Syslog on Cisco IOS: message format, severity levels and logging destinations
In short: Syslog is how network devices report events. A Cisco message has a facility, a severity level from 0 (emergency) to 7 (debugging) and a mnemonic, followed by a description. IOS can send messages to the console, a memory buffer, remote sessions and a central server, each with its own severity threshold. Accurate time from NTP makes the logs useful.
What syslog is for
Every interface that goes down, every failed login and every routing neighbour that changes state produces a log message. Syslog is the standard way devices write and send those messages. Read on the device they help you troubleshoot; collected centrally they give you a history of the whole network and feed security monitoring. The protocol is described in RFC 5424 and normally uses UDP port 514; TLS-protected syslog (RFC 5425) uses TCP 6514 when the device supports it.
Reading a Cisco message
Here is a typical message from a switch:
000123: Oct 11 09:42:17.311 GST: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/14, changed state to down- 000123 is a sequence number (shown when
service sequence-numbersis on). Gaps tell you messages were lost. - The timestamp is only meaningful if the clock is right, which is why NTP matters.
- LINK is the facility: the part of IOS that raised the message.
- 3 is the severity level, here an error.
- UPDOWN is the mnemonic, a short code for the event.
- The rest is the human-readable description.
Searching for the facility and mnemonic together, such as LINK-3-UPDOWN or SEC_LOGIN-4-LOGIN_FAILED, is the fastest way to build alerts and filters.
The eight severity levels
| Level | Keyword | Typical example |
|---|---|---|
| 0 | emergencies | System unusable |
| 1 | alerts | Immediate action needed, such as overheating |
| 2 | critical | Hardware or software failure |
| 3 | errors | Interface down, error conditions |
| 4 | warnings | Failed login, configuration problem |
| 5 | notifications | Line protocol change, configuration saved |
| 6 | informational | ACL log entries, routine events |
| 7 | debugging | Output from debug commands |
When you set a level you get that level and all lower numbers. logging trap warnings sends levels 0 to 4. A memory aid you make yourself often works best; one option is "Even After Careful Engineering, Wires Never Inform Directly" for emergencies, alerts, critical, errors, warnings, notifications, informational, debugging.
Sending logs to the right places
service timestamps log datetime msec localtime show-timezone
service sequence-numbers
logging buffered 64000 informational
logging console warnings
logging host 10.0.100.30
logging trap informational
logging source-interface Loopback0
!
show logging
terminal monitor- Console logging is on by default. On a busy device, lots of console output can slow it down, so many teams raise the threshold or turn it off.
- Buffered logging keeps recent messages in RAM, viewed with
show logging. They are lost on reload. - Terminal monitor shows messages in your SSH session; it must be enabled each session.
- logging host sends messages to a central syslog server or SIEM, filtered by
logging trap. - logging source-interface makes every message come from one stable address, which keeps server-side filters simple.
Tip: avoid leaving debug-level logging switched on. Level 7 messages can flood the buffer and the server, hide the messages you really need, and on a busy device even affect performance. Turn debugs on for a short, planned test and off again straight afterwards. Also treat logs as sensitive: they can reveal usernames, addresses and network layout, so restrict who can read the syslog server and keep copies for as long as your retention policy requires.
Real-world example: the flapping uplink
At a fictional hotel, guests complained that Wi-Fi dropped for a few seconds several times a day. Nobody saw anything on the switches when they logged in, because the buffer was small and had already wrapped. The engineer added a central syslog server, set logging trap informational and turned on NTP so every device used the same clock. The next day a search for UPDOWN showed one access-point uplink going down and up at exactly the times guests had reported. The cable had been crushed behind a cabinet. Replacing it fixed the problem, and the team added an alert for any port that changes state more than five times an hour.
Practice
In %OSPF-5-ADJCHG, what are the facility, severity and mnemonic?
You set logging trap errors. Which levels reach the server?
Why configure NTP before relying on syslog?
Key takeaways
- A Cisco syslog message shows facility, severity and mnemonic, then a description.
- Severity runs from 0 (emergencies) to 7 (debugging); a threshold includes all lower numbers.
- IOS can log to console, buffer, terminal sessions and remote servers, each with its own level.
- Use timestamps, sequence numbers, a fixed source interface and NTP.
- Central syslog turns scattered messages into a searchable history.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.