Syslog Commands

This chapter contains the following sections:

• clear logging, on page 1
• log aggregation on, on page 2
• logging aggregation aging-time, on page 2
• logging host, on page 3
• logging on, on page 4
• logging severity, on page 5
• show logging, on page 6

clear logging
To clear the log messages from the internal logging buffer, use the clear logging Privileged EXEC mode
command.

Syntax
clear logging {buffered | file}

Parameters
buffered—Clears the log messages stored in RAM.
file—Clears the log messages stored in flash.

Command Mode
Privileged EXEC mode

Example
The following example clears the log messages stored in RAM:
switchxxxxxx# clear logging buffered

Syslog Commands
1
 Syslog Commands
log aggregation on

log aggregation on
To control aggregation of SYSLOG messages, use the logging aggregation on Global Configuration mode
command. If aggregation is enabled, logging messages are displayed every time interval (according to the
aging time specified by logging aggregation aging-time).To disable aggregation of SYSLOG messages, use
the no form of this command.

Syntax
logging aggregation on
no logging aggregation on

Parameters

This command has no arguments or keywords.

Default Configuration
Disabled

Command Mode
Global Configuration mode

Example
To turn off aggregation of SYSLOG messages:
switchxxxxxx(config)#no logging aggregation on

logging aggregation aging-time

To configure the aging time of the aggregated SYSLOG messages, use the logging aggregation aging-time
Global Configuration mode command. The SYSLOG messages are aggregated during the time interval set
by the aging-time parameter. To return to the default, use the no form of this command.

Syntax
logging aggregation aging-time sec
no logging aggregation aging-time

Parameters
aging-time—Aging time in seconds (Range: 15–3600).

Default Configuration
300 seconds

Syslog Commands
2
 Syslog Commands
logging host

Command Mode
Global Configuration mode

Example
switchxxxxxx(config)#logging aggregation aging-time 300

logging host
To define a remote SYSLOG server where log messages are sent (using the SYSLOG protocol), use the
logging host Global Configuration mode command.
To delete a SYSLOG server, use the no form of this command.

Syntax
logging host {ipv4-address | ipv6-address | hostname} [facility facility] [port port] [severity severity_level]
no logging host {ip-address | ipv6-address | hostname}

Parameters
ipv4-address—IPv4 address of the SYSLOG server.
ipv6-address—IPv6 address of the SYSLOG server.
hostname—Hostname of the SYSLOG server. Only translation to IPv4 addresses is supported.
facility facility—(Optional) Specifies the log facility that is indicated in the message. It can be one of the
following values: local0, local1, local2, local3, local4, local5, local 6, and local7. The default is local7.
port port—(Optional) Specifies the port number for SYSLOG messages. The default port number is 514.
(Range: 0 to 65535)
severity level—(Optional) Specifies the severity of log messages sent to the SYSLOG server. The optional
severity levels are:
<0-7> Minimum severity <0-7> (EMEGR-DEBUG)
emergencies System is unusable
alerts Immediate action needed (severity=1)
critical Critical conditions (severity=2)
errors Error conditions (severity=3)
warnings Warning conditions (severity=4)
notifications Normal but significant conditions (severity=5)
informational Informational messages (severity=6)
debugging Debugging messages (severity=7)

Default Configuration
No messages are logged to a SYSLOG server.

Syslog Commands
3
 Syslog Commands
logging on

The default severity level is Informational.

Command Mode
Global Configuration mode

User Guidelines
You can specify multiple SYSLOG servers.

Example
switchxxxxxx(config)# logging host 1.1.1.121
switchxxxxxx(config)# logging host 3000::100
switchxxxxxx(config)# logging host SYSLOG1

logging on
To enable logging on the switch, use the logging on Global Configuration mode command.
To disable logging on the switch, use the no form of this command.

Syntax
logging on
no logging on

Parameters
N/A

Default Configuration
Message logging is enabled.

Command Mode
Global Configuration mode

User Guidelines
This command sends debug or error messages asynchronously to the designated locations.
The logging process controls the logging message distribution at various destinations, such as the logging
buffer, logging file, or SYSLOG server. Logging on and off at these destinations can be individually configured
using the logging console, logging buffered, logging file, and logging host Global Configuration mode
commands.
However, if logging is disabled, no messages are sent to these destinations. Only the console receives the
error messages.

Example
The following example enables logging on the switch:

Syslog Commands
4
 Syslog Commands
logging severity

switchxxxxxx(config)# logging on

logging severity
To set the severity level for error messages that are logged to RAM or flash, use the logging severity Global
Configuration mode command.

Syntax
logging {buffered | console | file} severity [severity_level]

Parameters
buffered—Stores the messages in the RAM.
console—Stores the messages on the console.
file—Stores the messages in flash memory.
severity_level—(Optional) The severity level of messages logged in the buffer. The optional severity levels
are:
<0-7> Minimum severity <0-7> (EMEGR-DEBUG)
emergencies - System is unusable
alerts - Immediate action needed (severity=1)
critical - Critical conditions (severity=2)
errors - Error conditions (severity=3)
warnings - Warning conditions (severity=4)
notifications - Normal but significant conditions (severity=5)
informational - Informational messages (severity=6)
debugging - Debugging messages (severity=7)

Default Configuration
The default severity level is informational.

Command Mode
Global Configuration mode

User Guidelines
All SYSLOG messages are logged to the internal buffer. This command limits the messages displayed to the
user.

Example
The following example sets the severity level for logging messages to RAM and flash as debugging:
switchxxxxxx(config)# logging buffered severity 7

Syslog Commands
5
 Syslog Commands
show logging

show logging
To display the logging status and SYSLOG messages stored in the internal buffer, use the show logging
Privileged EXEC mode command.

Syntax
show logging [buffered | file]

Parameters
buffered—(Optional) Displays the log messages stored in the RAM.
file—(Optional) Displays the log messages stored in flash memory.

Default Configuration
N/A

Command Mode
Privileged EXEC mode

Example
Example 1—The following example displays the logging status:
switchxxxxxx# show logging
Logging service is enabled
Console Logging: level notice
Buffer Logging : level info
File Logging : disabled
Buffer Logging
--------------
*Jan 01 2000 08:04:42: AAA-5: New console connection for user cisco, source async ACCEPTED
*Jan 01 2000 08:01:21: STP-6: GigabitEthernet13 STP port state is set to Forwarding
*Jan 01 2000 08:01:07: STP-6: GigabitEthernet13 STP port state is set to Learning
*Jan 01 2000 00:00:50: System-5: System Startup!
*Jan 01 2000 00:00:50: System-5: Logging is enabled

The following table describes the significant fields shown in the example:

Field Description

TARGET Where the log messages are stored.

STATUS Shows whether RAM memory logging or flash

memory logging is enabled or disabled.

Server (PORT) Server address and port number for SYSLOG

messages.

FACILITY What kind of events are logged.

LOG LEVEL Severity level of messages to be logged.

Syslog Commands
6
Syslog Commands
show logging

Example 2—The following example shows information of the SYSLOG messages stored in the RAM:
switchxxxxxx# show logging buffered
Log messages in buffered
NO.| Timestamp | Category | Severity | Message
---------------------+----------------+----------+----------------------------------------
1| Jan 01 14:31:24| AAA| info| User 'cisco' enter privileged mode from
console with level '15' success
2| Jan 01 14:31:22| AAA| info| User 'cisco' is authorized with privilege
level 15
3| Jan 01 14:31:22| AAA| info| User 'cisco' login from console success
4| Jan 01 14:20:40| AAA| info| User 'cisco' enter privileged mode from
telnet with level '15' success
5| Jan 01 14:20:38| AAA| info| User 'cisco' is authorized with privilege
level 15
6| Jan 01 14:20:38| AAA| info| User 'cisco' login from telnet success
7| Jan 01 00:30:43| AAA| info| User 'cisco' enter privileged mode from
telnet with level '15' success
8| Jan 01 00:30:36| AAA| info| User 'cisco' is authorized with privilege
level 15
9| Jan 01 00:30:36| AAA| info| User 'cisco' login from telnet success
10| Jan 01 00:00:55| STP| info| Port 1 STP port state is set to Forwarding

11| Jan 01 00:00:40| STP| info| Port 1 STP port state is set to Learning

12| Jan 01 00:00:22| System| info| Sysinfo variable 'resetdefault' is set

to value '0'

The following table describes the significant fields shown in the example:

Field Description

NO. Log entry number.

Timestamp Time when the log message was generated.

Category Log facility to which the event belongs.

Severity Severity level of the event.

Message Description of the log message, indicating what event

is logged.

Syslog Commands
7
 Syslog Commands
show logging

Syslog Commands
8