Syslog is a system logging protocol. Syslog is used by many applications, such as software, servers, sensors, etc. Cisco devices also use syslog.
Syslog messages always contain a time, a priority and a message.
Cisco syslog messages can range from important critical messages (such as a router crash) to less important informational messages (such as line protocol information).
|Alert||1||Immediate action required|
|Notification||5||Normal, but more important than informational|
|Informational||6||Normal, less important than notification|
Cisco devices can display syslog messages in the following way:
By default, all type of syslog messages on the console connection are displayed. With command logging console level you can set which messages are displayed on the console connection. level stands for the last severity level. This can be entered as a keyword or number. logging console 4 is therefore the same as logging console warning. In this case, only syslog messages with levels 0 to 4 will be displayed on the console connection.
Syslog messages can also be sent to vty connections, users who are logged into the router via eg SSH. With the command logging monitor level you can set which messages are displayed on the vty connections.
NB! When a user is logged in, they will see no syslog messages by default. The user can enable this in his session by entering the command terminal monitor in enabled mode.
Cisco devices have a buffer in which syslog messages are stored. With the command logging buffered level you can set which messages are stored in this buffer.
In enabled mode the buffer can be viewed with command show logging
R4#show logging Log Buffer (8192 bytes): *Apr 3 12:08:44.372: %LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to down *Apr 3 12:08:44.378: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down *Apr 3 12:08:44.379: %LINK-3-UPDOWN: Interface GigabitEthernet0/2, changed state to up *Apr 3 12:08:44.389: %LINK-3-UPDOWN: Interface GigabitEthernet0/3, changed state to down *Apr 3 12:08:45.381: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to down *Apr 3 12:08:45.384: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down
Cisco devices can forward the syslog messages to a syslog server.
Syslog servers capture and store syslog messages. Often such servers also offer the option to send a warning to the administrator if a critical syslog message has been received. An example of a free syslog server is Kiwi.
To set up a syslog server on a cisco device 2 things have to happen:
In the example below, messages up to level 4 (notification) are sent to syslog server 172.16.189.184
R1(config)#logging host 172.16.189.184 R1(config)#logging trap 4