Cisco IOS - Is it possible to change severity level of a single syslog message?

Question

On an ASA I can change the severity of a single syslog message by doing this:

logging message 713120 level notifications

Is there a way to do this on a Cisco Router running 15.1 code? I am only collecting syslogs on level notification but the syslog I want is set for level informational. I don't want to log all informational because it becomes too much.

I'm trying this command but it's not working:

logging message %FW-6-DROP_PKT level notification

Answer 1

The closest IOS equivalent to the ASA's logging message command is the Embedded Syslog Manager (ESM) feature. It offers similar capabilities, but is far more flexible (and, consequently, more complex). I've never needed to use it, but based on a quick reading of the documentation, it works like this:

1. Create one or more logging filters in TCL. In your case, your filter will need to manipulate the message severity.
2. Tell IOS about the filter(s) with one or more logging filter commands. The filter can be stored on local flash or can be accessed using any remote protocol supported by your device (e.g. HTTP, TFTP, etc.).
3. Modify your logging host, logging console, etc. commands to include the filtered keyword.

The linked documentation includes an example script that modifies the message severity, which may help you get started.

Answer 2

You have a syntax issue, you need to indicate the syslog message ID, not the message itself. There may also be sub messages under "FW-6-DROP_PKT", so you might have to change multiple IDs.

logging message 713120 level notifications

This works because the ID points directly at the syslog message specifically. (see http://www.cisco.com/c/en/us/td/docs/security/asa/syslog-guide/syslogs/logmsgs.html#pgfId-4775683)

logging message %FW-6-DROP_PKT level notification

This doesn't because %FW-6-DROP_PKT is not a valid ID.

If you can paste the full syslog message(s) you're wanting to change, I could edit my answer to be a bit more helpful.