Where can I find syslog header for cisco 5520 router ?

[naidusadanala]

Hi , I am receving 5520 data via syslog . I am unable to interpret them .I am new to cisco community . Any one can please send me URL for syslog message header interpretation .

Thanks 

[omz]

General Syslog message format is - 

*Apr 14 09:40:10.326: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up

• timestamp: Apr 14 0:40:10.326
• facility: %LINEPROTO
• severity level: 5
• mnemonic: UPDOWN
• description: Line protocol on Interface GigabitEthernet0/1, changed state to up

[omz · Accepted solution]

General Syslog message format is - 

*Apr 14 09:40:10.326: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up

• timestamp: Apr 14 0:40:10.326
• facility: %LINEPROTO
• severity level: 5
• mnemonic: UPDOWN
• description: Line protocol on Interface GigabitEthernet0/1, changed state to up

Below are severity levels - 

• 0 —emergency: System unusable
• 1 —alert: Immediate action needed
• 2 —critical: Critical condition—default level
• 3 —error: Error condition
• 4 —warning: Warning condition
• 5 —notification: Normal but significant condition
• 6 —informational: Informational message only
• 7 —debugging: Appears during debugging only

[naidusadanala]

I have sample as below 

May 5 22:35:49 10.8.70.5 kc-bdf-ca10-mpus-wlc1: *Dot1x_MN_MsgTask_4: May 05 22:35:49.293: %DOT1X-3-INVALID_REPLAY_CTR: 1x_eapkey.c:452 Invalid replay counter from client 8c:a9:65:e9:65:5R

[Seb Rupik]

Hi there,

Looks like an embedded message:

Timestamp: May 5 22:35:49

Source IP: 10.8.70.5

Source hostname: kc-bdf-ca10-mpus-wlc1

WLC error code: *Dot1x_MN_MsgTask_4

Payload: May 05 22:35:49.293: %DOT1X-3-INVALID_REPLAY_CTR: 1x_eapkey.c:452 Invalid replay counter from client 8c:a9:65:e9:65:5R

See @omz message regarding the payload structure.

cheers,

Seb.