In my experience, syslog is only needed for extended troubleshooting and not needed to typical day to day operations. If you decide to put in a syslog server, it should not be dedicated to the Aruba system, but it should be a central syslog server for all networking devices and shared.
Again, this is my opinion. Others might be able to weigh in..
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
Original Message:
Sent: Apr 27, 2021 09:51 AM
From: Patrick Gera
Subject: How to estimate Syslog capacity?
I agree about share resources from an existing server with a VM instance for syslog.
But how much resources I need to share with this Syslog VM?
If i know the proper number I can use client environment to acomplish this, but without no idea, maybe we´ll must buy a server for it, even not being the best option.
How much events can APs generate per second?
------------------------------
Patrick Gera
Original Message:
Sent: Apr 26, 2021 02:12 PM
From: Colin Joseph
Subject: How to estimate Syslog capacity?
There is none that I know of. Fortunately disk storage is not expensive. I would attempt to share another server instead of getting a new box specifically for syslog...
------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
Original Message:
Sent: Apr 26, 2021 01:10 PM
From: Patrick Gera
Subject: How to estimate Syslog capacity?
Yes it makes sense, but it remains with no answer for me.
Imagining the worst scenario where the client will apply all logs to be tracked and recorded in their wireless environment... how can I estimate the amount of resources required at syslog server side to be capable to handling and keep these logs there for at least 60 days?
Is there a formule to calculate this?
I dont know, We have 480 users, 81 APs, 2-3 endpoints per user, multiplied per how many logs setted, at which level = X amont of free data space plus Y processor plus W memory.
I need to buy an external syslog server to do that, but I dont want to super estimate and use 1% of everything and not to under estimate and dont have enough resouses to do the job.
Is there a official server recommendation from aruba side? A default specification?
------------------------------
Patrick Gera
Original Message:
Sent: Apr 26, 2021 12:53 PM
From: Colin Joseph
Subject: How to estimate Syslog capacity?
The short answer is: if you are concerned about logging storage, deploy an external syslog server.
The observed onboard storage capacity of logs is one kilobit of syslog messages for each category on a VMC (system, user, security, wireless, ARM and others). How many messages are generated is dependent on (1) how busy your controller is and (2) the level of logging you have enabled (warnings is default). The logs are rolled based on storage and not by date. That would mean that a busy category's logs would be rolled before a not-so-busy category or one where the logging was increased.
The majority of logs are not actionable, but if you had an issue, you would not want to wonder if pertinent logs have rolled or not.
I hope that makes sense.
------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
Original Message:
Sent: Apr 26, 2021 11:10 AM
From: Patrick Gera
Subject: How to estimate Syslog capacity?
Hello guys,
I have facing some difficulties to find information related to "logs", "Audit-Trail" and so on.
Im trying to find these above information for Aruba Central and Aruba Virtual Mobility Controller.
For Aruba Central, I have found (after read 300 documents) only one paragraph saying something about "audit-trails" that can save logs for 90 days.
For Aruba Virtual Mobility Controller, even looking ArubaOS files I cant find anything.
I have some doubts needing answers, I appreciate any help.
1- How to estimate the locally, the log capacity for the system before overwrite information?
2- How to estimate a external syslog capacity (Processor, Memory, Hard Drive Space) to maintein system logs events and user change events, Antennas Events, etc in its HD for at least 60 days?
I have a project for 81 APS 505, two VMC... and no answer regarding logs until now.
Thanks,
------------------------------
Patrick Gera
------------------------------