CCNA 200-301 v1.1 reference — IP Services
Syslog
Severity levels and inclusive logging thresholds, facilities, destinations and message format, with configuration and verification.
Objective 4.5v1.1 exam target
Loading
Syslog severity levels (lower = worse)
| Level | Keyword | Meaning | Mnemonic |
|---|---|---|---|
| 0 | emergencies | System unusable | Every |
| 1 | alerts | Immediate action needed | Awesome |
| 2 | critical | Critical condition | Cisco |
| 3 | errors | Error condition | Errors |
| 4 | warnings | Warning condition | Will |
| 5 | notifications | Normal but significant | Need |
| 6 | informational | Informational message | Investigation |
| 7 | debugging | Debug messages | Daily |
'Every Awesome Cisco Engineer Will Need Icecream Daily' — or your favorite mnemonic.
Severity thresholds are inclusive: logging trap 4 sends levels 0–4 (emergencies through warnings) — i.e., 'this severity and worse'. logging trap debugging sends everything. The same logic applies per destination: console, monitor (vty sessions), buffer (memory) and trap (remote server).
Facilities and destinations
| Concept | What it is |
|---|---|
| Facility | The subsystem the message came from (e.g., %LINK, %OSPF, %LINEPROTO) — identifies the source component |
| Severity | The 0–7 level after the facility in the message |
| console | Messages to the console port |
| monitor | Messages to vty sessions (after terminal monitor) |
| buffered | Local memory log — show logging |
| trap/host | Remote syslog server on UDP 514 |
$ Anatomy of a syslog message
*Mar 1 00:12:31.421: %LINK-5-CHANGED: Interface GigabitEthernet0/1, changed state to administratively downTimestamp : %FACILITY-SEVERITY-MNEMONIC: text%LINK-5-CHANGEDLINK facility, severity 5 (notification), mnemonic CHANGED.Related resources
Sources
- Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
- RFC 5424 — The Syslog Protocol — reviewed 2026-11-02
- Cisco — Configuration Fundamentals Command Reference — reviewed 2026-11-02
Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.