Syslog provides a structured record of device and application events for real-time observation, local history, and centralized troubleshooting. Unlike SNMP, which emphasizes polled quantitative metrics and event alerts, Syslog preserves descriptive sequences of events. section 7.0
The Cisco-oriented format is `seq:timestamp: %facility-severity-mnemonic: description`. Sequence numbers and timestamps are optional, so messages may omit one or both components. section 7.2.1 section 7.3
Read the message from left to right:
- Sequence number identifies message order when `service sequence-numbers` is enabled; it applies only to subsequently generated messages. section 7.2.1
- Timestamp records when the event occurred; `service timestamps log datetime` uses the date and time, while `uptime` uses time since boot. section 7.2.1
- The percent-prefixed code contains a facility, numeric severity, and mnemonic; Cisco IOS severity values run from 0 to 7, with lower values more severe. section 7.2.2 section 7.3
- The description states the operational event, such as an interface transition, login, or configuration change. section 7.1 section 7.1.3
Parsing an interface event
In `Sep 18 00:54:27.832: %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to down`, the timestamp identifies the event time, `LINK` is the facility, `3` is the severity, `UPDOWN` is the mnemonic, and the remainder describes the interface transition. section 7.2.2
Sep 18 00:54:27.832: %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to down
Use the complete listing to identify the timestamp, percent-prefixed facility/severity/mnemonic code, and event description. section 7.1
Cisco IOS can display messages on the console or VTY lines, retain them in the RAM logging buffer, or send them to a Syslog server. Use `show logging` to inspect destinations, severity thresholds, and buffered messages. VTY users must issue `terminal monitor` for each session. section 7.1.1 section 7.1.3 section 7.3
