How does one know what messages will be sent via syslog vs as a trap? Is there some master logging document that says messages a,b,c are syslog, messages x,y,z are traps and e,d are sent as both?
Also, I am trying to tune the level of messaging we recieve. What are the best practices for 'must have' severity levels vs severity levels that are nice to have? If I set the devices to send anything above warning, how do I know there is not something important under notice? Has anyone seen a Cisco document that describes in detail what messages belong to each severity level?
If you have a lot of experience with with syslog/traps/monitoring it would be good to hear what has worked for you.
Thanks
