During an outage review, police engineers find no local record of a critical link-down. Which assurance practice would best have preserved that event for later diagnosis?
Select an answer to reveal the explanation.
Short Explanation
Local log buffers are sticky notes on a crowded fridge—they fall off. Ship syslog to a collector and the link-down story is still there when the post-incident review starts. Memory and cleared buffers don’t cut it for police outage timelines.
Full Explanation
During an outage review, police engineers finding no local record of a critical link-down shows why remote syslog matters. Remote syslog logging best preserves that event by retaining link-down and similar messages on a collector beyond local buffer limits, reboots, and wraparound. Local buffers are finite; after busy shifts or device reloads, the evidence needed for a municipal after-action review is often gone unless it was shipped off-box in real time.
Relying solely on an engineer’s memory of console messages during the shift fails because human memory is incomplete and not an auditable timeline for police network incidents. Clearing the logging buffer hourly to keep show log output short fails because it actively destroys historical evidence. Disabling SNMP traps so only NetFlow can report interface state fails because traps complement syslog for state changes; disabling them reduces, rather than improves, event retention options, and NetFlow is not a full substitute for link-down logging.
Exam caveat: assurance design includes retention—remote logging collectors, appropriate severity, and synchronized timestamps (NTP). Do not pick “clear buffers” or “memory” distractors when the stem asks how to preserve events for later diagnosis.
Operational check: confirm logging host configuration and reachability, generate a test link event in a lab or maintenance window, verify the collector received it with correct facility/severity, and ensure local buffers are no longer the sole source of truth.