Cisco – logging process

This post contains quick notes about logging system on Cisco devices.

Quick notes

  1. by default, all log messages are managed by logging process (and it is not recommended to disable it for performance reason – in this case the log messages would be flushed into console without any control). Disabling process command: dev> no logging on
  2. logging process takes care for distributing log messages to:
    • console; enabled by default
    • terminal (telnet/ssh)
    • buffer (internal memory); enabled by default; RAM memory (log is lost when device is restarted)
    • external Log server
  3. use dev> terminal monitor command from your telnet/ssh terminal to log messages into your terminal direct (for this session only)
  4. Use this commands to setup local timestamp into log messages.
    service timestamps log datetime localtime msec show-timezone year
    service timestamps debug datetime localtime msec show-timezone year
  5. severity levels:
      emergencies        System is unusable                (severity=0)
      alerts             Immediate action needed           (severity=1)
      critical           Critical conditions               (severity=2)
      errors             Error conditions                  (severity=3)
      warnings           Warning conditions                (severity=4)
      notifications      Normal but significant conditions (severity=5)
      informational      Informational messages            (severity=6)
      debugging          Debugging messages                (severity=7)
    

Examples

Here is exemplary session from the Cisco switch. I am connected with Console cable and with telnet session. I unplug the cable and play with different logging levels for both Console and terminal.

win-xserw001#terminal monitor // log messages on current telnet session
win-xserw001# // unpulug cable

------------------------------- CONSOLE LOG:
.Jan  4 13:59:26.187: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/22, changed state to down
.Jan  4 13:59:27.191: %LINK-3-UPDOWN: Interface FastEthernet0/22, changed state to down
------------------------------- TERMINAL LOG:
win-xserw001(config)#
.Jan  4 13:59:26.187: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/22, changed state to down
.Jan  4 13:59:27.191: %LINK-3-UPDOWN: Interface FastEthernet0/22, changed state to down


win-xserw001(config)#logging console 4


------------------------------- CONSOLE LOG:
.Jan  4 14:01:45.579: %LINK-3-UPDOWN: Interface FastEthernet0/22, changed state to down
------------------------------- TERMINAL LOG:
.Jan  4 14:01:44.575: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/22, changed state to down
.Jan  4 14:01:45.579: %LINK-3-UPDOWN: Interface FastEthernet0/22, changed state to down


win-xserw001(config)#logging console // return to default console logging level (debug)
win-xserw001(config)#logging monitor 4


------------------------------- CONSOLE LOG:
.Jan  4 14:04:31.183: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/22, changed state to down
.Jan  4 14:04:32.187: %LINK-3-UPDOWN: Interface FastEthernet0/22, changed state to down
------------------------------- TERMINAL LOG:
.Jan  4 14:04:32.187: %LINK-3-UPDOWN: Interface FastEthernet0/22, changed state to down

This example shows how to change buffered log size [RAM] and display current logging levels settings.

win-xserw001(config)#logging buffered 7483647 // change the size of buffered log [RAM]
win-xserw001#show logging

Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)

No Active Message Discriminator.
No Inactive Message Discriminator.

    Console logging: level debugging, 38 messages logged, xml disabled,
                     filtering disabled
    Monitor logging: level warnings, 32 messages logged, xml disabled,
                     filtering disabled
    Buffer logging:  level debugging, 3 messages logged, xml disabled,
                    filtering disabled
    Exception Logging: size (4096 bytes)
    Count and timestamp logging messages: disabled
    File logging: disabled
    Persistent logging: disabled
    Trap logging: level informational, 51 message lines logged

Log Buffer (7483647 bytes):

(...)

Log to local (flash:) file example – in this configuration messages are logged into mylog file. In the following configuration, when file exceeds 4096 bytes then it is truncated to 2048 bytes (and so on…)

win-xserw001#mkdir log
Create directory filename [log]?
Created dir flash:log
win-xserw001#conf t
win-xserw001(config)#logging file flash:/log/mylog 4096 2048 debugging

win-xserw001#more flash:/log/mylog
*Mar  1 00:13:19.811: %LINK-3-UPDOWN: Interface FastEthernet0/22, changed state to down
*Mar  1 00:13:23.807: %LINK-3-UPDOWN: Interface FastEthernet0/22, changed state to up
win-xserw001#

This example shows how to log into external syslog server with severity level warning.

win-xserw001(config)#logging host 10.0.0.101
win-xserw001(config)#logging trap warnings

Leave a Reply

Your email address will not be published. Required fields are marked *