Infrastructure Services · Topic 3 of 6
Logging, Debugging and Telemetry
Troubleshoot using local and syslog logging, severity levels, timestamps, debugs, conditional debugs and an intro to model driven telemetry on IOS XE.
- 4 min
- Severity runs from 0, emergencies, to 7, debugging.
- A level setting includes all more severe levels.
- Syslog uses UDP 514 by default.
What it is
Logging records what a device is doing, and debugging shows protocol events live, so you can find the cause of a fault.
Log messages carry a severity level and a time. They can go to the console, to a buffer in memory, to a terminal session or to a remote syslog server.
Telemetry is a newer way to send operational data from the device to a collector without the collector asking each time.
How it works
Pick the right destination and level first, then add timestamps, and use debugs with care.
Severity levels
| Level | Name |
|---|---|
| 0 | Emergencies |
| 1 | Alerts |
| 2 | Critical |
| 3 | Errors |
| 4 | Warnings |
| 5 | Notifications |
| 6 | Informational |
| 7 | Debugging |
A lower number is more severe. Setting a destination to a level shows that level and all more severe ones.
For example, level 4 shows levels 0 to 4. Debug output is level 7.
Logging destinations
R1(config)# logging buffered 16384 informational
R1(config)# logging console warnings
R1(config)# logging host 10.1.1.60
R1(config)# logging trap informational
R1(config)# logging source-interface Loopback0
R1# show logging
R1# terminal monitorEach command sets one destination.
logging bufferedkeeps messages in memory, andshow loggingdisplays them. The buffer is cleared at reload.logging hostsends messages to a syslog server, which uses UDP port 514 by default.logging trapsets the level sent to the server.terminal monitorshows messages on a Telnet or SSH session, as the console does by default.
A logging source-interface makes the router use a stable address that the server expects.
Timestamps
Messages without time stamps are hard to correlate. Turn timestamps on for both log messages and debug output.
R1(config)# service timestamps log datetime msec localtime show-timezone
R1(config)# service timestamps debug datetime msec localtime show-timezone
R1(config)# service sequence-numbersTimestamps are only useful if the clock is right. Use NTP so that logs from several devices line up.
Debugs
A debug prints detailed events from a process, such as OSPF adjacency steps. It uses CPU and can flood the console on a busy router.
R1# debug ip ospf adj
R1# show debugging
R1# undebug allUse undebug all to stop all debugging at once. Use show debugging to see what is running. Send output to the buffer rather than the console on a busy router, and avoid debug ip packet without a filter.
Conditional debugs
A conditional debug limits output to one interface, user or other condition. You set the condition first, then turn on the debug.
R1# debug condition interface GigabitEthernet0/0
R1# show debug condition
R1# undebug allAfter the condition is set, turn on the debug you need. The condition applies only to debugs that support it, so confirm the output is limited before you rely on it.
For debug ip packet, an ACL is the usual filter. In debug ip packet 101 detail, ACL 101 selects the traffic to show.
Telemetry
Telemetry pushes data from a device to a collector. On IOS XE this is model driven telemetry, which uses YANG data models.
A subscription says what data to send, how often or on change, and where to send it. This differs from SNMP polling, where the manager asks each time. Streaming can give finer detail than polling at long intervals.
R1# show telemetry ietf subscription allThis command lists the subscriptions and their state. For the exam, know the idea of push against pull, and that the data model is YANG.
Use the buffer for logging during troubleshooting and turn the console level down, because heavy console output can slow a router.
What to remember for the exam
Eight facts cover most questions on this topic.
- Severity runs from 0, emergencies, to 7, debugging.
- A level setting includes all more severe levels.
- Syslog uses UDP 514 by default.
show loggingshows the buffer, and the buffer is lost at reload.terminal monitorshows messages on a remote session.service timestamps log datetime msecadds timestamps to logs.undebug allstops all debugging.- Telemetry pushes data to a collector, and SNMP polling pulls it.
An unfiltered debug on a production router can cause a CPU spike, so use conditions or an ACL and turn debugging off when finished.
Common mistakes
These five mistakes appear often.
Wrong severity. A trap level of errors never sends informational messages.
No timestamps. Events from different devices cannot be matched.
Forgetting terminal monitor. Debug output does not show on an SSH session.
Leaving debug on. Output continues and uses CPU long after the test.
Wrong logging source. The syslog server ignores messages from an unknown address.
Check yourself
Work through these three questions.
What does
logging trap warningsdo?It sends messages of level 4 and more severe to the syslog server.
How do you limit a debug to one interface?
Set a condition such as
debug condition interface GigabitEthernet0/0before you turn on the debug.How does telemetry differ from SNMP polling?
Telemetry pushes data to the collector by subscription, while SNMP polling relies on the manager asking each time.
Topic 3 of 6 in Infrastructure Services
Test yourself on Infrastructure Services
The full Cisco CCNP 300-410 ENARSI question bank has 857 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.