ASA log viewer
mysidia at gmail.com
Sun Nov 20 16:33:52 CST 2011
On Sun, Nov 20, 2011 at 6:42 AM, Joe Happe <Joe.Happe at archlearning.com> wrote:
>udp for syslog the ASA won't be in this mode, and you won't block traffic if syslog fails. With that said, there may be a command I'm unaware of that allows a tcp syslog to fail and not block traffic.
However, if you don't need to refuse connections when TCP syslog
fails, then you don't need 100% of your syslog messages, you should
use UDP syslog for performance.
TCP just makes sure you will get all syslog messages between time A
and time B or none of them.
If there are WAN issues, there are many cases where one would prefer
SOME syslog messages, with an understanding that the network
bottleneck means messages are being lost, rather than few/no syslog
messages to help debug the issue
More information about the NANOG