PDF

About Syslog

Updated: April 15, 2026

Want to summarize with AI?

Log in

Describes how syslog messages are generated and delivered in Cisco ACI systems. Provides context for monitoring faults, events, and user actions through system log messages for troubleshooting and auditing.

A syslog message is a system log entry generated by the Cisco ACI system to record faults, events, audit logs, or session logs.

  • Syslog messages can be sent to the console, a local file, or a remote logging server.

  • Each message contains information about the fault or event, and may include audit or session log entries.

  • Syslog sources are objects with monitoring policies, and destinations are configurable with severity levels.

Syslog Message Types and Configuration

Syslog messages are specific to user actions or objects being configured or administered.

  • Informational messages provide assistance and tips about the action being performed.

  • Warning messages provide information about system errors related to objects such as user accounts or service profiles.

To receive and monitor syslog messages, specify a destination (console, local file, or remote host) and set the minimum severity level. The local file for syslog messages is /var/log/external/messages .

  1. Specify syslog destination.

  2. Set minimum severity level for messages.

  3. Configure items to be included in syslog messages.

Syslog messages can be displayed in NX-OS style format.

  • Item: Syslog source — Any object with an object monitoring policy.

  • Item: Syslog destination — Console, local file, or remote host.

Note

Not all system log messages indicate problems. Some are informational, while others help diagnose issues with communications lines, hardware, or software.

For a list of syslog messages generated by APIC and fabric nodes, see Cisco ACI System Messages Reference Guide . Additional details about faults and events are described in the Cisco APIC Faults, Events, and System Messages Management Guide , and system log messages are listed in the Cisco ACI System Messages Reference Guide .

Create a syslog destination and destination group

This task allows you to configure syslog data destinations for logging and evaluation purposes, enabling the export of syslog data to multiple destination types including console, local files, and remote syslog servers organized in destination groups.

This procedure configures syslog data destinations for logging and evaluation. You can export syslog data to the console, to a local file, or to one or more syslog servers in a destination group.

Procedure

  1. In the menu bar, click Admin.

  2. In the submenu bar, click External Data Collectors.

  3. In the Navigation pane, expand Monitoring Destinations.

  4. Right-click Syslog and choose Create Syslog Monitoring Destination Group.

  5. In the Create Syslog Monitoring Destination Group dialog box, perform these actions:

    1. In the group and profile Name field, enter a name for the monitoring destination group and profile.
    2. In the group and profile Format field, choose the format for Syslog messages.

      The default is ACI, or the RFC 3164 compliant message format, but you can choose to set it to the NX-OS style format instead.

    3. In the group and profile Admin State drop-down list, choose enabled.
    4. To enable sending of syslog messages to a local file, choose enabled from the Local File Destination Admin State drop-down list and choose a minimum severity from the Local File Destination Severity drop-down list.

      The local file for receiving syslog messages is /var/log/external/messages.

    5. To enable sending of syslog messages to the console, choose enabled from the Console Destination Admin State drop-down list and choose a minimum severity from the Console Destination Severity drop-down list.
    6. Click Next.
    7. In the Create Remote Destinations area, click + to add a remote destination.
    Caution

    There is a risk of hostname resolution failure for remote syslog destinations if the DNS server that you specify is configured to be reachable over in-band connectivity. To avoid the issue, configure the syslog server using the IP address, or if you use a hostname, ensure that the DNS server is reachable over an out-of-band interface.

  6. In the Create Syslog Remote Destination dialog box, perform these actions:

    1. In the Host field, enter an IP address or a fully qualified domain name for the destination host.
    2. Optional: In the Name field, enter a name for the destination host.
    3. In the Admin State field, click the enabled radio button.
    4. Optional: Choose a minimum severity Severity, a Port number, and a syslog Facility.

      The Facility is a number that you can optionally use to indicate which process generated the message, and can then be used to determine how the message will be handled at the receiving end.

    5. In the Transport field, choose the transport protocol to use for the messages.

      SSL enables a Cisco ACI switch (acting as a client) to make a secure, encrypted outbound connection to remote syslog servers (acting as a server) supporting secure connectivity for logging. With authentication and encryption, this feature allows for a secure communication over an insecure network.

      You must also upload the necessary SSL certificate if you select SSL as the transport protocol to use for the messages. You can upload the necessary SSL certificate by navigating to the Create Certificate Authority window: For the procedure, see Create Syslog Certificate Authority.

      The default option for the transport protocol is udp.

    6. If you chose SSL or tcp for transport, then enter a value for the Keep Alive Interval field that is between 300 seconds and 7200 seconds. The default value is 7200 seconds.

      If the connection remains idle for an amount of time equal to the Keep Alive Interval, then the Cisco syslog client sends a keepalive packet to the server to keep the connection open.

    7. From the Management EPG drop-down list, choose the management endpoint group.
    8. Click OK.

  7. To add more remote destinations to the remote destination group, click + again and repeat the steps in the Create Syslog Remote Destination dialog box

  8. Click Finish.

The syslog destination and destination group are created and configured according to your specifications. Syslog messages will be sent to the configured destinations based on the severity levels and transport protocols you selected.

Create Syslog Certificate Authority

Follow this procedure to create the necessary SSL certificate by navigating to the Create Certificate Authority window:

Procedure

  1. In the menu bar, click Admin > AAA.

  2. In the navigation pane, click Security.

  3. Choose the Certificate Authorities tab.

  4. Then, choose Actions > Create Certificate Authority.

  5. Fill out the fields and click Save.

Create a syslog source

Create a syslog source to enable system log message monitoring for specific managed objects in your network infrastructure.

A syslog source can be any object for which an object monitoring policy can be applied.

Before you begin

Create a syslog monitoring destination group.

Follow these steps to create a syslog source:

Procedure

  1. From the menu bar and the navigation frame, navigate to a Monitoring Policies menu for the area of interest.

    You can configure monitoring policies for tenants, fabric, and access.

  2. Expand Monitoring Policies, then select and expand a monitoring policy.

    Under Fabric > Fabric Policies > Monitoring Policies > Common Policy is a basic monitoring policy that applies to all faults and events and is automatically deployed to all nodes and controllers in the fabric. Alternatively, you can specify an existing policy with a more limited scope.

  3. Under the monitoring policy, click Callhome/SNMP/Syslog.

  4. In the Work pane, choose Syslog from the Source Type drop-down list.

  5. From the Monitoring Object list, choose a managed object to be monitored.

    If the desired object does not appear in the list, follow these steps:

    1. Click the Edit icon to the right of the Monitoring Object drop-down list.
    2. From the Select Monitoring Package drop-down list, choose an object class package.
    3. Select the checkbox for each object that you want to monitor.
    4. Click Submit.

  6. In a tenant monitoring policy, if you select a specific object instead of All, a Scope selection appears.

    In the Scope field, select a radio button to specify the system log messages to send for this object:

    • all—Send all events and faults related to this object

    • specific event—Send only the specified event related to this object. From the Event drop-down list, choose the event policy.

    • specific fault—Send only the specified fault related to this object. From the Fault drop-down list, choose the fault policy.

  7. Click + to create a syslog source.

  8. In the Create Syslog Source dialog box, perform these actions:

    1. In the Name field, enter a name for the syslog source.
    2. From the Min Severity drop-down list, choose the minimum severity of system log messages to be sent.
    3. In the Include field, check the checkboxes for the type of messages to be sent.
    4. From the Dest Group drop-down list, choose the syslog destination group to which the system log messages will be sent.
    5. Click Submit.

  9. To add more syslog sources, click + again and repeat the steps in the Create Syslog Source dialog box

The syslog source is created and configured to monitor the specified managed objects and send system log messages to the designated syslog destination group.