So let's change the logging level, so logging
and once again monitor
and I'll set this to error messages, so errors. So show logging
console is set to debugging, monitor is set to errors, show debug,
OSPF adjacency debugging is enabled
Interface f0/0 shut the interface,
we have terminal monitor enabled on our telnet line, no shut.
Once again, we see debugging on the console, but we see nothing on the VTY lines, and that's because
the logging on the console is debugging or level 7 but the logging on the monitor lines is errors
or level 3.
It's worth knowing both the name
and the number with regards to Syslog messages.
Now it's possible to stop all logging to the local console if you like and all you would do is type
no logging console. You could do something similar for other options, such as the monitor lines.
So I noticed when I typed end nothing happened, control z or control zed, nothing happened, show debug
OSPF debugging is enabled show logging
console is disabled in this case, monitoring on the monitor is set to errors, I'll change that to
level 7.
So I've disabled logging on the console
Notice I don't see output here but I see output on the VTY line.
So just to show you that again
hit enter a few times here, control z or control zed notice I see the output on the VTY line
but I don't see the output on the console because I've disabled logging on the console.
I'll shut the interface down on this router and then no shut it.
I see the debugging on the VTY line but I see nothing on the console of the router.
So let's enable that again, logging console debugging, logging monitor debugging, show log show
logging console is set back to debugging and the monitor is set to debugging.
However, in this example, the buffer is disabled.
So let's look at enabling logging on the buffer.
Now, in this example on router 1 show logging shows me that I have logging on the console and logging
on the VTY line but I don't have logging enabled on the buffer.
Now, it's very unlikely that you're going to connect to the console of all your routers and switches
and view logging messages in real time.
You may do that while troubleshooting an issue, but you probably don't want to spend your whole day
looking at console messages.
You would rather have that buffered somewhere or even better, stored in a central place which you can
view offline or view at a later date.
So let's look at buffer logging first and then we'll look at Syslog.
So I'll set logging on the console to a low level 3 errors.
I'll leave it at seven on the why, so that we can see the output, but then I'm going to say logging
buffered
and in this case I'll set it to 7 or debugging.
So show log
console is level 3 errors,
monitor lines in other words, in our example, the VTY is set to debugging, and buffer is set to debugging.
So if I type show log again
I see a message in the buffer, I also see the size of the buffer so I can change that size by typing
logging buffered
and I can set the buffer level to a number and set it to this.
So show log
you can see the buffer size has changed, now that'll depend on the amount of space that you have available
on your router or switch.
So let's do the test again, shut the interface on router 2
no shut it.
I don't see any log messages on the console, I am seeing them on the VTY but if I type show log now
and scroll down notice, I see my OSPF messages in the log
these were not there previously.
I could, as an example, do some filtering.
So using cloud and let's look for the word BDR
and that'll show me all my log messages in the buffer that include the keyword BDR.
It's a lot better and a lot easier to search for specific messages using the buffer than it would be
using the console or a monitor interface such as this.
The problem with buffers is they are limited in size.
You don't have gigs of buffer space available on your routers
and the problem is if you have 100 routers, you're going to end up with 100 buffers.
It makes a lot more sense to have a centralized Syslog server where you collect all the log messages
and store in a single place allows for a lot better searching.
You can use tools in Windows or Mac as an example to search for log messages.
It can be archived.
It's just a lot better to store your log messages on a Syslog server.
So let's look at installing the solarwind Syslog server and capturing the Syslog messages.