A log message
*Mar 1 00:00:42.052: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up
- Timestamp (the
*means the clock isn't synchronised). - Facility: the part of IOS that logged it (LINK).
- Severity: 3.
- Mnemonic: a short name for the event (UPDOWN).
- The description.
Severity levels
| Level | Keyword | Meaning |
|---|---|---|
| 0 | emergencies | System is unusable |
| 1 | alerts | Immediate action needed |
| 2 | critical | Critical condition |
| 3 | errors | Error condition |
| 4 | warnings | Warning condition |
| 5 | notifications | Normal but significant (an interface goes admin down) |
| 6 | informational | Informational messages |
| 7 | debugging | Debug output |
A memory aid: Every Awesome Cisco Engineer Will Need Ice cream Daily. Setting a level means that level and everything more severe (a lower number).
Where messages go
| Destination | Command | Default level |
|---|---|---|
| Console | logging console LEVEL | debugging (7) |
Memory buffer (show logging) | logging buffered LEVEL | debugging (7) |
| Syslog server (UDP 514) | logging host 10.1.1.50 + logging trap LEVEL | informational (6) |
| SSH/Telnet sessions | terminal monitor (per session) | debugging (7) |
In NetLab
▶ R1 R1>enable R1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. R1(config)#logging host 10.1.1.50 R1(config)#logging trap warnings R1(config)#interface g0/1 R1(config-if)#shutdown *Mar 1 00:00:06.000: %LINK-5-CHANGED: Interface GigabitEthernet0/1, changed state to administratively down *Mar 1 00:00:06.000: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down R1(config-if)#no shutdown *Mar 1 00:00:07.000: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up *Mar 1 00:00:07.000: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up R1(config-if)#end *Mar 1 00:00:08.000: %SYS-5-CONFIG_I: Configured from console by console R1#show logging | include Trap|Logging to Trap logging: level warnings, 10 message lines logged Logging to 10.1.1.50 (udp port 514, audit disabled, ▶ NMS student@NMS:~$ tail /var/log/syslog Mar 1 00:00:07 10.1.1.1 *Mar 1 00:00:07.000: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up
Only the severity 3 "changed state to up" message reached the server: the others are levels 5 (notifications) and above, below the warnings threshold.
Tip:
service timestamps log datetime msec(the default here) puts the date and milliseconds in each message. With NTP set up, those times line up across the network.