Syslog: Configure syslog server logging (Cisco)

Technology: Monitoring
Area: Simple syslog configuration
Vendor: Cisco
Software: 10.0, 10.2-3, 11.0-3, 12.0, 12.0T, 12.1, 12.1T
Platform: Catalyst platforms, Routing platforms

Syslog is a standard for logging messages. The syslog messages are generated by our routers and our switches to let us know about everything that has happened. And it could be a wide range of things that have happened, from anything about to an emergency to something that’s just a simple notification. We can configure the messages to be forwarded to various destinations i.e. logging buffer, console line, terminal line and finally to syslog server. By default, syslog messages go to the console line. Those first three options will not help us in case of power loss or restart – the data will be gone. The best option is to take those messages and send them to a syslog server. There is such a thing as the severity levels of syslog messages. Severity levels indicates how important particular messages are. There are 8 severity levels:

For example level 6 – informational is giving us some information about something that has happened. If we set level informational on switch or router then we will obtain syslogs from chosen level as well as all preceding levels.

How to configure syslog server logging on Cisco IOS?

To enable syslog (basic config), use the following command on router 1:

R1# configure terminal
R1(config)# logging host x.x.x.x
R1(config)# logging trap informational (it differ on your requirement, choose between severity levels 0-7)
R1(config)# logging history informational (as above)
R1(config)# logging origin-id hostname
R1(config)# facility local6
R1(config)# logging host x.x.x.x transport udp port x

Before enabling logging make sure your router is correctly setup to receive time from NTP server or configure it manually to get time. Use command set clock or ntp server x.x.x.x to sync clock to router.

Additionally, it is worth using the following commands:

R1(config)# service sequence numbers
R1(config)# service timestamps log

The first one stamps log messages with a sequence number, the second one adds a date and time of the message or event.

We may also specify which types of messages should be displayed: