You are on page 1of 1

I don't think I need this; I debug to a syslog server.

In my experience, 80% of the time I receive debugs from a syslog server, they co
ntain dropped messages and render an accurate analysis impossible; one can obser
ve this behavior when sequence numbers are enabled on the IOS side. This is bec
ause syslog is UDP by default, and the messages usually end up being rate-limite
d heavily. There are ways to debug to the syslog more reliably (use TCP for sys
log, or Reliable Delivery and Filtering via BEEP) but those concepts are outside
the scope of this document.
Why can't I just log to the monitor with 'terminal monitor'?
We want to debug to the log to prevent any debug messages which are sent in burs
ts from being dropped. For example, an H.245 debug may have 40-50 lines of debu
gs all arriving at the same millisecond, and is usually too fast for the monitor
to print out and large chuncks of the debug output will end up missing from the
screen output. By logging to the buffer, we eliminate scenarios where the term
inal monitor would have dropped messges.
Recommended Configuration:
Router(config)#
Router(config)#
Router(config)#
Router(config)#
Router(config)#

service sequence-numbers
service timestamps debug datetime localtime msec
logging buffered 10000000 debug
no logging console
no logging monitor

Router(config)# default logging rate-limit


Router(config)# default logging queue-limit
Router(config)# voice iec syslog
<Enable debugs, then wait for issue to occur.>
...
<Enable session capture to txt file in terminal program.>
Router# terminal length 0
Router# show logging

You might also like