How do I check if a Cisco switch is connected to an SYSLOG server?

[sjarasan]

Hi everyone, We use the Cisco C2960X switch.

Query 1: What does console, monitor, buffer & exception logging mean?

Query 2: Capture logging to 192.168.X. X which means if the switch sends logs to the SYSLOG server?

Query 3: What is the command to show all switching logs from the console port?

Query 4: How to find out if the switch is already configured to store logs inside the switch or SYSLOG server?

When checking the Show logging command, the messages were discovered.

SW1#sh logging
Syslog logging: enabled (0 messages dropped, 1 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)

No Active Message Discriminator.

No Inactive Message Discriminator.

    Console logging: level debugging, 46352 messages logged, xml disabled,
                     filtering disabled
    Monitor logging: level debugging, 0 messages logged, xml disabled,
                     filtering disabled
    Buffer logging:  level debugging, 46352 messages logged, xml disabled,
                    filtering disabled
    Exception Logging: size (4096 bytes)
    Count and timestamp logging messages: disabled
    File logging: disabled
    Persistent logging: disabled

No active filter modules.

     Trap logging: level informational, 46354 message lines logged
       Logging to 192.168.x.x  (udp port 514, audit disabled,
              link up),
               9522 message lines logged, 
              0 message lines rate-limited, 
              0 message lines dropped-by-MD, 
              xml disabled, sequence number disabled
               filtering disabled
         Logging Source-Interface:       VRF Name:
 Log Buffer (4096 bytes):
 Mar 10 00:35:14.895: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/12, changed state to down
 Mar 10 00:35:18.174: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/12, changed state to up
 Mar 10 00:35:19.173: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/12, changed state to up
 Mar 10 01:26:21.973: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/17, changed state to down
 Mar 10 01:26:22.976: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/17, changed state to down
 Mar 10 01:26:49.414: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/17, changed state to up
 Mar 10 01:26:51.452: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/17, changed state to down
 Mar 10 01:26:53.738: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/17, changed state to up
 Mar 10 01:26:54.737: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/17, changed state to up
 Mar 10 01:27:31.294: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/17, changed state to down
 Mar 10 01:27:33.297: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/17, changed state to up
 Mar 11 01:16:44.496: %SYS-5-CONFIG_I: Configured from console by locadmin on console

[marce1000]

 - You can verify if the syslog server is mentioned or configured in the running-config , for the rest the volume of logs on the syslog-server will depend on the way the level of logging is chosen with the 'logging trap... ' command. (not all events are send to syslog by default)

 M.

[Richard Burts · Accepted solution]

The original poster asks several questions. Here are my responses:

1: What does console, monitor, buffer & exception logging mean? console configures what log messages are sent to the console port. monitor configures what log messages are displayed if you have remote access to the device and use the command terminal monitor. buffer configures what log messages are stored in the memory of the device. These messages are displayed using the command show log.

2: Capture logging to 192.168.X. X which means if the switch sends logs to the SYSLOG server? I am not sure what "capture logging" is about. But yes syslog messages are being sent to that address.

3: What is the command to show all switching logs from the console port? If you are connected to the console port then you are already seeing the log messages  from logging console. You could use the command show log from the console and see the messages in the logging buffer. I do not believe that terminal monitor is supported on the console so you can not see the log monitor messages from the console. From the console you would not be able to see the messages sent to the syslog server.

4: How to find out if the switch is already configured to store logs inside the switch or SYSLOG server? In the first page or so of output from the command show log would provide the answers to these questions about storing logs in the switch and about sending logs to a server.

[sjarasan]

Hi,  Thanks for the useful information.

Trap logging: level informational, 46354 message lines logged
       Logging to 192.168.x.x  (udp port 514, audit disabled,
              link up),

Trap logging,  which means if the switch sends logs to the SYSLOG server?

[Richard Burts]

That section of output indicates that the switch will attempt to send to the syslog server at 192.168.x.x syslog messages at severity level of informational or better (but for example would not send syslog messages for debug). And it has sent 46354 messages to that syslog server.

[Richard Burts]

I am glad that our explanations have been helpful. Thank you for marking this question as solved. This will help other participants in the community to identify discussions which have helpful information. This community is an excellent place to ask questions and to learn about networking. I hope to see you continue to be active in the community.