Syslog

1. What is Syslog?

Imagine you're managing a network and for example an interface goes down on your router. How do you find out what happened?

This is where SYSLOG protocol can help you ! It’s a standardized protocol used by network devices like routers and switches to send status updates and alerts.

Figure 1 – Syslog message triggered when interface g0/0 goes down

If an interface goes down on our Router R1, SYSLOG will immediately generates a message like this:

R1#
%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to down

This message tells you that the interface is no longer operational !

2. Storing Syslog Messages

When a Cisco device detects an event, such as an interface going down, it generates a SYSLOG message. This message can be sent to different destinations, depending on how your device is configured.

Let’s look at each logging method and how it behaves in practice.

Console Logging

When you're physically connected to the router through the console port, SYSLOG messages are displayed in real time on your terminal.

Figure 2 – Syslog messages displayed live through the console connection

This type of logging is enabled by default and is ideal for local troubleshooting during initial configuration. The logging console command can be used if your device has console logging disabled!

But let's me tell you, if the session is closed or the device reboots, all logs are lost...

Terminal Logging (Telnet/SSH)

When connecting remotely via SSH or Telnet, SYSLOG messages are not displayed by default. To see them, you need to explicitly enable real-time logging on your session by using the terminal monitor command.

Figure 3 – Real-time logging over SSH or Telnet using the terminal monitor command

This command affects only your current session and must be re-entered if you reconnect to the device.

Buffered Logging (RAM)

Buffered logging allows you to store log messages temporarily in RAM.
This means you can view them even after an event has occurred as long as the device hasn't rebooted.

You can choose how much memory to allocate for logging.

Let's me show you how to configure buffered logging:

R1(config)# logging buffered ?
  <0-7>              Logging severity level
  <4096-2147483647>  Logging buffer size (default is 4096)
  alerts             (level 1)
  critical           (level 2)
  debugging          (level 7)
  emergencies        (level 0)
  errors             (level 3)
  informational      (level 6)
  notifications      (level 5)
  warnings           (level 4)

R1(config)# logging buffered 16384 4

This command sets 16,384 bytes of buffer space and stores only logs with severity 4 (warnings) and higher. (We will see severity levels in part 4)

To review the logs use the command show logging:

R1# show logging
Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns)
    Console logging: level debugging, 7 messages logged, xml disabled,
                     filtering disabled
    Monitor logging: level debugging, 0 messages logged, xml disabled,
                     filtering disabled
    Buffer logging:  level warnings, 36 messages logged, xml disabled,
                     filtering disabled
    Exception Logging: size (4096 bytes)
    Count and timestamp logging messages: disabled
    Persistent logging: disabled
    Trap logging: level informational, 39 message lines logged
        Logging to 192.168.10.1 via udp on port 514
        Logging Source-Interface:       not set
        VRF Name:                       (default)

Log Buffer (16384 bytes):
*Jun 12 08:14:21.012: %SYS-5-CONFIG_I: Configured from console by admin on vty0 (192.168.1.100)
*Jun 12 08:14:22.123: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up
*Jun 12 08:14:23.315: %LINK-3-UPDOWN: Interface GigabitEthernet0/2, changed state to down
*Jun 12 08:14:24.417: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/2, changed state to down
*Jun 12 08:14:27.789: %SEC-6-IPACCESSLOGP: list 101 permitted tcp 10.1.1.5(51304) -> 172.16.1.10(22), 1 packet
*Jun 12 08:14:31.456: %SYS-5-CONFIG_I: Configured from memory by console
*Jun 12 08:14:33.111: %BGP-5-ADJCHANGE: neighbor 10.1.1.1 Up
*Jun 12 08:14:35.962: %SYS-4-WARNING: High CPU utilization detected on process 'routing'

Syslog Server (Centralized Storage)

In enterprise environments, logs are sent to a central Syslog server for long-term storage. This allows you to keep a complete history of events from multiple devices in one place.

Figure 4 – Syslog messages sent to a centralized server for long-term storage

In the diagram, R1 is configured to send logs to a server over the network. This ensures that even if R1 reboots, the logs are still archived and available for analysis.

Syslog uses UDP port 514 to send messages

Where Can Syslog Messages Be Sent?

If we summarize, here you can see a table of all SYSLOG destinations, the relevant configuration commands and how they behave:

Table 1 - Syslog Message Destination

3. Syslog Message Structure

Syslog Message need to have a sturcture in order to be understand by network administrator.

Each SYSLOG message provides structured information to help you diagnose network events. Here’s what a SYSLOG message typically contains:

• Timestamp: When the event happened.

• Facility Code: The part of the system that generated the message.

• Severity Level: How critical the event is.

• Mnemonic: A short identifier for the event type.

• Message Text: A detailed description of what happened.

Let’s view an example

When an interface goes down, a SYSLOG message might look like this:

R1# 
%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to down

• Facility Code: %LINEPROTO (related to the interface protocol)

• Severity Level: 5 (Notification level)

• Mnemonic: UPDOWN (Interface status change)

• Message Text: The interface went down.

4. Syslog Severity Levels

Not all Syslog messages have the same level of importance.

To help network engineer prioritize, each message is assigned a severity level ranging from 0 to 7, where 0 is the most critical and 7 is the least.

These severity levels can be difficult to learn but look at this simple phrase together:

"Every Awesome Cisco Engineer Will Need Ice Cream Daily."

Each word helps you remember the Syslog severity levels from 0 to 7:

You just need to repeat the phrase a few times and you’ll never forget the order again.

5. Syslog Facility Codes

In large networks, devices can generate hundreds of log messages every minute.
To keep things organized, Syslog Facility Codes are used to identify the source or origin of each Syslog message such as the system, an interface or a security process.

These codes allow administrators to filter logs more efficiently, helping them focus only on the messages that matter like authentication failures, link changes, or system warnings instead of being overwhelmed by irrelevant logs.

Overview of Facility Codes

Example

When an interface goes down, the message might look like this:

%LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down

Breaking it down:

• %LINK → The facility code indicates that the message is related to interface link status.

• 3 → The severity level (Error).

• UPDOWN → The message mnemonic, showing that the interface state changed.

• Message text → Specifies the affected interface and the new state.

This allows administrators to quickly understand the issue and take appropriate action.

6. Conclusion

What You Should Remember

🔵 What is Syslog
A protocol used by network devices to report important events, like interface changes, errors, or configuration updates.

🔵 Syslog Destinations
Messages can be sent to different places:

• Console: Real-time logs if you're connected physically (enabled by default)

• Terminal (SSH/Telnet): Requires terminal monitor to show logs remotely

• Buffer (RAM): Stores logs temporarily in memory (logging buffered)

• Syslog Server: Centralized storage for long-term analysis (logging host)

🔵 Syslog Message Structure
Every message contains:

• A timestamp

• A facility code (which part of the system generated it)

• A severity level (how urgent it is)

• A mnemonic and a short message

🔵 Syslog Severity Levels (0–7)
Used to rank the importance of each message, from Emergency (0) to Debugging (7).
Lower numbers mean more critical issues.

🔵 Syslog Facility Codes
Let you identify the origin of the log: system messages, link status, security events, etc.

If you understand this, you’ll troubleshoot better and spot problems faster.

Want to go deeper?

If you're looking for Cisco's official documentation on how Syslog is implemented in Cisco switches, this PDF from Cisco provides advanced technical details.