Knowing how to troubleshoot networks is a really important skill for any network engineer and knowing
how to properly use logging on Cisco routers and switches is a core requirement to help you troubleshoot.
It's vital that you know how to use logging directly on a Cisco device as well as using a syslog server
when you need to troubleshoot networks.
Now, Cisco offers many options with regards to logging.
You can log directly to the console of a router, you can log to a buffer, you can log to a syslog
server, as well as additional logging options.
In these videos, I'm going to show you how to log to the console and use various options with regards
to logging, including logging levels, we look at logging to the buffer as well as logging to a syslog
server.
So let's get started.
In this example, I've got a simple network of two routers, router 1, and router 2 connected via their
FastEthernet interface.
On router 1, if I go into the FastEthernet interface and no shut it notice the output that's displayed
on the console link and then a number in this case, 3 Up Down interface, FastEthernet 00
has changed state to up,
and then we get another message, a line protocol number 5, in this case, up down line protocol
in the interface has changed to up.
There's also a date and time stamp on the message, so these are logging messages displayed on the console
of the router and this number indicates a syslog level.
You can read more about the syslog protocol in RFC 5424 and I won't bore you going through the entire
RFC, but if you want to know the details of logging messages and the syslog protocol
this is a good place to start. I'll just point out a few things, certain types of functions are performed,
we have the originator, which generates syslog content to be carried in a message.
So now example, a router is generating syslog message and then we might have a collector that gathers
syslog content for further analysis. In a later video
I'm going to show you how to configure a solarwinds source log server as a collector capturing multiple
syslog messages to a central server
but for now, let's start with some of the basic principles of syslog
and to do that, we need to look at the priority of each source syslog message.
So in the RFC we have numerical codes, 0 to 7 with the severity description.
When you configure logging on a router as an example, you can configure the severity either by the number
or by the name.
So on our Cisco router at the moment, if I type show logging.
Notice when I typed end, a syslog message was shown with a level of 5, and when I typed show logging,
it shows me as an example that the console logging is set to level debugging.
I can configure the logging level by typing logging
and there are multiple options, but in this example, I'll configure logging console, use question
mark and notice I can specify a logging severity level using a number or I could specify a word.
So either debugging
or using the No.7.
So let's start with the highest number, 7 is debugging which allows you to view debugging messages,
6 is informational messages
this would be something like an access list of violation,
5 is notices, normal but significant conditions.
An example would be line protocol down, so interface f0/0 if I shut the interface.
Notice, 5 line protocol is down,
4 is warning conditions, so an example would be a configuration file is written to a server via
an SNMP request,
3 is errors
this is an error condition.
An example would be interface up-down messages.
2 is critical conditions that might be something like memory allocation failures, 1 is an alert
action must be taken immediately.
That might be something like temperature limit has been exceeded and emergency is the system is unstable.
So an example would be that the system is shutting down due to a missing fan tray on a switch as an
example.
So the numerical numbers are specified in this RFC 5424 and are specified in lots of places on the
Sasko website.
So here is an example, on the Cisco website.
Talking about the error message keywords and corresponding UNIX Syslog definitions.
So once again, notifications is 5 normal but significant conditions.
So let's have a look at another example showing you the differences in output on the console of a router
depending on the debugging that you set.
An important note to make is that if you enable a higher level, such as 7, all other levels are
enabled.
If you enable a level such as 5, that means levels 0, 1, 2, 3, 4, and 5 are
enabled.
So whenever you specify a level, that level and all lower levels are enabled on the router.