03-16-2007 02:01 AM
Hi
Little hard to understand difference beetween logging messages.
We have logging level 5 in buffer logging in our cisco devices and routers.
I i want to send logging messages at same level 5 to unix server is that level then local5.(config "logging facility local5)
Does these level 5 and local5 include same kind of messages. What is difference beetween those parameters.
Does local7 include all messages including auth, cron, daemon, kern.
Thanks
Juha
Solved! Go to Solution.
03-16-2007 03:53 AM
The logging facility command basically tells the syslog server where to put the log message. You configure the syslog server with something like:
local7.debug /var/adm/local7.log
Now, when you use the "logging facility local7" on your device, all messages with severity "debug" or greater should be saved in /var/adm/local7.log.
HTH
03-16-2007 03:53 AM
The logging facility command basically tells the syslog server where to put the log message. You configure the syslog server with something like:
local7.debug /var/adm/local7.log
Now, when you use the "logging facility local7" on your device, all messages with severity "debug" or greater should be saved in /var/adm/local7.log.
HTH
03-17-2007 06:56 AM
Thanks for response. That was very helpful.
Any idea about
"Does local7 include all messages including auth, cron, daemon, kern."
03-17-2007 09:08 AM
No, facilities don't work that way. local7 is just another facility, independent from all others such as cron, daemon, etc. The facility allow administrators to logically separate messages (e.g. write them to separate files, forward them to different destinations, etc.)
The severity, on the other hand, does work like that. The higher severity numbers "include" the lower severity numbers. So, if you specify:
local7.debug /var/log/syslog_info
In your syslog.conf, then that will log all messages sent with the local7 facility with any severity to /var/log/syslog_info. On the other hand:
local7.info /var/log/syslog_info
Will only log messages with a severity number of info (i.e. 6) or lower (i.e. more severe messages). In other words, no local7 messages with a severity of debug will be logged to syslog_info.
I went over in a bit more detail how Cisco syslog messages work, and how a message is constructed in this thread: http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Network%20Infrastructure&topic=Network%20Management&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.1ddd41bd/1#selected_message .
03-17-2007 09:13 AM
According to this, no:
You need to use different facility names to log the messages you mention.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: