Describe the use of syslog features, including facilities and severity levels

What syslog does

Every time something notable happens on a Cisco device (an interface goes down, a neighbor is lost, someone logs in, a configuration is saved) the IOS generates a log message. Syslog is both the message format and the protocol for sending those messages to a central syslog server where they are stored and searched. A device can also show messages on the console, on Telnet/SSH sessions, and in its own memory buffer.

Logs are the flight recorder of the network. When a user says “the network was slow at 3 pm yesterday,” the logs are how you find out that an OSPF adjacency reset at 14:58.

Syslog messages travel over UDP port 514 to the server. (A TCP transport exists but UDP 514 is the number to know.)

Anatomy of a message

A Cisco syslog message looks like this:

*Sep  8 14:32:07.115: %LINK-3-UPDOWN: Interface GigabitEthernet0/1,
changed state to down

Broken down:

• *Sep 8 14:32:07.115: is the timestamp (the leading * means the clock is not NTP-synchronized; it disappears once NTP syncs). Timestamps appear only if service timestamps log datetime is configured, which it is by default on modern IOS.
• %LINK is the facility: which part of IOS generated the message (LINK, LINEPROTO, SYS, OSPF, DHCP, SEC, and hundreds more). In Cisco messages the facility names the software component; this is different from the numeric “facility” field (local0 to local7, and so on) in the standard syslog protocol header, which is used to sort messages on the server.
• 3 is the severity: how serious it is (see below).
• UPDOWN is the mnemonic: a short code for the specific event.
• Everything after the colon is the description, the human-readable text.

The general format is %FACILITY-SEVERITY-MNEMONIC: description.

Severity levels 0 through 7

Mnemonic to memorize the order: Every Awesome Cisco Engineer Will Need Icecream Daily (Emergency, Alert, Critical, Error, Warning, Notification, Informational, Debugging). Lower number = more severe.

A crucial rule: when you set a logging level, the device sends messages at that level and all more severe (lower-numbered) levels. Setting level 4 (warnings) sends 0 through 4. Setting level 7 (debugging) sends everything.

Where messages can go

The word “trap” in logging trap has nothing to do with SNMP traps; it is just the historical name for the syslog server severity threshold.

Configuration

! Timestamps with date, time, and milliseconds on log messages
R1(config)# service timestamps log datetime msec
! Same for debug output
R1(config)# service timestamps debug datetime msec
! Keep 64 KB of messages in RAM at level informational (6) and above
R1(config)# logging buffered 65536 informational
! Show only warnings (4) and more severe on the console
R1(config)# logging console warnings
! SSH/Telnet users may see notifications (5) and more severe
R1(config)# logging monitor notifications
! Send to the syslog server
R1(config)# logging host 192.168.1.60
! Send level 6 and more severe to the server
R1(config)# logging trap informational
! Use a stable source address for messages
R1(config)# logging source-interface Loopback0
! Stop log messages from interrupting what you are typing
R1(config)# line console 0
R1(config-line)# logging synchronous
R1(config-line)# exit
R1(config)# line vty 0 15
R1(config-line)# logging synchronous

logging synchronous on a line does not change what is logged; it makes IOS reprint your half-typed command on a fresh line after a log message interrupts it. Without it, messages splatter across your input and beginners think they have lost their place.

Then, in an SSH session, turn on message display:

R1# terminal monitor

terminal no monitor turns it off again. It is per-session and is not saved.

Verifying syslog

R1# show logging
Syslog logging: enabled (0 messages dropped, 0 messages rate-limited,
                0 flushes, 0 overruns, xml disabled, filtering disabled)
    Console logging: level warnings, 12 messages logged, xml disabled,
                     filtering disabled
    Monitor logging: level notifications, 0 messages logged, xml disabled,
                     filtering disabled
    Buffer logging:  level informational, 48 messages logged, xml disabled,
                    filtering disabled
    Logging to 192.168.1.60  (udp port 514, audit disabled,
              link up), 40 message lines logged
    Trap logging: level informational, 40 message lines logged

Log Buffer (65536 bytes):
Sep  8 14:32:07.115: %LINK-3-UPDOWN: Interface GigabitEthernet0/1,
changed state to down
Sep  8 14:32:08.120: %LINEPROTO-5-UPDOWN: Line protocol on Interface
GigabitEthernet0/1, changed state to down
Sep  8 14:35:41.002: %SYS-5-CONFIG_I: Configured from console by admin on vty0

The header confirms each destination and its level, then the buffered messages follow. clear logging empties the buffer.