A Syslog message is a structured event record generated by a device or service to report an occurrence or status change. Cisco IOS can display messages in real time, store them in the local logging buffer, or send them to a centralized Syslog server. section 7.1 section 7.3
The standard Cisco IOS format is seq:timestamp: %facility-severity-mnemonic: description. Sequence numbers and timestamps are optional; facility identifies the generating service, severity indicates urgency with lower values being more severe, mnemonic identifies the event, and description supplies its details. section 7.2 section 7.2.1
Configure and verify Syslog behavior with these Cisco IOS controls:
- Enable sequence numbers with service sequence-numbers; the setting affects future messages only. section 7.2.1
- Choose service timestamps log datetime or uptime; datetime identifies event time, while uptime records time since boot. Add localtime or msec when required. section 7.2.1
- View buffered messages with show logging. Control console, VTY, and RAM-buffer delivery with logging console, logging monitor, and logging buffered [bytes]. section 7.3
- For centralized logging, specify logging [host] ip-address and control server delivery with logging trap. Standard Syslog uses UDP 514; Syslog over TLS uses TCP 6514. section 7.3
Reading an interface event
000065: Sep 19 01:01:01.133: %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to down. The sequence is 000065, facility is LINK, severity is 3, mnemonic is UPDOWN, and the description identifies the affected interface and state change. section 7.2
000065: Sep 19 01:01:01.133: %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to down
Inspect the complete Cisco IOS message layout, including its optional sequence number and timestamp. section 7.2
