Support Center > Search Results > SecureKnowledge Details
/var/log/messages shows 'Log buffer is full' Technical Level
Symptoms
  • /var/log/messages files show:

    FW-1: Log buffer is full
    FW-1: lost N log/trap messages
Cause

The kernel module maintains a cyclic buffer of waiting log messages.

This log buffer queue was overflown (i.e., new logs are added before all the previous ones are being read - causing in legit messages to be overwritten) resulting in the above messages.

Most probable causes can be:

  • high CPU utilization
  • high levels of logging
  • increased traffic
  • change in logging

These messages were also observed when $FWDIR/log/fw.log becomes very large (e.g., 750MBb or 1GB).

This can cause different issues since it can block kernel traps (sent to User Space daemons) that may be essential for the Security Gateway to work.


Solution
Note: To view this solution you need to Sign In .