- Preface
- Overview
- Using the Command-Line Interface
- Configuring the Switch Alarms
- Performing Switch Setup Configuration
- Configuring Cisco IOS Configuration Engine
- Configuring Switch Clusters
- Performing Switch Administration
- Configuring PTP
- Configuring PROFINET
- Configuring CIP
- Configuring SDM Templates
- Configuring Switch-Based Authentication
- Configuring IEEE 802.1x Port-Based Authentication
- Configuring Web-Based Authentication
- Configuring SGT Exchange Protocol over TCP (SXP) and Layer 3 Transport
- Configuring Interface Characteristics
- Configuring Smartports Macros
- Configuring VLANs
- Configuring VTP
- Configuring Voice VLAN
- Configuring STP
- Configuring MSTP
- Configuring Optional Spanning-Tree Features
- Configuring Resilient Ethernet Protocol
- Configuring Flex Links and the MAC Address-Table Move Update Feature
- Configuring DHCP
- Configuring Dynamic ARP Inspection
- Configuring IP Source Guard
- Configuring IGMP Snooping and MVR
- Configuring Port-Based Traffic Control
- Configuring SPAN and RSPAN
- Configuring LLDP, LLDP-MED, and Wired Location Service
- Configuring CDP
- Configuring UDLD
- Configuring RMON
- Configuring System Message Logging
- Configuring SNMP
- Configuring Network Security with ACLs
- Configuring Standard QoS
- Configuring Auto-QoS
- Configuring EtherChannels
- Configuring Static IP Unicast Routing
- Configuring IPv6 Host Functions
- Configuring Link State Tracking
- Configuring IPv6 MLD Snooping
- Configuring Cisco IOS IP SLAs Operations
- Troubleshooting the Cisco IOS Software
- Working with the Cisco IOS File System, Configuration Files, and Software Images
Software Configuration Guide, Cisco IOS Release 15.2(2)E (Industrial Ethernet 2000 Switch)
Bias-Free Language
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
- Updated:
- October 2, 2020
Chapter: Configuring System Message Logging
- Finding Feature Information
- Restrictions for System Message Logging
- Information About System Message Logging
- How to Configure System Message Logging
- Disabling Message Logging
- Setting the Message Display Destination Device
- Synchronizing Log Messages
- Enabling and Disabling Time Stamps on Log Messages
- Enabling and Disabling Sequence Numbers in Log Messages
- Defining the Message Severity Level
- Limiting Syslog Messages Sent to the History Table and to SNMP
- Enabling the Configuration-Change Logger
Configuring System Message Logging
Finding Feature Information
Your software release may not support all the features documented in this chapter. For the latest feature information and caveats, see the release notes for your platform and software release.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Restrictions for System Message Logging
Information About System Message Logging
System Message Logging
By default, a switch sends the output from system messages and debug privileged EXEC commands to a logging process. The logging process controls the distribution of logging messages to various destinations, such as the logging buffer, terminal lines, or a UNIX syslog server, depending on your configuration. The process also sends messages to the console.
Note
The syslog format is compatible with 4.3 BSD UNIX.
When the logging process is disabled, messages are sent only to the console. The messages are sent as they are generated, so message and debug output are interspersed with prompts or output from other commands. Messages appear on the console after the process that generated them has finished.
You can set the severity level of the messages to control the type of messages displayed on the consoles and each of the destinations. You can time-stamp log messages or set the syslog source address to enhance real-time debugging and management. For information on possible messages, see the system message guide for this release.
You can access logged system messages by using the switch command-line interface (CLI) or by saving them to a properly configured syslog server. The switch software saves syslog messages in an internal buffer.
You can remotely monitor system messages by viewing the logs on a syslog server or by accessing the switch through Telnet or through the console port.
System Log Message Format
System log messages can contain up to 80 characters and a percent sign (%), which follows the optional sequence number or time-stamp information, if configured. Messages appear in this format:
seq no:timestamp: %facility-severity-MNEMONIC:description
The part of the message preceding the percent sign depends on the setting of the service sequence-numbers, service timestamps log datetime, service timestamps log datetime [ localtime ] [ msec ] [ show-timezone ], or service timestamps log uptime global configuration command.
|
|
|
|---|---|
Stamps log messages with a sequence number only if the service sequence-numbers global configuration command is configured. For more information, see the “Enabling and Disabling Sequence Numbers in Log Messages” section. |
|
Date and time of the message or event. This information appears only if the service timestamps log [ datetime | log ] global configuration command is configured. For more information, see the “Enabling and Disabling Time Stamps on Log Messages” section. |
|
The facility to which the message refers (for example, SNMP, SYS, and so forth). For a list of supported facilities, see Table 36-3. |
|
Single-digit code from 0 to 7 that is the severity of the message. For a description of the severity levels, see Table 36-2. |
|
Text string containing detailed information about the event being reported. |
Log Messages
You can synchronize unsolicited messages and debug privileged EXEC command output with solicited device output and prompts for a specific console port line or virtual terminal line. You can identify the types of messages to be output asynchronously based on the level of severity. You can also configure the maximum number of buffers for storing asynchronous messages for the terminal after which messages are dropped.
When synchronous logging of unsolicited messages and debug command output is enabled, unsolicited device output appears on the console or printed after solicited device output appears or is printed. Unsolicited messages and debug command output appears on the console after the prompt for user input is returned. Therefore, unsolicited messages and debug command output are not interspersed with solicited device output and prompts. After the unsolicited messages appear, the console again displays the user prompt.
Message Severity Levels
Note Specifying a level causes messages at that level and numerically lower levels to appear at the destination.
To disable logging to the console, use the no logging console global configuration command. To disable logging to a terminal other than the console, use the no logging monitor global configuration command. To disable logging to syslog servers, use the no logging trap global configuration command.
Table 36-2 describes the level keywords. It also lists the corresponding UNIX syslog definitions from the most severe level to the least severe level.
|
|
|
|
|
|---|---|---|---|
The software generates these categories of messages:
- Error messages about software or hardware malfunctions, displayed at levels warnings through emergencies. These types of messages mean that the functionality of the switch is affected. For information on how to recover from these malfunctions, see the system message guide for this release.
- Output from the debug commands, displayed at the debugging level. Debug commands are typically used only by the Technical Assistance Center.
- Interface up or down transitions and system restart messages, displayed at the notifications level. This message is only for information; switch functionality is not affected.
Configuring UNIX Syslog Servers
The next sections describe how to configure the UNIX server syslog daemon and how to define the UNIX system logging facility.
Logging Messages to a UNIX Syslog Daemon
Before you can send system log messages to a UNIX syslog server, you must configure the syslog daemon on a UNIX server. This procedure is optional.
Note Some recent versions of UNIX syslog daemons no longer accept by default syslog packets from the network. If this is the case with your system, use the UNIX man syslogd command to decide what options must be added to or removed from the syslog command line to enable logging of remote syslog messages.
Log in as root, and perform these steps:
Step 1 Add a line such as the following to the file /etc/syslog.conf:
The local7 keyword specifies the logging facility to be used; see Table 36-3 for information on the facilities. The debug keyword specifies the syslog level; see Table 36-2 for information on the severity levels. The syslog daemon sends messages at this level or at a more severe level to the file specified in the next field. The file must already exist, and the syslog daemon must have permission to write to it.
Step 2 Create the log file by entering these commands at the UNIX shell prompt:
Step 3 Make sure the syslog daemon reads the new changes:
For more information, see the man syslog.conf and man syslogd commands on your UNIX system.
Table 36-3 lists the UNIX system facilities supported by the software. For more information about these facilities, consult the operator’s manual for your UNIX operating system.
|
|
|
|---|---|
Default System Message Logging Configuration
|
|
|
|---|---|
Debugging (and numerically lower levels; see Table 36-2). |
|
Local7 (see Table 36-3). |
|
Informational (and numerically lower levels; see Table 36-2). |
How to Configure System Message Logging
Disabling Message Logging
Message logging is enabled by default. It must be enabled to send messages to any destination other than the console. When enabled, log messages are sent to a logging process, which logs messages to designated locations asynchronously to the processes that generated the messages.
Disabling the logging process can slow down the switch because a process must wait until the messages are written to the console before continuing. When the logging process is disabled, messages appear on the console as soon as they are produced, often appearing in the middle of command output.
|
|
|
|
|---|---|---|
Setting the Message Display Destination Device
If message logging is enabled, you can send messages to specific locations in addition to the console. Beginning in privileged EXEC mode, use one or more of the following commands to specify the locations that receive messages:
|
|
|
|
|---|---|---|
Logs messages to an internal buffer on the switch. The range is 4096 to 2147483647 bytes. The default buffer size is 4096 bytes. If the switch fails, the log file is lost unless you had previously saved it to flash memory. See Step 4. Note Do not make the buffer size too large because the switch could run out of memory for other tasks. Use the show memory privileged EXEC command to view the free processor memory on the switch. However, this value is the maximum available, and the buffer size should not be set to this amount. |
||
Logs messages to a UNIX syslog server host. host— Specifies the name or IP address of the host to be used as the syslog server. To build a list of syslog servers that receive logging messages, enter this command more than once. |
||
logging file flash: filename [ max-file-size [ min-file-size ]] [ severity-level-number | type ] |
Stores log messages in a file in flash memory.
|
|
Logs messages to a nonconsole terminal during the current session. Terminal parameter-setting commands are set locally and do not remain in effect after the session has ended. You must perform this step for each session to see the debugging messages. |
Synchronizing Log Messages
Enabling and Disabling Time Stamps on Log Messages
Enabling and Disabling Sequence Numbers in Log Messages
Because there is a chance that more than one log message can have the same time stamp, you can display messages with sequence numbers so that you can unambiguously see a single message. By default, sequence numbers in log messages are not displayed.
|
|
|
|
|---|---|---|
Defining the Message Severity Level
You can limit messages displayed to the selected device by specifying the severity level of the message, which are described in Table 36-2 .
Limiting Syslog Messages Sent to the History Table and to SNMP
If you enabled syslog message traps to be sent to an SNMP network management station by using the snmp-server enable trap global configuration command, you can change the level of messages sent and stored in the switch history table. You also can change the number of messages that are stored in the history table.
Messages are stored in the history table because SNMP traps are not guaranteed to reach their destination. By default, one message of the level warning and numerically lower levels (see Table 36-2) are stored in the history table even if syslog traps are not enabled.
When the history table is full (it contains the maximum number of message entries specified with the logging history size global configuration command), the oldest message entry is deleted from the table to allow the new message entry to be stored.
Enabling the Configuration-Change Logger
You can enable a configuration logger to keep track of configuration changes made with the command-line interface (CLI). When you enter the logging enable configuration-change logger configuration command, the log records the session, the user, and the command that was entered to change the configuration. You can configure the size of the configuration log from 1 to 1000 entries (the default is 100).
Configuring the UNIX System Logging Facility
When sending system log messages to an external device, you can cause the switch to identify its messages as originating from any of the UNIX syslog facilities.
|
|
|
|
|---|---|---|
Logs messages to a UNIX syslog server host by entering its IP address. To build a list of syslog servers that receive logging messages, enter this command more than once. |
||
Limits messages logged to the syslog servers. Be default, syslog servers receive informational messages and lower. See Table 36-2 for level keywords. |
||
Configures the syslog facility. See Table 36-3 for facility-type keywords. |
||
Monitoring and Maintaining the System Message Log
|
|
|
|---|---|
Configuration Examples for the System Message Log
System Message: Example
This example shows a partial switch system message:
Logging Display: Examples
This example shows part of a logging display with the service timestamps log datetime global configuration command enabled:
This example shows part of a logging display with the s ervice timestamps log uptime global configuration command enabled:
This example shows part of a logging display with sequence numbers enabled:
Enabling the Logger: Example
This example shows how to enable the configuration-change logger and to set the number of entries in the log to 500.
Configuration Log Output: Example
This is an example of output for the configuration log:
Additional References
The following sections provide references related to switch administration:
Related Documents
|
|
|
|---|---|
Cisco IOS basic commands |
|
Standards
|
|
|
|---|---|
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature. |
MIBs
|
|
|
|---|---|
To locate and download MIBs, use the Cisco MIB Locator found at the following URL: https://cfnng.cisco.com/mibs |
RFCs
|
|
|
|---|---|
No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature. |
Feedback