Details about the WebUI memory log (memlog)

Last modified on 20 Jan, 2023. Revision 10
This article discusses how much data is stored by the cOS Core WebUI memory log (memlog) feature and for how long. It also discusses the difference in logging for the different memlog categories listed in the WebUI. The memlog feature allows logs to be viewed in real-time as they are generated by cOS Core.
Up to date for
cOS Core 14.00.08
Supported since
cOS Core 9.30.xx
Not valid for
cOS Core 8.90.xx and older
Status OK
Author
Peter Nilsson

The WebUI Logging Menu

When using the cOS Core WebUI, there is a run-time information section that (among other things) contain a logging section, as shown in the screenshot below.

As can be seen above, there is a menu of six different memory logger (memlog) categories that can be selected. Below are answers to some common questions regarding the memlog feature.

How many logs are saved by memlog?

Roughly 500 logs are saved at any time for each logging category in the list shown. This amount may in some situations be above or below 500 logs. The reason for the variation depends on the variable size of the log messages and how many can fit in the allocated memory area.

How long are logs stored by memlog?

The logs are stored until the firewall either restarts or until the log limit of around 500 has been reached. Once the limit has been reached the oldest log entries are continuously replaced by the newer entries.

Are logs saved to disk by memlog?

No, memlog logs are only stored in memory and will be lost when the firewall restarts. However, they are preserved by a reconfigure operation. To store logs on disk, it is recommended to set up a log receiver object in cOS Core such as FWLog or Syslog.

Does each listed memlog category have its own log limit?

Yes, each memlog category (System, Anti-Virus, Application Control log etc) has its own memory allocation that allows about 500 log entries for each category.

Can these logs be viewed using the CLI?

Yes, the logsnoop CLI command can be used to do this. This command is documented in both the cOS Core Administration Guide and CLI Reference Guide.


Related articles

The TCP Window Scale Log Event
15 Nov, 2022 tcp log core
Automatically stop active PCAPdump or Logsnoop in the CLI
7 Dec, 2022 pcapdump log cli core logsnoop
Why some log category ID's are missing
23 May, 2022 core log logreceiver
The meaning of the Default_Access_Rule log entry
7 Nov, 2022 core arp log routing