logging queue" and see the below counter's value:
switch/Admin# show logging queue
        Logging Queue length limit : 80 msg(s), 8 msg(s) discarded.
        Current 0 msg on queue, 5 msgs most on queue
By default, logging queue would be 80. If you see it is 0 please increase it.
Also, do "show resource usage" in affected and look at the counter's highlighted below:
switch/Admin# show resource usage
                                                     Allocation
        Resource         Current       Peak        Min        Max       Denied
Context: Admin
  conc-connections              0         42        100    8000000          0
  mgmt-connections              4       1630        100     100000          0
  proxy-connections             0         42          0    1048572          0
  xlates                        0          0          0    1048572          0
  bandwidth                   616     338973    2500000  625000016          0
    throughput                  0     207796    1250000  500000016          0
    mgmt-traffic rate         616     131177    1250000  125000000          0
  connection rate               0        706        100     600000          0
  ssl-connections rate          0          0          0      30000          0
  mac-miss rate                 0          1          0       2000          0
  inspect-conn rate             0          0          0     240000          0
  http-comp rate                0          0          0  786432000          0
  to-cp-ipcp rate               0        534          0       5000          0
  acl-memory                95136      97096          0   99579792          0
  sticky                        2          2          0    4194304          0
  regexp                        0          0          0    1048576          0
  syslog buffer                 0      29696          0    4194304          0
  syslog rate                   0          6          0     100000          0
If you see the last counter on right increasing then there is a resource problem. Also, do "show resource allocation" and see if you have any minimum resource guaranteed or not. Generally, if you don't any number in right-most column, you don't need to worry about resource crunch. But it is a good practice to have some minimum guaranteed to each context.
Coming to your question of sending logs from specific interface, i don't see any way of doing it. i guess it will send logs from the interface through which the syslog server is reachable. But you can always make the ACE to define the interface or hostname as a device-id to be included in the log messages it will send, even though the actual interface through which the log sent is different.
Regards,
Kanwal