up vote 0 down vote favorite
share [g+] share [fb]

How do we fix these errors?

2629753: Dec 29 09:03:56.521 EST: %SEC-6-IPACCESSLOGRL: access-list logging rate-limited or missed 2 packets

This is a Cisco 871 router with BVI and access lists.

link|improve this question
85% accept rate
feedback

3 Answers

up vote 1 down vote accepted

The message means that an ACL (with, presumably, logging enabled) is generating syslog messages faster than the router is willing to send them off. You'll have to increase the rate-limit, use the logging rate-limit command to do this (you'll probably want to use the ip access-list logging interval command as well).

Then, tweak the rate-limit and interval until lowering them starts generating the rate-limit messages and up them a bit. The exact values will depend on your traffic profile and you may find that you'll have to accept these during traffic peaks.

link|improve this answer
I looked at (config)#logging rate-limit ? and it says <1-10000> Messages per second so that is very clear.. but what about ip access-list logging interval? Is it supposed to be the same as rate-limit? – George Bailey Jan 8 '11 at 13:57
I believe that is a minimum time between ACL log messages. Basically, you need to allow more log messages to be generated. But, the 871 is not the fastest hardware platform around and I don't know if "have ACL" directly implies "process-switched" or not. You may actually be on the limit of what your hardware can do. – Vatine Jan 8 '11 at 14:35
OK.. I looked again it says Access list logging interval (milliseconds).. It seems like I would have already checked that the first time :P . I looked at show run | include ... and it seems I must be using default values for both. I set the ACL interval to 0 and will play around with the rate-limit option to see if it works the way I think it does. Thanks for the answer – George Bailey Jan 10 '11 at 15:55
feedback
up vote 0 down vote

I assume you have to set the level of logging you are doing

There are 7 levels, I'm not sure which one you need, but I think this would be a good place to start.

0—emergencies 1—alerts 2—critical 3—errors 4—warnings 5—notification 6—informational 7—debugging

link|improve this answer
I edited my question. I was not just talking about hiding the messages. – George Bailey Dec 29 '10 at 18:05
feedback
up vote 0 down vote

I'm not immediately sure if this is a central logging server, but I'm inclined to think so. You're either seeing dropped packets, or messages are being generated to fast. Options are to fix your network congestion / reliability, or find a way to reduce the items being logged.

link|improve this answer
This is a Cisco 871 router with BVI and access lists. (edited my question) – George Bailey Dec 29 '10 at 18:15
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.