Cisco IOS Cookbook, 2nd Edition

Rate-Limiting Syslog Traffic

Problem

You wish to rate-limit the syslog traffic to your server.

Solution

Use the logging rate-limit configuration command to limit the number of syslog packets sent to your server:

Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#logging host 172.25.1.1
Router(config)#logging rate-limit 30 except warnings
Router(config)#end 
Router#

To rate limit the number of log messages sent to the console port, use the following command:

Router#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#logging rate-limit console 25 except warnings 
Router(config)#end 
Router#

This feature became available starting in IOS Version 12.1(3)T.

Discussion

By default, a router that is configured for remote logging will forward all log messages to the syslog server as they are created, regardless of how many there are. The rate-limit command will throttle the number of packets to ensure that router won’t flood the network or syslog server. It is particularly useful to throttle syslog messages when forwarding debug traces or if the network is congested.

Cisco provides the option to throttle log messages sent to the console port, as well. This feature is important, since all messages written to the console port cause CPU interrupts. If a large number of log messages are being sent to the console port, then the router can suffer noticeable service degradation. Being able to rate-limit messages ...