5

On an ASA I can change the severity of a single syslog message by doing this:

logging message 713120 level notifications

Is there a way to do this on a Cisco Router running 15.1 code? I am only collecting syslogs on level notification but the syslog I want is set for level informational. I don't want to log all informational because it becomes too much.

I'm trying this command but it's not working:

logging message %FW-6-DROP_PKT level notification
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer. – Ron Maupin Jan 5 at 19:30
2

The closest IOS equivalent to the ASA's logging message command is the Embedded Syslog Manager (ESM) feature. It offers similar capabilities, but is far more flexible (and, consequently, more complex). I've never needed to use it, but based on a quick reading of the documentation, it works like this:

  1. Create one or more logging filters in TCL. In your case, your filter will need to manipulate the message severity.
  2. Tell IOS about the filter(s) with one or more logging filter commands. The filter can be stored on local flash or can be accessed using any remote protocol supported by your device (e.g. HTTP, TFTP, etc.).
  3. Modify your logging host, logging console, etc. commands to include the filtered keyword.

The linked documentation includes an example script that modifies the message severity, which may help you get started.

0

You have a syntax issue, you need to indicate the syslog message ID, not the message itself. There may also be sub messages under "FW-6-DROP_PKT", so you might have to change multiple IDs.

logging message 713120 level notifications

This works because the ID points directly at the syslog message specifically. (see http://www.cisco.com/c/en/us/td/docs/security/asa/syslog-guide/syslogs/logmsgs.html#pgfId-4775683)

logging message %FW-6-DROP_PKT level notification

This doesn't because %FW-6-DROP_PKT is not a valid ID.

If you can paste the full syslog message(s) you're wanting to change, I could edit my answer to be a bit more helpful.

  • Here is the message from the router that I wish to alter the logging level: Nov 21 14:07:43.795 MST: %FW-6-DROP_PKT: Dropping udp session 10.2.1.1:67 255.255.255.255:68 on zone-pair ZP-INTERNET-TO-SELF class class-default due to DROP action found in policy-map with ip ident 0 – tunnelsup Nov 21 '14 at 21:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.