List the syslog severity levels and explain how logging levels work on a Cisco device.
Show the answer
Say this first
Eight levels, 0 to 7: 0 emergencies, 1 alerts, 2 critical, 3 errors, 4 warnings, 5 notifications,
6 informational, 7 debugging. A lower number is more severe. Setting a level gives you that level and
everything more severe: logging trap warnings sends levels 0 to 4. Cisco messages carry the level
in their tag, as in %LINK-3-UPDOWN: facility LINK, severity 3, mnemonic UPDOWN.
Go deeper
| Level | Keyword | Typical messages |
|---|---|---|
| 0 | emergencies | system unusable |
| 1 | alerts | act now, for example temperature alarms |
| 2 | critical | critical conditions |
| 3 | errors | %LINK-3-UPDOWN interface down |
| 4 | warnings | warnings |
| 5 | notifications | %LINEPROTO-5-UPDOWN, %SYS-5-CONFIG_I, %OSPF-5-ADJCHG, %BGP-5-ADJCHANGE |
| 6 | informational | ACL log hits such as %SEC-6-IPACCESSLOGP |
| 7 | debugging | debug output |
A memory aid: Every Awesome Cisco Engineer Will Need Ice cream Daily.
Where logs go on IOS
| Destination | Command | Default level |
|---|---|---|
| Console | logging console | debugging |
| SSH and telnet sessions | logging monitor, plus terminal monitor per session | debugging |
| Local buffer | logging buffered | debugging |
| Syslog servers | logging trap | informational |
service timestamps log datetime msec show-timezone
service sequence-numbers
logging buffered 64000 informational
logging console warnings
logging source-interface Loopback0
logging host 10.0.0.60
logging trap informationalSyslog uses UDP 514 by default. TCP and TLS (port 6514) are available where the platform supports them. Cisco devices use facility local7 by default.
They will ask next
Why not send debugging level to the syslog server?
Volume. A single debug can produce thousands of lines a second and bury the messages that matter. Informational (6) is the usual level for the servers.
You are on SSH and see no log messages. Why?
Logs go to vty sessions only after
terminal monitorin that session.A syslog server shows priority 189 on Cisco messages. What does that mean?
PRI is facility times 8 plus severity. local7 is facility 23, so 23 x 8 + 5 = 189: a level 5 notification such as an interface line protocol change.
Traps
- Getting the direction wrong.
logging trap 4sends 0 to 4, not 4 to 7. - Logging without NTP and timestamps. Logs with wrong times are close to useless in an incident.