I've been trying to get our Cisco switch stacks and ASRs to output syslog messages without sequence numbers and am having a strange problem - When I use both "no logging message-counter syslog" and "no service sequence-numbers", I end up with messages looking like this:
<189>: st01-19: Jan 22 21:55:54.587: %MAB-5-FAIL: Authentication failed for client (406c.8f2d.4ed1) on Interface Gi7/0/46 AuditSessionID 0AE3AC6400000DAA298C73CE
Here is the output when "logging message-counter syslog" is left on:
<189>291486: st01-19: Jan 22 19:47:54.796: %MAB-5-FAIL: Authentication failed for client (3c07.543d.8b96) on Interface Gi1/0/35 AuditSessionID 0AE3AC6400000D86291501D7
IOS seems to be leaving a ":" after the "<189>", which doesn't play nice with RFC 3164 checks. Does anyone know if there's a way to remove that character?
