I'm trying to differentiate between the following commands below. When I telnet into the switch and shut down the port, no syslog message is sent. What's the diff between logging server facility and logging history severity and logging server severity. Which ones do I actually need? The command ref is unclear
Also if server facility is needed, what exactly is local5, local6, etc?
set logging server enable
set logging server 10.3.3.8
set logging server facility LOCAL5
set logging server severity 5
set logging history severity 5
SBS-110W-7-6509-X1 (enable) sh logging
Logging buffer size: 500
timestamp option: enabled
Logging console: enabled
Logging telnet: enabled
Logging server: enabled
server facility: LOCAL5
server severity: debugging(7)
Current Logging Session: enabled
Facility Default Severity Current Session Severity
By set logging history severity severity_level command you can limit the Number of syslog Messages. By set logging server ip_addr command you can specify the IP address of one or more syslog servers .And by set logging server facility server_facility_parameter command you can set the facility and severity levels for syslog server messages.
Logging history is used is used to specify how many lines to put into the history log before sending it off to the syslog server.
set logging history severity x limits the messages put into the history log by severity.
set logging server facility is not about setting severity level it is about setting the facility level ie. you can specify a particular facility level eg local0, local1 etc.
Some syslogs can filter not just on severity but also facility. So say you had pix firewalls logging to the same syslog server and you wanted to be able to differentiate between firewall and router messages.
Set the firewall messages at facility local1
Set the router messages at facility local2
set the switch messages at facility local3
It gives you a way of organising and searching you syslogs.
Jon, thanks for your response. I think I'm finally getting closer to understanding this
I understand your point about facility
To see only severity level messages 3 and below, I'll set it to
set logging server severity 3
Now, if I do a 'set logging history severity 5', will my syslog server show messages 3 and under or 5 and under? If your explanation about history is correct and if it only is a number which indicates how many messages should be logged to the switch's buffer before sending it to the syslog server, why isn't it a plain number? Why does it have an associated severity to it too? That confuses me.
So, would the syslog see 5 and under or 3 and under in the above case?
We are pleased to announce availability of Beta software for 16.6.3. 16.6.3 will be the second rebuild on the 16.6 release train targeted towards Catalyst 9500/9400/9300/3850/3650 switching platforms. We are looking for early feedback from custome...