Syslog Tutorial

Keeping track of what is happening inside a network is just as important as building it correctly. Syslog is the standard logging mechanism used for exactly this purpose: it lets network devices generate messages whenever something noteworthy happens, so that an administrator can be alerted to problems as they occur rather than discovering them later.

Where Syslog Messages Can Be Stored or Displayed

A Cisco device can send its log messages to several different destinations at the same time, depending on what is configured:

• Internal buffer — messages are kept in the router’s own memory, configured with logging buffered [size].
• Syslog server — messages are sent to a dedicated external server, configured with the logging command. These messages are carried over UDP port 514.
• Flash memory — messages are written to a file in flash, configured with logging file flash:filename.
• Non-console terminal — messages are shown on a Telnet/SSH session, enabled with terminal monitor.
• Console line — messages are displayed directly on the console, configured with logging console.