Cisco IOS Syslog Messages

Lessons Discussion
21

You guys are absolutely right, just fixed this.

Thanks!

Rene

1 Like
22

if you access via telnet or ssh and you do a “show log” and the logging buffered is configured until severity 4 (warnings) , the show log will only show up until warning messages despite the logging monitor was configured until severiry 6 (informational) ?

23

Hello Juan

You can set the severity that will be displayed/logged for each destination of a syslog message. For example, you can configure logging buffered level which will configure the severity level displayed when you do a show logging. The logging console level will configure the severity level that is displayed on the console. logging monitor level will configure the level that is displayed on vty lines, that is, on connections via SSH and Telnet. Finally, logging trap level will configure the level that will be sent to a syslog sever, if it has been configured.

So you can set the severity level of the syslog that is displayed for each destination of a syslog message.

I hope this has been helpful!

Laz

24

I am not sure if this is the right place to post my comment, but I like to give a try:

Is it possible to classify syslog so the command ‘snmp-server enable traps syslog’ can be skipped or modified? I do not like to send syslog informational/notificational to the snmp server, but wanted to send APPNAV/WAAS logs to the snmp server. But APPNAV/WAAS logs fall under the syslog, if we disable the command, then nothing will be sending to SNMP server.

25

Hi Sudip,

What syslog messages are you trying to forward for APPNAV/WAAS? I’d think that there should be an SNMP equivalant for this.

You could also create a simple EEM script that looks for your APPNAV/WAAS syslog messages, then forwards them to your SNMP server. This ensures that only these syslog messages get forwarded and nothing else.

Rene

26

To remember that various Levels of logging, Todd Lammle book says the following sentence
"Every Awesome Cisco Employee Will Need Icecream Daily " . This makes it easy to remember the levels from 0 to 7 with first letters of each word.

2 Likes
27

Hi Rene,

my name is Juan nice to meet you, I want configure ( Adiscon LogAnalyzer), can you guide me for integrate with devices cisco this kind of syslog, please, I install Adiscon in Kali linux.

I do not know if it is enough to enable the website within / var / www / html in the root of kali linux, I create a testing environment and I have a switch with scope to this server syslog, configure the command "logging host 10.10 .64.150 “and” logging trap informational "but my server does not receive anything, I do not know if any database should be mounted to work in Kali, I am confused with this syslog that may be useful in the future.

Please I appreciate any support.

28

Hello Juan

It’s great that you are suggesting additional topics that can be added to the Networklessons site. It’s difficult to have each and every one responded to in full. I suggest you submit a new lesson idea at this page:


That way Rene can add new lessons and address the topics you mention in full.

I hope this has been helpful!

Laz

29

Hi Rene ,
Could you plz explain to me what does it null 0 in the routing table ?

30

Hello Allal

The Null0 route is used for various reasons in the routing table. Any routing entry that has an exit interface of Null0 will drop packets to that destination. Using Null0 you are explicitly stating that any packets destined to this specific destination will be dropped.

Null0 interfaces in the routing table are used for various reasons. One of the most common is when EIGRP summerization is enabled. EIGRP will advertise a summary route to other routers, but at the same time, will have a routing table entry to the summary route pointing to the Null0 interface. An example of such an entry in the routing table can be seen below:

R1#show ip route eigrp 
     172.16.0.0/16 is variably subnetted, 3 subnets, 2 masks
D       172.16.0.0/23 is a summary, 00:01:38, Null0

This is done to avoid routing loops. In the absence of any more specific route, the above routing table entry would cause any packets destined for this subnet to be explicitly dropped. More about this type of summarization (and why the Null0 interface is used) can be found in the following lesson:


I hope this has been helpful!

Laz

31

Thank you so much Lazaros :blush:

1 Like
32

HII Rene,

i am working as a network engineer, my access routers are configured with below commands by planning team.can u explain in brief.

!
logging buffered 65530 informational
logging trap informational
no logging console
no logging monitor
enable secret var123
!
33

Hello Chandrasekhar

The meaning of these commands is as follows:

logging buffered 65530 informational
This command enables system logging so that syslog events that are triggered are saved within the local buffer to be viewed at a later time. The specific command indicates that the buffer size in bytes is 65530, and that the type of syslog messages that are buffered are of a severity level of “informational” and lower. Note that there are eight severity levels:

0 | emergencies]—System is unusable
1 | alerts]—Immediate action needed
2 | critical]—Critical conditions
3 | errors]—Error conditions
4 | warnings—Warning conditions
5 | notifications]—Normal but significant conditions
6 | informational]—Informational messages
7 | debugging]—Debugging messages

When you set the severity level to informational, all syslog messages are buffered except for debugging.

logging trap informational

This command involves syslog messages that are sent to external syslog servers. A trap is an unsolicited (meaning, not requested) message that is sent to a remote network management host. This command indicates the severity level of syslog messages that should be sent to the remote host. Regardless of what this command is set to, in order for it to have meaning, the logging host command must also be applied which configures the remote host to which syslog messages will be sent.

no logging console
no logging monitor

These commands disable the appearance of syslog messages on the console (connected directly via the serial cable) or on the monitor (remote connection using either telnet or SSH). These commands should be implemented so that when you connect to the CLI, you will not be distracted by messages appearing on the CLI while trying to configure the device. You must enable these commands if you want to view debugging information live as the events occur in real time.

enable secret var123
This command configures the password you must type when you want to enter into global configuration mode.

You can find more information about logging commands at the following Cisco documentation.

I hope this has been helpful!

Laz

34

Dear Sir,
Is there any possiblity to download the syslog free edition. ? Please provide instruction how to use to download the free edition.
Appreciate your help.

Regards,
Mani

35

Hello Mani

There are several free syslog servers available online. If you do a search for “free syslog server” you should find several good options for both Windows and Linux operating systems. In this lesson, Rene recommends Adiscon LogAnalyzer which is free. For step by step instructions on how to setup a syslog server, take a look at the documentation available for the server of your choice. For configuration of the Cisco device to send syslog messages to a server, take a look at the following lesson.

I hope this has been helpful!

Laz

36

Thanks for the article guys.

I have a question: On Packet Tracer I SSH’d from one switch to another, disabled terminal monitor, however I was still seeing messages show up when a did something like shutdown an interface, as per the below:

SwitchB#terminal no monitor 
SwitchB#config
Configuring from terminal, memory, or network [terminal]? 
Enter configuration commands, one per line.  End with CNTL/Z.
SwitchB(config)#inter
SwitchB(config)#interface fa0/7
SwitchB(config-if)#shut
SwitchB(config-if)#no shut

%LINK-5-CHANGED: Interface FastEthernet0/7, changed state to down
SwitchB(config-if)#

Is this just because Packet Tracer doesn’t quite behave like “real” Cisco devices? On a real device would I expect to not see these messages if terminal monitor was disabled?

Thanks!

37

Hello Louis

I tried going into packet tracer and I issued the term no mon command on a 2901 router. I found that when I shutdown an interface, no message appeared. I tried the same with a 2960 switch and it seems to be working. I’m using Packet Tracer 7.0.0.0306.

That’s interesting behaviour. Can you tell us what version you’re using?

Laz

1 Like
38

Hi Laz,

I just set it up again with fresh routers and using 2901’s like you, and it seems to be working. Not sure what went wrong before.

Thanks for your help!

1 Like
39

Hi Rene

If we enter more than one syslog server for our device to send its syslog messages to how does it handle it? In other words does it use the first as the primary and failover to the second if the first is unavailable or does it send to both simultaneously or does it alternate, or some other such thing?
I have a requirement to configure syslog resilience for all our Cisco devices so is it as simple as entering more than one logging host or do we need some other mechanism? Can it be done by means of ip sla for example? If so how would we do it?

Thanks,
Phil.

40

Hello Phil

Actually, it is as simple as configuring more than one logging host. When you do this, syslogs are sent to both servers simultaneously. You can find out more information about best practices for deploying syslog in a high-availability and scalable fashion for Cisco networks here:

I hope this has been helpful!

Laz