Syslog
Severity levels and inclusive logging thresholds, facilities, destinations and message format, with configuration and verification.
Severity levels
Syslog severity levels (lower = worse)
| Level | Keyword | Meaning | Mnemonic |
|---|---|---|---|
| 0 | emergencies | System unusable | Every |
| 1 | alerts | Immediate action needed | Awesome |
| 2 | critical | Critical condition | Cisco |
| 3 | errors | Error condition | Errors |
| 4 | warnings | Warning condition | Will |
| 5 | notifications | Normal but significant | Need |
| 6 | informational | Informational message | Investigation |
| 7 | debugging | Debug messages | Daily |
'Every Awesome Cisco Engineer Will Need Icecream Daily' — or your favorite mnemonic.
- Config
- logging trap warnings
- warnings = level 4.
- Inclusive threshold → severities 0,1,2,3,4 go to the server.
- Notifications (5), informational (6), debugging (7) stay off the wire.
The keyword names the least-severe level still sent.
Facilities and destinations
Facilities and destinations
| Concept | What it is |
|---|---|
| Facility | The subsystem the message came from (e.g., %LINK, %OSPF, %LINEPROTO) — identifies the source component |
| Severity | The 0–7 level after the facility in the message |
| console | Messages to the console port |
| monitor | Messages to vty sessions (after terminal monitor) |
| buffered | Local memory log — show logging |
| trap/host | Remote syslog server on UDP 514 |
Severity thresholds are inclusive: logging trap 4 sends levels 0–4 (emergencies through warnings) — i.e., 'this severity and worse'. logging trap debugging sends everything. The same logic applies per destination: console, monitor (vty sessions), buffer (memory) and trap (remote server).
*Mar 1 00:12:31.421: %LINK-5-CHANGED: Interface GigabitEthernet0/1, changed state to administratively downTimestamp : %FACILITY-SEVERITY-MNEMONIC: text%LINK-5-CHANGEDLINK facility, severity 5 (notification), mnemonic CHANGED.Configuration and verification
Log warnings+ to a server, notifications+ to console, info+ to buffer — Privileged EXEC → Global configuration
Cisco IOS / IOS XE
configure terminal logging host 192.168.99.20 logging trap 4 logging console notifications logging buffered 16384 informational service timestamps log datetime msec end
show logging
- Header lists each destination with its configured level.
- Buffer shows timestamped messages at or above the buffered level.
terminal monitoron a vty session enables live messages;logging synchronousstops them from trashing your typing.
Changes device configuration.
Common mistakes
- Reading thresholds as 'only this level' — they're inclusive of everything more severe.
- Mixing up level numbers and keywords (6 is informational, not errors — errors are 3).
- Assuming
logging trap <level>is always mandatory —logging hostcan work with default trap settings on many images; set it explicitly for predictable, documented behavior. - Confusing facility with severity in a message — %LINK is the facility, 5 is the level.
- Flooding console with debugging output — debug-level logging belongs at the server or buffer, not the console.
Observation: Syslog server configured; nothing arrives on the collector.
- logging trap level too restrictive — a smaller number sends fewer messages; a larger cutoff includes more
- UDP 514 blocked on the path
- Server address wrong or unreachable
| Check | Indicates |
|---|---|
show logging destination list | Confirms the configured host and trap level. |
| Ping the server; check ACLs for UDP 514 | Path filtering silently drops syslog. |
| Raise trap level temporarily to debugging | If messages now arrive, the issue was the threshold. |
Correction: Fix level/path/address as indicated.
Events appear on the collector with correct timestamps.
Related resources
Sources
- Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
- RFC 5424 — The Syslog Protocol — reviewed 2026-11-02
- Cisco — Configuration Fundamentals Command Reference — reviewed 2026-11-02
Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.