CISCO IOS in a Nutshell

Logging

The router can display logging messages on the terminal, store them in a buffer on the router, or send them to a log server using syslog (syslog is standard on Unix systems, and available for Windows^[8]). You can control how much logging information is collected by using severity levels. For example, you can say that all messages should be sent to the log server regardless of severity, but that only critical messages should be displayed on a console.

Configuring Logging

By default, logging is disabled. If you want to log the router’s activity, you must start by enabling logging:

logging on

We can now configure the syslog server. On a Unix system, you configure syslog by editing the /etc/syslog.conf file. On Windows, the configuration process depends on the software you use. No matter what operating system you run it on, each log file is associated with a facility and a severity. For example, the syslog.conf file might contain the following entry:

local5.debug        /var/adm/local5.log

This means that messages coming from the user-defined facility local5, with a severity debug (or greater), should be saved in the file /var/adm/local5.log. Since debug is the lowest possible severity, this statement means that we will log all messages from the local5 facility. On the router, the following commands start logging:

! Enable timestamps for all log messages and debug with a time and date stamp. ! The localtime keyword lists the time in local time instead of UTC service timestamps log datetime ...