Log Management Overview

During the operation of the device, various status changes will occur, such as link status UP, DOWN, etc., and some events such as processing exceptions will also be encountered. The syslog provides a series of services. When the status changes or an event occurs, fixed-format messages will be automatically generated, and these messages will be recorded on the device log file. It can be displayed on the console port and remote login terminal, and can also be sent to 1-3 groups of log servers on the network for administrators to analyze network conditions and locate problems. In order to facilitate administrators to read and manage log messages, these log messages can be classified according to the priority of the log information.

Configuring

Configure Console Log Level

SWITCH(config)# logging console {| <0-7>}

SWITCH(config)# no logging console

Configure console log output level

Default level is 6 When executing the no command, the log will not be output on the console. Execute logging console, no level parameters, configured as default level 6

Configure Terminal Log Level

• Configure Terminal Log Level

SWITCH(config) #logging monitor {| < 0-7>}

SWITCH(config)# no logging monitor

Configure terminal log output level

Default level is 6 When executing the no command, the log will not be output Execute logging monitor, no level parameters, configured to the default level 6

• Enable Terminal Output Log

SWITCH# terminal monitor

SWITCH# terminal no monitor

Enable log output on the terminal

By default, the terminal does not output log When executing the no command, the terminal does not output log

Configure Remote Server

• Configure Remote Server

SWITCH(config)# logging server {| second | third} {A.B.C.D | ipv6 XX::XX } udp-port <1-65535>

SWITCH(config)# no logging server {| second | third}

Configure remote server

Supports up to 3 remote server configurations Support remote server UDP protocol port configuration, range <1-65535> When no UDP protocol port parameters are configured, the default port number is 514

• Configure the Log Level Sent to the Remote Server

SWITCH(config) #logging trap {| < 0-7>}

SWITCH(config)# no logging trap

Configure the level of logs sent to the server

Default level is 6 When executing the no command, no logs will be sent to the server. Execute logging trap , no level parameters, configured as default level 6

• Configure the Rate Limit for Sending Server Logs

SWITCH(config) #logging rate-limit interval <1-30> burst <1-1000>

SWITCH(config)#no logging rate-limit

Configure the rate at which the device sends logs to the remote server

Interval is the time range, the default is 6, the range is <1-30>, the unit is seconds burst is the maximum number of logs that can be sent within the time range, the default is 60, the range is <1-1000> By default, up to 60 sys logs can be sent to the server every 6 seconds Configure the Logging Buffer

SWITCH(config) #logging buffer <64-4096>

SWITCH(config)#no logging buffer

Configure log storage entries, log storage starts from device startup Default number of storage entries is 1024 The range is <64-4096>

SWITCH# clear logging

Examples

Case 1 : The device sent syslog to the remote server, the device IP is 1 92.168.1.240 , the remote server IP is 1 92.168.1.33 ,UDP port number is 10514. Configure the remote server on the device:

SWITCH(config)# logging server 192.168.1.33 udp-port 10514

The device generates syslog information: *1970 Jan 01 14:19:34 SWITCH %HAL-4: Interface gigabitEthernet0/1 changed state to down Monitor syslog information on the remote server: LOCAL7.warn: *1970 Jan 1 14:19:34 SWITCH %HAL-4: Interface gigabitEthernet0/1 changed state to down

Display Information

• Display Logs Stored in Device

SWITCH# show logging

Show all syslog stored in device

• Display Logs Stored in Device of Last entries

SWITCH# show logging last <1 4096>

Show last specific number of logs stored in device

• Display Log Configuration Information

SWITCH# show logging summary

SWITCH#show logging summary

Summary of logging configuration: Logging console : 6 Logging monitor : 6 Logging trap : 6 Logging buffer : 1024 Server: Ip address : 192.168.1.33 Udp port : 10514 Server second : Disabled Server third : Disabled Rate-limit: Interval : 1 seconds Burst : 2

Log console output control

<0-7>: Indicates the log level Disabled: Indicates no console output Logging monitor

Log terminal line output control

<0-7>: Indicates the log level Disabled: Indicates that it is not output in terminal line Logging trap

Log trap remote server output control

<0-7>: Indicates the log level Disabled: Indicates not sending to the remote server

Logging buffer

Log storage entries, log storage starts from device startup <64-4096>: Indicate max log storage entries Server Server second

Server third

Server, currently supports 3 servers

Ip address

Ipv6 address Ipv4, ipv6 address information Udp port

UDP port information

Rate-limit Speed limit for sending logs to remote server Interval Speed limit effective time range Burst Speed limit value within interval time