Syslog
Also known as: system logging protocol
Syslog is a standard protocol that network devices use to send event and status messages to a central logging server. It gives administrators one place to review what happened across routers, switches, firewalls, and servers.
Syslog separates the device generating a message (the client) from the collector that stores it (the syslog server). Messages travel over UDP port 514 by default, though TCP and TLS-secured transport are available where reliability or confidentiality matters. Centralizing logs solves a real operational problem: device buffers are small and clear on reboot, so without an external collector the evidence of an outage often disappears before anyone can look at it.
Every message carries a facility, indicating the subsystem that produced it, and a severity level from 0 to 7. The levels run emergency (0), alert (1), critical (2), error (3), warning (4), notification (5), informational (6), and debugging (7) — a common mnemonic is "Every Awesome Cisco Engineer Will Need Ice cream Daily." Lower numbers are more severe. Configuring a logging level sends that severity and everything more severe, so setting level 4 captures warnings, errors, criticals, alerts, and emergencies.
On Cisco IOS, logging destinations are configured independently: console logging for the directly attached terminal, monitor logging for Telnet and SSH sessions, buffered logging to device RAM, and trap logging to a remote syslog server. Because log entries are only as useful as their timestamps, syslog is normally paired with NTP so that events across many devices can be correlated on a common clock. Syslog reports events after the fact, in contrast to SNMP, which polls devices for status and metrics.
The CCNA covers syslog under network management and device administration. Be prepared to identify the eight severity levels and their order, recognize the effect of a logging level command, name the default transport and port, and explain why syslog and NTP are deployed together.
Key takeaways
- Syslog sends event messages from network devices to a central logging server, by default over UDP port 514.
- Messages carry a facility and a severity level from 0 (emergency) to 7 (debugging), where lower is more severe.
- Setting a logging level captures that severity and all more severe messages.
- Cisco devices log separately to console, monitor, buffer, and remote syslog destinations.
- NTP is deployed alongside syslog so timestamps across devices can be correlated.