Notes - Syslog on IOS-XE
The router can log messages to multiple destinations:
Console
Term monitor (SSH and telnet)
Syslog server
SNMP server
Local buffer (non-persistent)
Local persistent storage
Syslog message format
Syslog messages are in the format:
The sequence numbers feature causes a sequence number to increment for every message. It can be enabled using:
The timestamp can be added to log/debug messages and can use the date or the uptime of the device. You can optionally add the msec, year, and timezone to the timestamp
The facility is essentially the process that generated the message, such as SNMP, LDP, OSPF, SYS, LINEPROTO, etc.
The severity is a digit from 0-7, with 0 being the most severe.
0
Emergency
1
Alert
2
Critical
3
Error
4
Warning
5
Notification
6
Informational
7
Debug
The MNEMONIC is a string that breifly describes the message, such as UPDOWN, ADJCHG, NBRCHG, etc.
The description is a longer string that describes the event, such as “LDP Neighbor 11.11.11.11:0 (4) is UP”
Enabling/Disabling Logging
By default logging is enabled. To turn it off you can use:
However you will see see logging messages outputted to console. To disable this you must also use:
Logging Buffer
The logging buffer is not persistent - the messages are lost upon a reboot.
You can control the size of the buffer using:
You can control the level of log messages that are outputed to the buffer using:
You can confirm the settings using show logging:
The above command show logging also displays the contents of the buffer.
Logging to Console and VTY lines
The console and VTY lines are configured separately.
You can set the logging level as follows. All log messages with a severity level equal or less than the specified value are sent to the line:
You can rate-limit the console messages only, or all logging messages. The all keyword message to include debug messages.
You should also configure synchronous logging for the console line. This makes the logging process wait for the terminal to finish printing a line before outputting the logging message.
This is also configurable on the VTY lines, but I have never seen this used. Perhaps it is enabled by default for VTY?
Logging to a Syslog Server
You configure the logging severity level for the syslog server using:
You configure the remote syslog server using the following command.
The default transport is UDP/514. You can configure this using:
Set the source-interface as follows:
The facility code can be configured at the global level, not per-server. This is used to multiplex messages. The syslog server can separate log messages based on the facility - directing the messages to separate files, etc.
You can set the queue depth for logs that are forwarded to a syslog server using:
Logging to persistent memory
The logging buffer is lost upon reboots. You can additionally configure logs to be sent to a persistent directory at a given URL. The URL can be the local bootflash.
You can control the max filesize of an individual log file using:
Logging to SNMP server
You can send syslog messages using SNMP traps. You must first enable SNMP traps for syslog and define the SNMP host.
You then set the SNMP syslog notification level using:
The idea is that syslog first sends the log to a dedicated history buffer, and then the agent replicates the messages as SNMP traps. This is the reason for the “logging history” syntax.
Last updated
