Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

Cisco Devices Syslog monitoring and user monitoring tools

Can anyone help me how to monitoring syslog and users log (which command use specific user). if any software or hardware need for this purpose we will purchace it. note that our network running all cisco devices (router, switch, ASA etc) and more then 200 devices are in our network.



Cisco Devices Syslog monitoring and user monitoring tools

Configuring Cisco Devices to Use a Syslog Server

Most Cisco devices use the syslog protocol to manage system logs and  alerts. But unlike their PC and server counterparts, Cisco devices lack  large internal storage space for storing these logs. To overcome this  limitation, Cisco devices offer the following two options:

  • Internal buffer— The device's operating system  allocates a small part of memory buffers to log the most recent  messages. The buffer size is limited to few kilobytes. This option is  enabled by default. However, when the device reboots, these syslog  messages are lost.
  • Syslog— Use a UNIX-style SYSLOG protocol to send  messages to an external device for storing. The storage size does not  depend on the router's resources and is limited only by the available  disk space on the external syslog server. This option is not enabled by  default.


Before configuring a Cisco device to send syslog messages, make  sure that it is configured with the right date, time, and time zone.  Syslog data would be useless for troubleshooting if it shows the wrong  date and time. You should configure all network devices to use NTP.  Using NTP ensures a correct and synchronized system clock on all devices  within the network. Setting the devices with the accurate time is  helpful for event correlation.

To enable syslog functionality in a Cisco network, you must configure the built-in syslog client within the Cisco devices.

Cisco devices use a severity level of warnings through emergencies to  generate error messages about software or hardware malfunctions. The  debugging level displays the output of debug commands. The Notice level  displays interface up or down transitions and system restart messages.  The informational level reloads requests and low-process stack messages.

Configuring Cisco Routers for Syslog

To configure a Cisco IOS-based router for sending syslog messages to  an external syslog server, follow the steps in Table 4-11 using  privileged EXEC mode.

Table 4-11. Configuring Cisco Routers for Syslog





Router# configure terminal

Enters global configuration mode.


Router(config)# service timestamps type datetime [msec] [localtime] [show-timezone]

Instructs the system to timestamp syslog messages; the options for the type keyword are debug and log.


Router(config)#logging host

Specifies the syslog server by IP address or host name; you can specify multiple servers.


Router(config)# logging trap level

Specifies the kind of messages, by severity level, to be  sent to the syslog server. The default is informational and lower. The  possible values for level are as follows:

Emergency: 0
Alert: 1
Critical: 2
Error: 3
Warning: 4
Notice: 5
Informational: 6
Debug: 7

Use the debug level with caution, because it can generate a large amount of syslog traffic in a busy network.


Router(config)# logging facility facility-type

Specifies the facility level used by the syslog messages; the default is local7. Possible values are local0, local1, local2, local3, local4, local5, local6, and local7.


Router(config)# End

Returns to privileged EXEC mode.


Router# show logging

Displays logging configuration.


When a level is specified in the logging trap level command, the router is configured to send messages with lower severity levels as well. For example, the logging trap warning command configures the router to send all messages with the  severity warning, error, critical, and emergency. Similarly, the logging trap debug command causes the router to send all messages to  the syslog server. Exercise caution while enabling the debug level.  Because the debug process is assigned a high CPU priority, using it in a  busy network can cause the router to crash.

Example 4-12 prepares a Cisco router to send syslog messages at  facility local3. Also, the router will only send messages with a  severity of warning or higher. The syslog server is on a machine with an  IP address of

Example 4-12. Router Configuration for Syslog

Router-Dallas#config terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router-Dallas(config)#service timestamps debug datetime localtime show-timezone
Router-Dallas(config)#service timestamps log datetime localtime show-timezone msec
Router-Dallas(config)#logging facility local3
Router-Dallas(config)#logging trap warning
Router-Dallas#show logging
Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns)
    Console logging: level debugging, 79 messages logged
    Monitor logging: level debugging, 0 messages logged
    Buffer logging: disabled
    Trap logging: level warnings, 80 message lines logged
        Logging to, 57 message lines logged

Configuring a Cisco Switch for Syslog

To configure a Cisco CatOS-based switch for sending syslog messages  to an external syslog server, use the privileged EXEC mode commands  shown in Table 4-12.

Table 4-12. Configuring a Cisco Switch for Syslog





Switch>(enable) set logging timestamp {enable | disable}

Configures the system to timestamp messages.


Switch>(enable) set logging server ip-address

Specifies the IP address of the syslog server; a maximum of three servers can be specified.


Switch>(enable) set logging server severity server_severity_level

Limits messages that are logged to the syslog servers by severity level.


Switch>(enable) set logging server facility server_facility_parameter

Specifies the facility level that would be used in the message. The default is local7.  Apart from the standard facility names listed in Table 4-1, Cisco  Catalyst switches use facility names that are specific to the switch.  The following facility levels generate syslog messages with fixed  severity levels:

5: System, Dynamic-Trunking-Protocol, Port-Aggregation-Protocol, Management, Multilayer Switching


2: Other facilities


Switch>(enable) set logging server enable

Enables the switch to send syslog messages to the syslog servers.


Switch>(enable) Show logging

Displays the logging configuration.

Example 4-13 prepares a CatOS-based switch to send syslog messages at  facility local4. Also, the switch will only send messages with a  severity of warning or higher. The syslog server is on a machine with an  IP address of

Example 4-13. CatOS-Based Switch Configuration for Syslog

Console> (enable) set logging timestamp enable
System logging messages timestamp will be enabled.
Console> (enable) set logging server added to System logging server table.
Console> (enable) set logging server facility local4
System logging server facility set to 
Console> (enable) set logging server severity 4
System logging server severity set to <4>
Console> (enable) set logging server enable
System logging messages will be sent to the configured syslog servers.
Console> (enable) show logging
Logging buffered size: 500
timestamp option: enabled
Logging history size: 1
Logging console: enabled
Logging server: enabled
server facility: LOCAL4
server severity: warnings(4
Current Logging Session: enabled

Facility            Default Severity          Current Session Severity
-------------       -----------------------   ------------------------
cdp                 3                         4
drip                2                         4
dtp                 5                         4
dvlan               2                         4
earl                2                         4
fddi                2                         4
filesys             2                         4
gvrp                2                         4
ip                  2                         4
kernel              2                         4
mcast               2                         4
mgmt                5                         4
mls                 5                         4
pagp                5                         4
protfilt            2                         4
pruning             2                         4
radius              2                         4
security            2                         4
snmp                2                         4
spantree            2                         4
sys                 5                         4
tac                 2                         4
tcp                 2                         4
telnet              2                         4
tftp                2                         4
udld                4                         4
vmps                2                         4
vtp                 2                         4

0(emergencies)        1(alerts)              2(critical)
3(errors)             4(warnings)            5(notifications)
6(information)        7(debugging)
Console> (enable)

Configuring a Cisco ASA for Syslog >

You can get a free copy of Syslog server from here

Hope it helps!!