That is not correct.

This "logging facility localx" is useless

if you syslog server is a windows machine.

Facility is like a file handle in Unix/Linux

and it applies only to syslog server running

on Linux/Unix.

Let say if you set "logging facility local3"

on your router. Now on your Linux, you have

the following in your /etc/syslog.conf:

local3.* /var/log/cisco.log

What it means is that syslog messages level 6,

default, will be send to the Linux box /var/log/cisco.log file.

By default, cisco router will send syslog message level 6 and higher to the /var/log/cisco.log file. If you want to see

only syslog level 4,3,2 and 1, you need to do this:

service timestamps debug datetime msec localtime show-timezone

service timestamps log datetime

logging trap warnings

Does it make sense?

CCIE Security

So, if I'm understanding this...

I don't even need the logging facility command.

If I use the logging trap command it will send whatever I state and higher warnings. So If I did use logging trap warnings, that would send me the following messages...warnings, error, critical, alert and emergency.

Would that be correct?

Thanks for your input,

Matt

Yes that is correct.

"logging trap 6" is ON by default on Cisco IOS

devices.

For enterprise environments, we use

syslog next-generation (syslog-ng) which run

on Unix/Linux, mine is Gentoo Linux which works

extremely well. You can all ALL your cisco,

Juniper, Checkpoint, Unix devices going to

to syslog-ng. Syslog-ng has built-in features

to parse the log and place these logs in

appropriate files for you. In other words,

each device will be stored in each own

separate file. Furthermore, you can

dump the log messages into its separate MySQL

tables. The old syslog can not provide

this function unless you write your own

Perl script to do it. Everything is

built-in with syslog-ng.