Home > Syslog Tutorial

Syslog Tutorial

May 22nd, 2014 Go to comments

As an administrator of a network, you have just completed all the configuration and they are working nicely. Now maybe the next thing you want to do is to set up something that can alert you when something goes wrong or down in your network. Syslog is an excellent tool for system monitoring and is almost always included in your distribution.

Places to store and display syslog messages

There are some places we can send syslog messages to:

Place to store syslog messages Command to use
Internal buffer (inside a switch or router) logging buffered [size]
Syslog server logging
Flash memory logging file flash:filename
Nonconsole terminal (VTY connection…) terminal monitor
Console line logging console

Note: If sent to a syslog server, messages are sent on UDP port 514.

By default, Cisco routers and switches send log messages to the console. We should use a syslog server to contain our logging messages with the logging command. Syslog server is the most popular place to store logging messages and administrators can easily monitor the wealth of their networks based on the received information.

Syslog syntax

A syslog message has the following format:

seq no:timestamp%FACILTY-SEVERITY-MNEMONIC: message text

Each portion of a syslog message has a specific meaning:
+ Seq no: a sequence number only if the service sequence-numbers global configuration command is configured
+ Timestamp: Date and time of the message or event. This information appears only if the service timestamps global configuration command is configured.
+ FACILITY: This tells the protocol, module, or process that generated the message. Some examples are SYS for the operating system, IF for an interface…
+ SEVERITY: A number from 0 to 7 designating the importance of the action reported. The levels are:

Level Keyword Description
0 emergencies System is unusable
1 alerts Immediate action is needed
2 critical Critical conditions exist
3 errors Error conditions exist
4 warnings Warning conditions exist
5 notification Normal, but significant, conditions exist
6 informational Informational messages
7 debugging Debugging messages

Note: You can remember the order above with the sentence: “Eventually All Critical Errors Will Not Involve Damage”.

The highest level is level 0 (emergencies). The lowest level is level 7. To change the minimum severity level that is sent to syslog, use the logging trap level configuration command. If you specify a level, that level and all the higher levels will be displayed. For example, by using the logging console warnings command, all the logging of emergencies, alerts, critical, errors, warnings will be displayed. Levels 0 through 4 are for events that could seriously impact the device, whereas levels 5 through 7 are for less-important events. By default, syslog servers receive informational messages (level 6).

+ MNEMONIC: A code that identifies the action reported.
+ message text: A plain-text description of the event that triggered the syslog message.

Let’s see an example of the syslog message:

39345: May 22 13:56:35.811: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/1, changed state to down

+ seq no: 39345
+ Timestamp: May 22 13:56:35.811
+ SEVERITY level: 5 (notification)
+ message text: Line protocol on Interface Serial0/0/1, changed state to down

Syslog Configuration

The following example tells the device to store syslog messages to a server on and limit the messages for levels 4 and higher (0 through 4):

Router(config)#logging trap 4

Of course on the server we have to use a syslog software to capture the syslog messages sent to this server.

Comments (50) Comments
Comment pages
1 2 2162
  1. ok for the terminal line
    May 22nd, 2014


  2. ljceli
    May 22nd, 2014

    Great!! Thanks 9tut.

  3. Mosaab
    June 3rd, 2014

    Thanks a lot..

  4. kherbek
    June 17th, 2014

    thanks it’s helpful,and well explained .

  5. Anonymous
    June 18th, 2014

    cbt-nuggets did not spend enough time on syslog, netflow and snmp.
    thanks 9tut

  6. Ahmed
    June 23rd, 2014

    Thanks alot for such useful information

  7. Ram
    June 24th, 2014

    good info

  8. Anonymous
    July 9th, 2014

    Thanks 9tut

  9. anoniman
    July 10th, 2014

    Šta je local 7?

  10. jj123
    July 17th, 2014

    Short and to the point. Thanks

  11. Mo
    July 21st, 2014

    Thank you so much. I dont know what we are going to do without you 9tut

  12. pipune
    August 4th, 2014

    Easy and concise straight to the point explanation, we really appreciate 9tut.

  13. Sandy6933
    August 8th, 2014

    Thanks for the information!!!

    Keep posting

  14. Max
    August 12th, 2014

    Sorry, but in the Cisco Site Configuration Guide, says the following: By default, Cisco IOS devices, CatOS switches, and VPN 3000 Concentrators use facility local7.

    So, what affirmation is correct? :(

    Level 6 or Level 7 is the default value?

  15. Anonymous
    September 9th, 2014
  16. 9tut
    September 9th, 2014

    @Anonymous: In your link, it said “The default outgoing facility is local7”. That is not level 7 message but the “facility”. The statement “By default, syslog servers receive informational messages (level 6)” is correct.


  17. Saamysaamy
    September 26th, 2014

    You made my day thanks

  18. chanaka
    September 27th, 2014

    surper description

  19. amandi
    October 7th, 2014

    nice,awesome explanation >>>>>>>>>>>>

  20. Anonymous
    November 19th, 2014

    Short and to the point. Thanks

  21. PrestonRoad
    November 19th, 2014

    Short and to the point. Thanks

  22. Adawudu Kafui
    December 3rd, 2014

    So simple and straight to the point

  23. Karthik Reddy
    December 20th, 2014

    Good material. Thannk you 9tut

  24. AMN
    December 25th, 2014

    Thank you 9tut , very good

  25. np
    December 26th, 2014

    Thanks u it help me a lot

  26. Vivek
    January 13th, 2015


  27. Sirigidi
    January 22nd, 2015

    Thanks, Well explained.

  28. Mohammad Mohsin
    February 9th, 2015


    What is the difference between Syslog & SNMP ?!
    While as both of them are doing the same thing.

    Please respond

  29. Eng.Sugule
    March 17th, 2015

    Thank you well illustrated.

  30. Stephen
    March 18th, 2015

    Wow this is very helpful! now I know! thanks 9tut!

  31. justin13
    March 22nd, 2015

    hello 9tut: cant locate the NETflow tutorial
    is there one?

  32. 9tut
    March 24th, 2015

    @justin13: We are sorry but currently we don’t have NetFlow tutorial. We will try to add it soon.

  33. eyemwired
    April 4th, 2015

    justin13, you can go to danscourses on youtube and he has them there

  34. mohamed Q
    April 21st, 2015

    thanks ;)

  35. 200-120
    April 25th, 2015

    @9tut please upload Net flow tutorial

  36. Nan
    June 3rd, 2015

    great job , thanks

  37. Iliyas
    June 27th, 2015


    Does the latest CCNA R & S syllabus contains syslogs?
    I am unable to find a syllabus online so it is hard to find out.

  38. Smith
    August 16th, 2015
  39. Sam
    August 19th, 2015

    You may also check out dumps at exams.eu.pn

  40. raposkyy
    August 21st, 2015

    10k God bless

  41. Jawwad
    August 22nd, 2015

    Great notes

  42. shaheer
    September 7th, 2015

    good inf

  43. sidd
    September 14th, 2015
  44. sidd
    September 14th, 2015
  45. Abdulhafiz
    September 29th, 2015

    Plz I need latest dumps send to my mail abdulhafizmatti2001@yahoo.com

  46. Dani
    October 8th, 2015

    i think there is a mistake here , cause according to Cisco the default severity for syslog is 7 , not 6 as you mentioned.
    reference : http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2950/software/release/12-1_19_ea1/configuration/guide/2950scg/swlog.html

  47. Dani
    October 8th, 2015

    i think there is a mistake here , cause according to Cisco the default severity level for syslog is 7 , not 6 as you mentioned.
    reference : http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2950/software/release/12-1_19_ea1/configuration/guide/2950scg/swlog.html

  48. franky
    October 9th, 2015

    hi Dani,
    I remember that the severity level is 6 information but not 7 debug.
    the levels are from 0 to 6, but not 1 to 7

  49. Dani
    October 14th, 2015

    @ franky
    actually, there are 8 severity levels for 0 to 7. and tut is right about that ,
    but could you please explain me why this answer :
    Question 5
    What is the default Syslog facility level?
    A. local4
    B. local5
    C. local6
    D. local7
    Answer: D

    October 22nd, 2015

    @ Dani: To understand the question 5, use the below link as a reference:


Comment pages
1 2 2162
Add a Comment