cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
32357
Views
11
Helpful
4
Replies

Difference beetween logging level and logging facility

u346874_2
Level 1
Level 1

Hi

Little hard to understand difference beetween logging messages.

We have logging level 5 in buffer logging in our cisco devices and routers.

I i want to send logging messages at same level 5 to unix server is that level then local5.(config "logging facility local5)

Does these level 5 and local5 include same kind of messages. What is difference beetween those parameters.

Does local7 include all messages including auth, cron, daemon, kern.

Thanks

Juha

1 Accepted Solution

Accepted Solutions

ahmednaas
Level 4
Level 4

The logging facility command basically tells the syslog server where to put the log message. You configure the syslog server with something like:

local7.debug /var/adm/local7.log

Now, when you use the "logging facility local7" on your device, all messages with severity "debug" or greater should be saved in /var/adm/local7.log.

HTH

View solution in original post

4 Replies 4

ahmednaas
Level 4
Level 4

The logging facility command basically tells the syslog server where to put the log message. You configure the syslog server with something like:

local7.debug /var/adm/local7.log

Now, when you use the "logging facility local7" on your device, all messages with severity "debug" or greater should be saved in /var/adm/local7.log.

HTH

Thanks for response. That was very helpful.

Any idea about

"Does local7 include all messages including auth, cron, daemon, kern."

No, facilities don't work that way. local7 is just another facility, independent from all others such as cron, daemon, etc. The facility allow administrators to logically separate messages (e.g. write them to separate files, forward them to different destinations, etc.)

The severity, on the other hand, does work like that. The higher severity numbers "include" the lower severity numbers. So, if you specify:

local7.debug /var/log/syslog_info

In your syslog.conf, then that will log all messages sent with the local7 facility with any severity to /var/log/syslog_info. On the other hand:

local7.info /var/log/syslog_info

Will only log messages with a severity number of info (i.e. 6) or lower (i.e. more severe messages). In other words, no local7 messages with a severity of debug will be logged to syslog_info.

I went over in a bit more detail how Cisco syslog messages work, and how a message is constructed in this thread: http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Network%20Infrastructure&topic=Network%20Management&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.1ddd41bd/1#selected_message .

According to this, no:

http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_chapter09186a008030c760.html#wp1001437

You need to use different facility names to log the messages you mention.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: