Syslog levels

[aweise]

On our core network devices, we are running HSRP in a number of spots. I'm of the impression that we'd need to set the syslog level to be at least level 6 (informational messages) so that we would see any HSRP state changes. I've confirmed that the logging buffered level is set to 5 (notifications), yet I do see some %STANDBY-6-STATECHANGE logs in the switch. Would a "logging facility local6" actually override the "logging buffered notificiations" setting, thus allowing the HSRP state changes to be logged?

[Richard Burts]

If you have logging buffered notification configured then I would be extremely surprised to see informational messages in the log buffer. If you would post the first group of lines from the output of show log we might understand better how logging is configured.

Is it possible that the logging buffer is just recording notification level messages and you are seeing messages through some other logging mechanism (through terminal monitor on a remote connection, through messages to the console, or on a syslog server)?

I would not expect the logging facility local6 to interact with the logging buffered command.

HTH

Rick

[aweise]

Here we are:

switch#sh logging

Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns)

Console logging: level notifications, 24706 messages logged

Monitor logging: level debugging, 2890 messages logged

Buffer logging: level notifications, 24706 messages logged

Exception Logging: size (4096 bytes)

Trap logging: level informational, 392707 message lines logged

The only item with informational is Trap logging. I see the logs on our Ciscoworks host, not the switch itself (sorry - didn't mention that earlier). That's only because there are enough events on this guy to fill the buffer pretty frequently.

[Richard Burts]

Trap logging controls the level of messages sent to syslog server(s). The default level for trap is Informational, which means that it will send informational (and more severe levels) to your configured syslog servers. Since you are looking at syslog messages rather than logging buffer messages I think this explains what is going on.

This output from show log indicates that the logging buffer and the console logging are restricted to notifications. But syslog is not limited.

I am not clear from the original question what you really want the behavior to be. If you really do want syslog limited to notifications then configure:

logging trap notification

If you want to see the HSRP messages in syslog then leave the config as it is.

HTH

Rick

[aweise]

My original question was really twofold: how to get the HSRP messages in the log buffer and (since I was told it would need to be level 6) why were they showing up when I had the log buffer at level 5?

Regardless, my questions have been answered. Thanks for the help!

[Richard Burts]

Just to close the loop on this discussion:

- be clear about the different destinations for log messages. They can go to the console, to logging buffered, to syslog, to terminal monitor. And they can have different severity levels for each destination.

- so if you want to see the HSRP messages in the log buffer then set logging buffered to informational. If you want to see the HSRP messages in syslog then set logging trap informational (which is the default).

The confusion (at least for me) was that the original question (and much of the following discussion) talked about what was happening in the logging buffer but you were looking at syslog. They operate independently.

HTH

Rick