Wireless Access

 View Only
last person joined: yesterday 

Access network design for branch, remote, outdoor, and campus locations with HPE Aruba Networking access points and mobility controllers.
Expand all | Collapse all

How to estimate Syslog capacity?

This thread has been viewed 34 times
  • 1.  How to estimate Syslog capacity?

    Posted Apr 26, 2021 12:06 PM

    Hello guys,

    I have facing some difficulties to find information related to "logs", "Audit-Trail" and so on. 
    Im trying to find these above information for Aruba Central and Aruba Virtual Mobility Controller.
    For Aruba Central, I have found (after read 300 documents) only one paragraph saying something about "audit-trails" that can save logs for 90 days.
    For Aruba Virtual Mobility Controller, even looking ArubaOS files I cant find anything. 
    I have some doubts needing answers, I appreciate any help. 

    1- How to estimate the locally, the log capacity for the system before overwrite information?
    2- How to estimate a external syslog capacity (Processor, Memory, Hard Drive Space) to maintein system logs events and user change events, Antennas Events, etc in its HD  for at least 60 days?

    I have a project for 81 APS 505, two VMC... and no answer regarding logs until now.

    Thanks,



    ------------------------------
    Patrick Gera
    ------------------------------


  • 2.  RE: How to estimate Syslog capacity?

    EMPLOYEE
    Posted Apr 26, 2021 12:54 PM
    The short answer is: if you are concerned about logging storage, deploy an external syslog server.

    The observed onboard storage capacity of logs is one kilobit of syslog messages for each category on a VMC (system, user, security, wireless, ARM and others).  How many messages are generated is dependent on (1) how busy your controller is and (2) the level of logging you have enabled (warnings is default).  The logs are rolled based on storage and not by date.  That would mean that a busy category's logs would be rolled before a not-so-busy category or one where the logging was increased.

    The majority of logs are not actionable, but if you had an issue, you would not want to wonder if pertinent logs have rolled or not.

    I hope that makes sense.

    ------------------------------
    Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
    ------------------------------



  • 3.  RE: How to estimate Syslog capacity?

    Posted Apr 26, 2021 01:10 PM

    Yes it makes sense, but it remains with no answer for me.

    Imagining the worst scenario where the client will apply all logs to be tracked and recorded in their wireless environment... how can I estimate the amount of resources required at syslog server side to be capable to handling and keep these logs there for at least 60 days?

    Is there a formule to calculate this?

    I dont know, We have 480 users, 81 APs,  2-3 endpoints per user, multiplied per how many logs setted, at which level = X amont of free data space plus Y processor plus W memory.

    I need to buy an external syslog server to do that, but I dont want to super estimate and use 1% of everything and not to under estimate and dont have enough resouses to do the job.

    Is there a official server recommendation from aruba side? A default specification?

    ------------------------------
    Patrick Gera
    ------------------------------



  • 4.  RE: How to estimate Syslog capacity?

    EMPLOYEE
    Posted Apr 26, 2021 02:12 PM
    There is none that I know of.  Fortunately disk storage is not expensive.  I would attempt to share another server instead of getting a new box specifically for syslog...


    ------------------------------
    Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
    ------------------------------



  • 5.  RE: How to estimate Syslog capacity?

    Posted Apr 27, 2021 09:52 AM

    I agree about share resources from an existing server with a VM instance for syslog.

    But how much resources I need to share with this Syslog VM?

    If i know the proper number I can use client environment to acomplish this, but without no idea, maybe we´ll must buy a server for it, even not being the best option.

    How much events can APs generate per second?

    ------------------------------
    Patrick Gera
    ------------------------------



  • 6.  RE: How to estimate Syslog capacity?

    EMPLOYEE
    Posted Apr 27, 2021 04:09 PM
    In my experience, syslog is only needed for extended troubleshooting and not needed to typical day to day operations.  If you decide to put in a syslog server, it should not be dedicated to the Aruba system, but it should be a central syslog server for all networking devices and shared.

    Again, this is my opinion.  Others might be able to weigh in..

    ------------------------------
    Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
    ------------------------------



  • 7.  RE: How to estimate Syslog capacity?

    Posted Apr 27, 2021 09:00 PM

    Client wants to use it for audit purposes.

    This below link answer in part my question, but I dont know the APs EPS yet.

    I used 10, and 90 days.... but I believe I super estimate.

    https://www.buzzcircuit.com/tag/siem-storage-calculator/

    thx at all



    ------------------------------
    Patrick Gera
    ------------------------------