Cisco IOS Cookbook, 2nd Edition

Restricting What Log Messages Are Sent to the Server

Problem

You want to limit which logging levels the router will send to the syslog server.

Solution

Use the logging trap configuration command to limit the severity level of syslog messages:

Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#logging host 172.25.1.1
Router(config)#logging trap notifications
Router(config)#end 
Router#

Discussion

By default, when you enable remote logging on a router, it will forward only those messages with a severity level informational or higher (see Table 18-1). This means that the router forwards everything but debugging messages to the syslog server. Raising the severity of the log messages forwarded to the syslog server can help to reduce bandwidth utilization across the network, as well as the disk space required for storing the log messages on the server. This example shows the output of the show logging exec command:

Router>show logging
Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns)
    Console logging: level debugging, 658 messages logged
    Monitor logging: level debugging, 65 messages logged
    Buffer logging: level debugging, 6 messages logged
    Logging Exception size (4096 bytes)
    Trap logging: level notifications, 662 message lines logged
        Logging to 172.25.1.1, 5 message lines logged
        Logging to 172.25.1.3, 5 message lines logged
          
Log Buffer (4096 bytes): 
Router>

Notice that the logging severity level is set ...