Syslog Output
Console
Logging Buffer
Remote Syslog Server.
Console Syslog Configuration
- R1(config)#logging console ?
- <0-7> Logging severity level
- alerts Immediate action needed (severity=1)
- critical Critical conditions (severity=2)
- debugging Debugging messages (severity=7)
- discriminator Establish MD-Console association
- emergencies System is unusable (severity=0)
- errors Error conditions (severity=3)
- filtered Enable filtered logging
- guaranteed Guarantee console messages
- informational Informational messages (severity=6)
- notifications Normal but significant conditions (severity=5)
- warnings Warning conditions (severity=4)
- xml Enable logging in XML
- R4(config)# logging console 6
- Console messages are limited to level 6-0
- Verification
- R4# show logging
Logging Buffer Configuration
- R1(config)# logging buffered 8192
- R4(config)# logging buffered 4
- R4(config)# logging buffered 8192 4
- Buffer syslog messages are limited to levels 4-0
- Buffer default size is increased to 8192 and messages are limited to levels 4-0
- Verify buffered messages
- R1# show logging
- This provides a little bit of information about size of the buffer, the number of messages currently logged before showing the messages currently logged in the buffer
Remote Syslog Configuration
NOTE: syslog relies on the date and time being accurate and for this reason, it is important that the system date and time is configured with the NTP protocol, so the system has accurate time
- R4(config)#logging ?
- A.B.C.D IP address of the logging host
- buffered Set buffered logging parameters
- console Set console logging parameters
- host Set syslog server IP address and parameters
- on Enable logging to all enabled destinations
- trap Set syslog server logging level
- userinfo Enable logging of user info on privileged mode enabling
Tips: For easy tracking of the syslog events, you can add the sequence numbers to the beginning of the events by issuing this commands
- R1(config)#service sequence-numbers
- R4(config)# logging 192.168.1.100 (Send syslog messages to the syslog server) OR
- R4(config)# logging host 192.168.1.100 (Send syslog messages to the syslog server)
- R1(config)#exit
- R1#
- 000036: *Dec 24 16:28:00.651: %SYS-5-CONFIG_I: Configured from console by console
- R1#
You can also enable syslog synchronous logging, remember, by default, syslog default action is to display the events on console as soon as they occur; however, this can be problematic especially when you are trying to configure our devices and event messages are popping up and and interfering with your configuration. You can for this reason, force syslog messages to be displayed once the configuration is completed. This will hold the event messages until you hit the enter key after your configuration. if this is not set, then you will have to be pressing tab tab to see your configuration instructions. This configuration below is needed on every device with or without the syslog being configured
- R4(config)# line console 0
- R4(config)# logging synchronous
- R4(config)# exit
Disabling syslog on a device
This is NOT recommended and should only be performed on express instruction and only if required and have specific reasons to do so.
- R4(config)# no logging on
Question
How can you configure the cisco router so that level 5 through 0 logs appear in buffer? Answer: logging buffered 5
Verification
R1#show logging
Syslog logging: enabled (0 messages dropped, 3 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled) No Active Message Discriminator. No Inactive Message Discriminator. Console logging: level debugging, 30 messages logged, xml disabled, filtering disabled Monitor logging: level debugging, 0 messages logged, xml disabled, filtering disabled Buffer logging: level warnings, 28 messages logged, xml disabled, filtering disabled Exception Logging: size (8192 bytes) Count and timestamp logging messages: disabled Persistent logging: disabled No active filter modules. Trap logging: level informational, 32 message lines logged Logging Source-Interface: VRF Name: Log Buffer (8192 bytes):