topic Re: System log message Clearing snmpd.log due to log overflow in General Topics

System log message Clearing snmpd.log due to log overflow

ChrisIsett — Fri, 13 Aug 2021 14:46:48 GMT

I am wondering why I see the log 'Clearing snmpd.log due to log overflow' on several of my firewalls. Out of the ~20 firewalls I manage 2 or 3 firewalls log this message on occasion. The other firewalls never log this message.

I am trying to understand why this occurs on just a few firewalls. Should I be concerned about the message? What do I look for?

Chris

Re: System log message Clearing snmpd.log due to log overflow

Remo — Sat, 14 Aug 2021 11:16:05 GMT

Hi @ChrisIsett

What PAN-OS versions do you have installed on all these firewalls and are all the same firewalls or different ones? Do you monitor all these firewalls the same way?

Re: System log message Clearing snmpd.log due to log overflow

ChrisIsett — Mon, 16 Aug 2021 12:01:21 GMT

Everything is 9.1.6. Panorama and Firewalls. They are all 5220's with the exception of one pair which are 5250's.

The snmp and logging configuration all gets pushed from templates. They are all basically monitored with the same set of tools. The firewalls are not under too.

I have looked at the health of the firewalls in Panorama and there is no obvious spike in traffic that seems to occur at the time the log message comes out.

Re: System log message Clearing snmpd.log due to log overflow

BPry — Mon, 16 Aug 2021 17:44:23 GMT

@ChrisIsett,

The message in and of itself really isn't alarming, and it won't cause any traffic issues at all. If you feel up to a bit of troubleshooting and don't want to just open a ticket with TAC I would take a look at the actual log file via 'less mp-log snmpd.log' and see what is actually overflowing the log file. It's possible that these two endpoints were put into debug for some reason which can cause this message, or it could be something more serious.

Re: System log message Clearing snmpd.log due to log overflow

ChrisIsett — Mon, 23 Aug 2021 16:45:31 GMT

Thanks for the command. The log is literally full of this...

2021-08-14 11:25:25 truncating integer value > 32 bits

About 30 entries a minute. I checked the 2 f/w's that generate the snmpd log messages the most and they are just filled with the above message. The rest of the firewalls look normal.

A quick search did not reveal any hints on what the log message means.