Cisco Syslog default configuration?

[Fida jlassi]

Hi All,

I run the show Log command on the cisco router 2811, the command output is bellow:

Router # show log
Syslog logging: enabled (0 messages dropped, 7 messages rate-limited, 0 flushes,
 0 overruns, xml disabled, filtering disabled)

No Active Message Discriminator.

No Inactive Message Discriminator.

    Console logging: level debugging, 56 messages logged, xml disabled,
                     filtering disabled
    Monitor logging: level debugging, 0 messages logged, xml disabled,
                     filtering disabled
    Buffer logging:  level debugging, 60 messages logged, xml disabled,
                    filtering disabled
    Exception Logging: size (4096 bytes)
    Count and timestamp logging messages: disabled
    Persistent logging: disabled
    Trap logging: level informational, 63 message lines logged

Log Buffer (4096 bytes):

I am a newbie with the cisco equipment , could you please explain if the logging feature is enabled in the router or weare using the default configuration other question is the syslog server enabled in the router?

Regards,

Fida 

[Richard Burts · Accepted solution]

Fida

I am not clear on what you are really asking. Based on the output that you posted logging is certainly enabled on the router. It appears that the router is using default parameters for logging so my guess is that there is not any configuration commands on the router for logging.

I am not understanding your question about syslog server. The IOS router can send messages to a syslog server but can not act as a syslog server. In the output that you posted the router is not configured to send syslog messages to any syslog server.

HTH

Rick

[Fida jlassi]

Hi,

Thank you Richard for the answer.

for the same router i found the following command in the config file (Cisco 2811, IOS 12.4(3i) ): 

logging buffered 51200 warnings

Is this command configured by default in the router? other question if the buffer size is fixed to 51200 in the config file  why in the "show log" output we found that the buffer size is set to 4096 bytes (refer to the previous post). Thanks.

[Richard Burts]

Fida

This is surprising and quite puzzling. The output in your first post shows clearly that the logging buffer is operating at the debug level and has a buffer of 4096. The configuration command would set the buffer size quite a bit larger (which is probably good) and would have it operate at the warning level.

I am quite puzzled how that command would be in the config but not alter the behavior of the logging process. Perhaps there is something in the context of that configuration command that might help us understand it. Could you post the section of the config in which that command is found?

HTH

Rick

[Fida jlassi]

Hi,

Bellow the section in which the command is found:

boot-start-marker
boot system flash c2800nm-advsecurityk9-mz-151-1.T4.BIN
boot-end-marker
!
logging buffered 4096
!
no aaa new-model
!
!
dot11 syslog
prompt "turt81 #"
ip source-route
!
!
ip cef

[Richard Burts]

Fida

Thank you for the additional information. The config command here is different from what you described in your previous post. This configuration command does agree with the behavior of the router in which logging buffer does operate at the debug level (the default behavior) and has a buffer of size 4096.

HTH

Rick

[Fida jlassi]

Sorry, you are right.

One other thing, what's the command to use to track the cisco users activity in the router, I mean which IP address connected to the router, the successful logins...

Thanks.

[Joseph W. Doherty]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

Tracking what a user is doing on the router is a bit involved; i.e. it's not just a single command that logs to syslog.  I believe it requires configuration of AAA.

[Richard Burts]

Fida

I believe that Joseph is describing using the Accounting function of AAA to send accounting records to the AAA server to report on user activity. And that is the more complete and sophisticated way to track user activity (it can show not only the logins with address but also other user activity).

There is a more simple solution which might provide what you are looking for. In fairly recent versions of IOS Cisco has introduced the ability to create log messages for login activity (you can log successful login and/or unsuccessful attempts to login), Check out these commands

login on-success log

login on-failure log

They do not provide nearly as much detail as the AAA accounting would, but perhaps they would give you enough to satisfy your requirement.

HTH

Rick

[Richard Burts]

Fida

I am glad that my responses were helpful. Thank you for using the rating system to mark this question as answered. This will help other readers in the forum to identify posts that have helpful information.

HTH

Rick