How do I check if a Cisco switch is connected to a SYSLOG server?

[bradley.willis891]

We use the Cisco C2960X switch.

Query 1: What does console, monitor, buffer & exception logging mean?

Query 2: Capture logging to 192.168.X.X which means if the switch sends logs to the SYSLOG server?

Query 3: What is the command to show all switching logs from the console port?

Query 4: How to find out if the switch is already configured to store logs inside the switch or SYSLOG server?

When checking the Show logging command, the messages were discovered.

SW1#sh logging
Syslog logging: enabled (0 messages dropped, 1 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)

No Active Message Discriminator.

No Inactive Message Discriminator.

    Console logging: level debugging, 46352 messages logged, xml disabled,
                     filtering disabled
    Monitor logging: level debugging, 0 messages logged, xml disabled,
                     filtering disabled
    Buffer logging:  level debugging, 46352 messages logged, xml disabled,
                    filtering disabled
    Exception Logging: size (4096 bytes)
    Count and timestamp logging messages: disabled
    File logging: disabled
    Persistent logging: disabled

No active filter modules.

     Trap logging: level informational, 46354 message lines logged
       Logging to 192.168.x.x  (udp port 514, audit disabled,
              link up),
               9522 message lines logged, 
              0 message lines rate-limited, 
              0 message lines dropped-by-MD, 
              xml disabled, sequence number disabled
               filtering disabled
         Logging Source-Interface:       VRF Name:
 Log Buffer (4096 bytes):
 Mar 10 00:35:14.895: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/12, changed state to down
 Mar 10 00:35:18.174: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/12, changed state to up
 Mar 10 00:35:19.173: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/12, changed state to up
 Mar 10 01:26:21.973: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/17, changed state to down
 Mar 10 01:26:22.976: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/17, changed state to down
 Mar 10 01:26:49.414: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/17, changed state to up
 Mar 10 01:26:51.452: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/17, changed state to down
 Mar 10 01:26:53.738: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/17, changed state to up
 Mar 10 01:26:54.737: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/17, changed state to up
 Mar 10 01:27:31.294: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/17, changed state to down
 Mar 10 01:27:33.297: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/17, changed state to up
 Mar 11 01:16:44.496: %SYS-5-CONFIG_I: Configured from console by locadmin on console

[marce1000]

 - A switch is actually never connected to  a syslog server  ,  permanently. What you do is  - configuring a syslog server in the running config and then the switch will use it for forwarding logging-messages when necessary.

 M.

[balaji.bandi]

Trap logging: level informational, 46354 message lines logged
       Logging to 192.168.x.x  (udp port 514, audit disabled,

as per the information the switch is configured logging server, check the is the switch able to ping syslog server ?

[Richard Burts]

The original poster asks several questions. Here are my responses:

1: What does console, monitor, buffer & exception logging mean? console configures what log messages are sent to the console port. monitor configures what log messages are displayed if you have remote access to the device and use the command terminal monitor. buffer configures what log messages are stored in the memory of the device. These messages are displayed using the command show log.

2: Capture logging to 192.168.X. X which means if the switch sends logs to the SYSLOG server? I am not sure what "capture logging" is about. But yes syslog messages are being sent to that address.

3: What is the command to show all switching logs from the console port? If you are connected to the console port then you are already seeing the log messages from logging console. You could use the command show log from the console and see the messages in the logging buffer. I do not believe that terminal monitor is supported on the console so you can not see the log monitor messages from the console. From the console you would not be able to see the messages sent to the syslog server.

4: How to find out if the switch is already configured to store logs inside the switch or SYSLOG server? In the first page or so of output from the command show log would provide the answers to these questions about storing logs in the switch and about sending logs to a server.