Logs and Retention Policies

Log Retention Policies

The log retention policy specifies the retention and purge behavior of logs. The policy specifies the maximum history record count and the number of records to purge with a purge interval. Records are periodically purged to contain log growth. When the purge timer triggers, a number of records equal to the Purge Window Size are deleted if the number of records in the log is greater than the Maximum Size.

You can configure the following settings:

  • Maximum Size—The maximum number of records to be maintained in the log. The range is 1000 to 500000 records; the default is 100000 records.

  • Purge Window Size— The maximum number of records to be deleted in a single swipe. Record deletion is performed periodically (every 30 seconds) in batches. The maximum size of a batch should be chosen to avoid spikes in I/O and CPU utilization. The range is 100 to 1000 records; the default is 250 records.

Configuring Log Retention Policies in the GUI

Procedure

Step 1

For releases prior to the 4.2(1) release, perform the following substeps:

  1. In the menu bar, choose Admin > Historical Record Policies.

  2. In the Navigation pane, choose Controller Policies.

    In the Work pane, retention policy settings appear for the following logs:

    • Audit log

    • Events log

    • Fault Records log

    • Health Records log

  3. For the desired log, enter or adjust the Maximum Size.

  4. For the desired log, enter or adjust the Purge Window Size.

  5. Click Submit.

  6. To configure log retention policies for the switches, right-click Switch Policies in the Navigation pane and choose the action to create the desired retention policy.

Step 2

For the 4.2(1) release and later, perform the following substeps:

  1. To configure log retention policies for the controllers, on the menu bar, choose System > Controllers.

  2. In the Navigation pane, choose Retention Policies.

  3. In the Work pane, for the desired log, enter or adjust the Maximum Size and Purge Window Size.

  4. Click Submit.

  5. To configure log retention policies for the switches, right-click Switch Policies in the Navigation pane and choose the action to create the desired retention policy.

  6. To configure a retention policy for the switches, on the menu bar, choose Fabric > Fabric Policies.

  7. In the Navigation pane, expand Policies > Switch.

  8. Right click Audit Log Retention Policies, Health Retention Policies, Event Retention Policies, or Fault Retention Policies depending on the desired policy and choose to create a policy.

    Prior to the 5.2(1) release, these are labeled as Switch Audit Log Retention Policies, Switch Health Retention Policies, Switch Event Retention Policies, and Switch Fault Retention Policies.

  9. Enter values as appropriate in the "create" dialog, then click Submit.

Configuring Log Retention Policies in the REST API

For detailed information about configuring the APIC REST API, see the Cisco APIC REST API Configuration Guide.

This example shows how to configure the maximum log size and purge window size for the audit log, the event log, the fault log, and the health log: 


POST http://www.ExampleCorp.com/api/mo/uni/appliance.json

{
  "applianceInst": {
    "attributes": {
      "dn": "uni/appliance",
      "status": "modified"
    },
    "children": [{
      "aaaCtrlrRetP": {
        "attributes": {
          "dn": "uni/appliance/ifcaaaretp",
          "maxSize": "99999",
          "purgeWin": "250"
        },
        "children": []
      }
    },{
      "eventCtrlrRetP": {
        "attributes": {
          "dn": "uni/appliance/ifceretp",
          "maxSize": "99998",
          "purgeWin": "250"
        },
        "children": []
      }
    },{
      "faultCtrlrRetP": {
        "attributes": {
          "dn": "uni/appliance/ifcfretp",
          "maxSize": "99997",
          "purgeWin": "250"
        },
        "children": []
      }
    },{
      "healthCtrlrRetP": {
        "attributes": {
          "dn": "uni/appliance/ifchretp",
          "maxSize": "99996",
          "purgeWin": "250"
        },
        "children": []
      }
    }]
  }
}

The first section of the response is shown here, showing the fault log settings: 


{
    "imdata": [{
        "applianceInst": {
            "attributes": {
                "childAction": "deleteNonPresent",
                "dn": "uni/appliance",
                "lcOwn": "local",
                "modTs": "2013-11-22T09:10:26.008+00:00",
                "monPolDn": "",
                "name": "",
                "replTs": "never",
                "status": "",
                "uid": "0"
            },
            "children": [{
                "faultCtrlrRetP": {
                    "attributes": {
                        "childAction": "deleteNonPresent",
                        "descr": "",
                        "lcOwn": "local",
                        "maxSize": "99997",
                        "modTs": "2013-11-23T08:54:54.601+00:00",
                        "monPolDn": "",
                        "name": "FaultCtrlrRetP",
                        "purgeWin": "250",
                        "replTs": "never",
                        "rn": "ifcfretp",
                        "status": "",
                        "uid": "0"
                    }
                }
            },
.
.
.