3

We use the Cisco C2960X switch.

Query 1: What does console, monitor, buffer & exception logging mean?

Query 2: Capture logging to 192.168.X.X which means if the switch sends logs to the SYSLOG server?

Query 3: What is the command to show all switching logs from the console port?

Query 4: How to find out if the switch is already configured to store logs inside the switch or SYSLOG server?

When checking the Show logging command, the messages were discovered.

SW1#sh logging
Syslog logging: enabled (0 messages dropped, 1 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)

No Active Message Discriminator.

No Inactive Message Discriminator.

    Console logging: level debugging, 46352 messages logged, xml disabled,
                     filtering disabled
    Monitor logging: level debugging, 0 messages logged, xml disabled,
                     filtering disabled
    Buffer logging:  level debugging, 46352 messages logged, xml disabled,
                    filtering disabled
    Exception Logging: size (4096 bytes)
    Count and timestamp logging messages: disabled
    File logging: disabled
    Persistent logging: disabled

No active filter modules.

     Trap logging: level informational, 46354 message lines logged
       Logging to 192.168.x.x  (udp port 514, audit disabled,
              link up),
               9522 message lines logged, 
              0 message lines rate-limited, 
              0 message lines dropped-by-MD, 
              xml disabled, sequence number disabled
               filtering disabled
         Logging Source-Interface:       VRF Name:
 Log Buffer (4096 bytes):
 Mar 10 00:35:14.895: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/12, changed state to down
 Mar 10 00:35:18.174: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/12, changed state to up
 Mar 10 00:35:19.173: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/12, changed state to up
 Mar 10 01:26:21.973: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/17, changed state to down
 Mar 10 01:26:22.976: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/17, changed state to down
 Mar 10 01:26:49.414: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/17, changed state to up
 Mar 10 01:26:51.452: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/17, changed state to down
 Mar 10 01:26:53.738: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/17, changed state to up
 Mar 10 01:26:54.737: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/17, changed state to up
 Mar 10 01:27:31.294: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/17, changed state to down
 Mar 10 01:27:33.297: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/17, changed state to up
 Mar 11 01:16:44.496: %SYS-5-CONFIG_I: Configured from console by locadmin on console

1 Answer 1

5

Query 1: What does console, monitor, buffer & exception logging mean?

The console is the console line interface. When console logging is enabled, log messages are sent to the serial console line.

Monitor logging means the log messages are sent to the VTY line.

Buffer logging means the log messages are sent to the device logging buffer (limited by the configured logging buffer size).

The exception logging size is the amount of the buffer sent to the console in the event of a system crash.

Query 2: Capture logging to 192.168.X.X which means if the switch sends logs to the SYSLOG server?

Yes. The Syslog logging: enabled shows that logging to a syslog server is enabled, and Logging to 192.168.x.x shows the syslog server address configured. (by the way, you do not need to obfuscate such Private addressing, only public addresses and passwords.)

Query 3: What is the command to show all switching logs from the console port?

That is the show logging command from the console that you ran. It shows all the log messages in the logging buffer. The logging buffer stores the last log messages up to the limit of the configured logging buffer size. Increase the logging buffer size to store more messages, but understand that will take RAM that could be used for other processes.

Query 4: How to find out if the switch is already configured to store logs inside the switch or SYSLOG server?

The switch will store log messages in its logging buffer up to the size of the configured logging buffer (removing older messages as new messages come in beyond the size of the logging buffer). The switch will also send the log messages to the configured syslog server if that is enabled.

2
  • 2
    It should be noted that the switch does not connect to the syslog server. It sends UDP packets to the configured server blindly, regardless if there is a syslog server running on that IP address, or whether the destination exists at all. And if there is nothing there, the switch will not alert you to that unless you have some debugging turned on.
    – Bib
    Mar 14 at 13:22
  • Thank you for giving me this information
    – sparasan
    Mar 22 at 3:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.