CatOS Logging configuration

[ciscors]

I'm trying to differentiate between the following commands below. When I telnet into the switch and shut down the port, no syslog message is sent. What's the diff between logging server facility and logging history severity and logging server severity. Which ones do I actually need? The command ref is unclear

Also if server facility is needed, what exactly is local5, local6, etc?

#syslog

set logging server enable

set logging server 10.3.3.8

set logging server facility LOCAL5

set logging server severity 5

set logging history severity 5

!

SBS-110W-7-6509-X1 (enable) sh logging

Logging buffer size: 500

timestamp option: enabled

Logging history:

size: 1

severity: debugging(7)

Logging console: enabled

Logging telnet: enabled

Logging server: enabled

{10.3.3.8}

server facility: LOCAL5

server severity: debugging(7)

Current Logging Session: enabled

Facility Default Severity Current Session Severity

------------- ----------------------- ------------------------

acl 5 5

cdp 4 4

cops 3 3

dtp 5 5

dvlan 2 2

earl 2 2

ethc 5 5

filesys 2 2

gl2pt 5 5

gvrp 2 2

ip 3 3

kernel 2 2

ld 3 3

mcast 2 2

mgmt 5 5

mls 5 5

protfilt 2 2

pruning 2 2

privatevlan 3 3

qos 3 3

radius 2 2

rsvp 3 3

security 2 2

snmp 2 2

spantree 2 2

sys 5 5

tac 2 2

tcp 2 2

telnet 2 2

tftp 2 2

udld 4 4

vmps 2 2

vtp 2 2

0(emergencies) 1(alerts) 2(critical)

3(errors) 4(warnings) 5(notifications)

6(information) 7(debugging)

SBS-110W-7-6509-X1 (enable)

[mchin345]

By set logging history severity severity_level command you can limit the Number of syslog Messages. By set logging server ip_addr command you can specify the IP address of one or more syslog servers .And by set logging server facility server_facility_parameter command you can set the facility and severity levels for syslog server messages.

For more information please click following URL:

http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration_guide_chapter09186a008019f029

[ciscors]

That link you sent me is a dead link.

I still don't get what is set logging history for. If that applies to the severity of messages sent to the syslog server, what is 'set logging server facility' for?

total confused!

thx

[Jon Marshall]

Hi

Logging history is used is used to specify how many lines to put into the history log before sending it off to the syslog server.

set logging history severity x limits the messages put into the history log by severity.

set logging server facility is not about setting severity level it is about setting the facility level ie. you can specify a particular facility level eg local0, local1 etc.

Some syslogs can filter not just on severity but also facility. So say you had pix firewalls logging to the same syslog server and you wanted to be able to differentiate between firewall and router messages.

Set the firewall messages at facility local1

Set the router messages at facility local2

set the switch messages at facility local3

etc..

It gives you a way of organising and searching you syslogs.

HTH

Jon

[ciscors]

Jon, thanks for your response. I think I'm finally getting closer to understanding this

I understand your point about facility

To see only severity level messages 3 and below, I'll set it to

set logging server severity 3

Now, if I do a 'set logging history severity 5', will my syslog server show messages 3 and under or 5 and under? If your explanation about history is correct and if it only is a number which indicates how many messages should be logged to the switch's buffer before sending it to the syslog server, why isn't it a plain number? Why does it have an associated severity to it too? That confuses me.

So, would the syslog see 5 and under or 3 and under in the above case?

Thanks for your patience ;)