IP Services · Topic 5 of 9

Syslog Facilities and Severity Levels

Learn how syslog messages are built, what the eight severity levels mean, what a facility is, and how a Cisco device sends logs to a console or server.

  • 4 min
  • Exam objective 4.5
In a nutshell
  • Severity runs from 0 (emergencies) to 7 (debugging), and lower is more serious.
  • A level setting includes that level and all more severe levels.
  • Level 4 is warnings, level 6 is informational, and level 7 is debugging.

What it is

Syslog is how network devices report what is happening to them.

Each notable event, such as an interface change or a failed login, produces a short text message. Syslog decides where that message goes.

A device can send messages to several places:

  • the console, the local management port
  • a terminal session, when monitoring is turned on
  • the buffer, memory on the device that holds recent messages
  • a syslog server, a central system that collects logs from many devices

Syslog servers listen on UDP port 514 by default. Central collection matters because a device that fails or reboots can lose the messages in its own memory.

Two ideas organise each message. The severity level says how serious it is. The facility says what part of the system produced it.

How it works

Every message carries a severity from 0 to 7, and the lowest number is the most serious.

Eventlink goes downseverity 3 errorRouterlogging trap warningslevel 4 or lower passesSyslog serverUDP 514Eventconfig savedseverity 5 notificationRouterlogging trap warningsblocked, level is above 4Dropped for the server

Severity levels

LevelNameMeaning in short
0EmergenciesSystem is unusable
1AlertsAct immediately
2CriticalCritical condition
3ErrorsError condition
4WarningsWarning condition
5NotificationsNormal but significant event
6InformationalRoutine information
7DebuggingDetailed debug output

A memory aid: Every Awesome Cisco Engineer Will Need Icecream Daily.

A logging level includes that level and every lower number. Level 4 shows warnings, errors, critical, alerts and emergencies. Level 7 shows everything.

Exam tip

Level 7 is not the most serious. It is the most detailed. Level 0 is the most serious.

Facilities in the message

Look at a typical message:

%LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down

Read it in three pieces separated by hyphens:

  • LINK is the facility, the subsystem that produced the message.
  • 3 is the severity, here errors.
  • UPDOWN is the mnemonic, a short code for the event.

Other common facilities are LINEPROTO, SYS and OSPF.

Facilities in the protocol

When a message goes to a server, it also carries a facility value the server can use to sort it. These come from a standard list that includes local0 to local7. A Cisco device uses local7 by default.

logging facility local4

The server can then file messages from different devices separately.

Basic configuration

logging host 10.1.1.60
logging trap warnings
logging buffered 16384
logging console informational
service timestamps log datetime msec
  • logging host sends messages to a syslog server.
  • logging trap sets the minimum severity sent to the server.
  • logging buffered stores messages in memory with a chosen size.
  • logging console sets the level shown on the console.
  • service timestamps adds the time to each message.
Watch out

logging trap has nothing to do with SNMP traps. On a Cisco device it controls the severity sent to a syslog server.

Defaults differ by destination:

  • The console and terminal lines default to debugging.
  • The syslog server threshold (logging trap) defaults to informational.
  • Buffered logging is off until you configure it, and then defaults to debugging.

Set the levels yourself to be safe.

Use show logging to see the buffer and settings. On a remote session, run terminal monitor to see messages live.

What to remember for the exam

Eight facts matter here.

  • Severity runs from 0 (emergencies) to 7 (debugging), and lower is more serious.
  • A level setting includes that level and all more severe levels.
  • Level 4 is warnings, level 6 is informational, and level 7 is debugging.
  • A message has the form %FACILITY-SEVERITY-MNEMONIC: text.
  • The facility names the source in the message and labels messages sent to a server.
  • Syslog servers use UDP port 514.
  • logging host, logging trap, logging buffered and logging console set the destinations.
  • show logging shows settings and the buffer.

Common mistakes

These five traps are common.

Reading the numbers backwards. Level 7 is the most detailed, not the most serious.

Forgetting levels are inclusive. Setting a level shows that level and everything more severe.

Confusing facility with severity. In %LINK-3-UPDOWN, the facility is LINK and the severity is 3.

Thinking logging trap means SNMP. It sets the syslog server threshold.

Running level 7 on a busy device. Debug output can flood the console and slow the device.

Check yourself

Work through these three prompts.

  • What do the three parts of %SYS-5-CONFIG_I represent?

    SYS is the facility, 5 is the severity (notifications), and CONFIG_I is the mnemonic, a short code for the event.

  • How does a logging level of 4 differ from a level of 7 in which messages each hides?

    Level 4 shows warnings and more severe messages, so it hides levels 5 to 7. Level 7 shows everything, so it hides nothing.

  • Name two places a message can be sent or stored, and why does a central server help?

    For example the buffer and a syslog server. A central server helps because a device that fails or reboots can lose the messages in its own memory.

Topic 5 of 9 in IP Services

Test yourself on IP Services

The full Cisco CCNA 200-301 question bank has 1,206 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.