cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Delay in event log messages

Highlighted
A model citizen

Delay in event log messages

Is there a 20 minute delay in event logs?

At 13:54, the log entry at 13:30 appeared. Even after refresh, as well as clicking Network Wide -> Event log, several times in between.

mfc-log-delay.PNG

8 REPLIES 8
Highlighted
Here to help

Re: Delay in event log messages

maybe there are no event logs on the MX during that time.
e.g: at 12:50 you only see the log at 12:30
Highlighted
A model citizen

Re: Delay in event log messages

I checked in on the Event log at 14:06 and nothing. Shortly thereafter;

mfc-log-delay2.PNG

Highlighted
Here to help

Re: Delay in event log messages

I'm not good at math but

- at 13:54 you cannot see the log of 14:00

- at 14:06 you can see the log of 14:00

 

it's natural.

 

If you have another network, you can check the delay

Highlighted
A model citizen

Re: Delay in event log messages


@natuan wrote:

I'm not good at math but

- at 13:54 you cannot see the log of 14:00

- at 14:06 you can see the log of 14:00

 

it's natural.

 

If you have another network, you can check the delay


No. I could not see the log entry at 13:30, untill 13:54. 

The entry at 14:00, did not appear until at 14:07.

 

Another thing I'm curioust about is that I have difficulty in believing that I'm getting the same two "Source IP and/or VLAN mismatch" events every 30 minutes, precisely on the second, for the last month. 

Highlighted
New here

Re: Delay in event log messages

Has anyone gotten an answer to this?  My meraki logs show about a 10 minute delay.

Highlighted
New here

Re: Delay in event log messages

I noticed the same issue. It took at least 20 minutes before the logs where showing in the "Event log" search.  I don't think it has been this slow in the past. 

Highlighted
Getting noticed

Re: Delay in event log messages

There seems to be a fair amount of alarm suppression happening (event log presentation)

Noticed that something like blocked malware is about an hour lead time until it shows in logs and sends alerts.
15 minutes (approx) for cellular up/down
Down is 5-10 minutes
Failover approx 5mins


It could mean that these alerts have different values, or that the boxes when getting lots of event log hits, place notification on a lower priority and that accounts for the delays in alerts being sent and logs being populated

Highlighted
Conversationalist

Re: Delay in event log messages

Same issue here. Got on at 17:50. Kept refreshing constantly, no log messages after 17:44. Finally at 18:01 2 1/2 pages of new entries showed up. Do they only update every 15 minutes? Makes troubleshooting VPNs and such quite difficult.

Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.