understanding the first line of the "show logging" output on IOS-XE

[Waterbird]

The first line of output of the "show logging" is: "syslog logging: enabled".  Does this line indicate that all syslog globally is enabled, regardless of the individual status of various types of logging such as console, terminal, and trap/server logging?  How can it be disabled so that the "show logging" output to displays: "syslog logging:disabled"?

[David Ruess · Accepted solution]

Hello,

Yes, pretty much. To disable it you can type no logging on in global config mode.

R2(config)#no logging on
R2(config)#do sh
Feb 23 20:35:48.210: %SYS-5-LOGGING_STOP: Logging disabled - CLI initiated
log
Syslog logging: disabled (0 messages dropped, 3 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)

Not sure why you would want to disable the logging completely. It’s very helpful in troubleshooting and helping you understand what goes on in the network. If the logs are taking up too much space you can I crease/reduce the size it takes in the buffer on the local machine as well.

-David

[Waterbird]

Thanks, I'll try that command.  By the way, how did you find that command?  I searched the internet and could not figure out where to obtain that information.  I often find it difficult to locate information on the output of specific commands for IOS-XE by using google.

The main reason to disable it would be to verify what the output actuall means, to confirm basically what you are saying it means, to prove for a security audit that that's what the command output really means, and to therefore check a box that syslog is operational on the device for the auditors.  No operational value that I can think of, either, to disabling syslog.

Another issue with the show logging command is the ouptut says "audit disabled" next to some of the lines in the output.  Do know what that is for?  It seems that when a trap is configured it starts working, yet at the same time says audit disabled in the show logging output.  I have seen others with this question in this forum but it has unfortunately not yet been difintively answered:  

https://community.cisco.com/t5/network-management/show-logging-output-meaning-of-audit-disabled/td-p/4500658

[David Ruess]

I'm not as familiar with the logging structure so not sure about the audit disabled part. I did google the answer kind of, but I also tested on a home lab and just played around with settings in the logging structure and turned stuff off/on and then did a show log to see if it was disabled.

This is the best documentation I could find:

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/esm/configuration/xe-17/esm-xe-17-book/log-local-nonvol.html#GUID-1DE525F5-41EF-452D-A7A9-7C1D9798C965

I know its not much but hopefully it helps some.