Deciphering syslog facilities

By stretch | Thursday, October 23, 2008 at 7:34 a.m. UTC

Anyone with experience configuring Cisco routers is no doubt familiar with the following console message:

 %SYS-5-CONFIG_I: Configured from console by console

This message appears (if console logging is enabled) whenever global configuration mode is exited. Similarly, you've probably noticed this pair of messages whenever opening an interface:

%LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up

These are syslog messages, generated by events on the router. If remote logging is configured (with the logging host command), these messages are sent to a centralized syslog server for archival and analysis. Syslog archives are typically integrated with a network management service for correlation with other events.

The human-friendly text of most messages is easy enough to interpret, but the beginning string of each takes a bit of explanation. The string beginning with the percent sign (%) consists of three parts:

  • Cisco facility (and optional subfacility on certain platforms)
  • Syslog severity level
  • Mnemonic

syslog_message.png

The facility indicates the device, protocol, or software module which generated the message. IOS 12.4 includes several hundred facilities, listed here. These are Cisco-specific values, not to be confused with the facility types used by the Syslog protocol itself (IOS uses syslog facility LOCAL7 by default).

The severity level is a single digit from 0 to 7, indicating the severity of the message. The severity levels are:

  • 0 - Emergency
  • 1 - Alert
  • 2 - Critical
  • 3 - Error
  • 4 - Warning
  • 5 - Notification
  • 6 - Informational
  • 7 - Debugging

The mnemonic is simply a short code which serves to identify the error message. It allows for quick reference of a message without having to refer to the entire output. All of these mnemonics, along with their applicable facilities, can be referenced in these two volumes.

About the Author

Jeremy Stretch is a network engineer living in the Raleigh-Durham, North Carolina area. He is known for his blog and cheat sheets here at Packet Life. You can reach him by email or follow him on Twitter.

Posted in Tips and Tricks

Comments


Kevin (guest)
October 23, 2008 at 6:54 p.m. UTC

Very nice Stretch!


Hemant Kumar (guest)
February 21, 2013 at 7:25 a.m. UTC

Hi Jeremy,

If I set the logging level to 6, does it mean it will log the message of 6 and below?

Comments have closed for this article due to its age.