Network monitoring and management: syslog, NTP, SNMP and controllers
In short: Monitoring keeps networks fast, available and secure. Syslog collects device events with a severity from 0 (emergency) to 7 (debug), NTP keeps every clock in step so logs line up, SNMP lets a manager poll and receive alerts, and controllers give one place to see and manage the whole network.
What monitoring is and why it matters
Network monitoring is the continuous watching of routers, switches, firewalls and servers to keep the network fast, available and secure. It helps to:
- Keep performance high by tracking bandwidth, latency and packet loss.
- Prevent downtime by spotting failing hardware or congestion before users notice.
- Improve security by flagging unusual logins, scans or traffic.
- Use resources well and plan capacity from real data.
- Prove compliance with reports and records.
- Define goals and metrics.
- Choose tools.
- List the critical devices and links.
- Set thresholds and alerts.
- Collect data (agents, SNMP, logs, flows).
- Analyse trends.
- Respond to alerts.
- Review and tune regularly.
Syslog
Syslog carries event messages from devices to a central collector over UDP port 514 (originally documented in RFC 3164, updated by RFC 5424). It sends and forgets: there is no acknowledgement. Each message carries a facility (the source, 0 to 23, with local0 to local7 free for network devices), a severity, the hostname, a timestamp and the message text.
| Level | Severity | Meaning |
|---|---|---|
| 0 | Emergency | System unusable |
| 1 | Alert | Act immediately |
| 2 | Critical | Critical condition |
| 3 | Error | Error condition |
| 4 | Warning | Could become an error |
| 5 | Notice | Normal but significant |
| 6 | Informational | Routine information |
| 7 | Debug | Detailed troubleshooting output |
Cisco messages follow the pattern %FACILITY-SEVERITY-MNEMONIC: text, for example %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down.
NTP: keeping time
NTP (UDP 123) synchronises device clocks so logs from different devices can be lined up during an investigation. It is hierarchical: stratum 0 is a reference clock (atomic or GPS), stratum 1 servers connect directly to it, and each step down adds one. Devices can be NTP clients, servers, or both.
SNMP
A network management system (NMS) talks to agents on managed devices. It reads values with GET (UDP 161), changes settings with SET, and receives unsolicited alerts called traps (UDP 162). Data is organised in a MIB (management information base). Use SNMPv3: v1 and v2c send their community strings in clear text, while v3 adds authentication and encryption.
Network controllers
A network controller is a central system that configures, monitors and troubleshoots many devices from one place. It shows the whole topology, device health and performance, applies consistent security policy, and uses software-defined networking ideas to automate changes. Controllers talk to devices over standard protocols and APIs.
service timestamps log datetime msec
logging host 192.168.99.20
logging trap informational
ntp server 192.168.99.10
snmp-server group NMS v3 priv
snmp-server user nmsuser NMS v3 auth sha Auth-Pass-123 priv aes 128 Priv-Pass-456Practice
Which is more severe: level 2 or level 5?
Why must NTP be configured before you rely on logs?
Which SNMP version should you use, and why?
Key takeaways
- Monitoring protects performance, availability, security and compliance.
- Syslog uses UDP 514; severity 0 is emergency, 7 is debug.
- NTP (UDP 123) keeps clocks in step; lower stratum is closer to the reference.
- SNMP: GET/SET on UDP 161, traps on UDP 162; use v3.
- Controllers give one place to manage, monitor and automate.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.