Syslog¶
Syslog is how a device reports events — link up/down, config changes, security violations, errors — as timestamped messages, either kept in a local buffer or sent to a central server. A central syslog server is often the only way to reconstruct what actually happened across multiple devices after the fact.
Severity Levels¶
Every syslog message has a severity level from 0 (most severe) to 7 (least):
| Level | Name | Example |
|---|---|---|
| 0 | Emergency | System unusable |
| 1 | Alert | Immediate action needed |
| 2 | Critical | Critical condition |
| 3 | Error | Error condition |
| 4 | Warning | Warning condition |
| 5 | Notice | Normal but significant |
| 6 | Informational | Informational messages |
| 7 | Debug | Debug-level messages |
Filtering by level (logging trap <level> or logging console <level>) sets a threshold — that level and everything more severe (lower-numbered) is sent, everything less severe is dropped.
Configuration¶
Already introduced in Security Hardening:
Cisco IOS — global configuration mode (conf t):
logging 10.0.99.5
logging source-interface Vlan99
! Send level 6 (informational) and more severe
logging trap informational
logging source-interface matters more than it looks — without it, the source IP on syslog messages can vary depending on which interface routed the packet, making it harder to filter/identify messages from a specific device at the receiving server.
Local Buffer¶
Even without a remote server, IOS keeps a local ring buffer of recent messages:
Cisco IOS — global configuration mode (conf t):
! Increase buffer size (bytes) and set the level
logging buffered 16384 informational
Cisco IOS — privileged EXEC:
! View the local buffer
show logging
Useful for a quick local check without needing the central server reachable.
Multi-Device Setup¶
The Netgate firewall should point at the same syslog server as the Cisco switch — see Netgate 6100 MAX Administration — so a single timeline covers the whole stack instead of having to correlate two separate log sources by hand. Set NTP correctly on every device first (see Netgate initial configuration); mismatched clocks make correlating events across devices unreliable.
NTP alone isn't the whole story on the Cisco side: by default IOS stamps log messages in UTC with no timezone shown, while the Netgate logs in its configured local timezone — so the two timelines can sit hours apart even with perfect NTP sync. Fix it on the switch:
Cisco IOS — global configuration mode (conf t):
! Stamp log messages in local time, with the zone shown
! (requires clock timezone to be configured)
service timestamps log datetime msec localtime show-timezone
Verification¶
Cisco IOS — privileged EXEC:
! Local buffer + current logging config summary
show logging
show logging | include %
The second command filters to actual event messages — Cisco system messages contain %FACILITY-SEVERITY-MNEMONIC.
Over SSH, log messages don't appear in your session by default — they only go to the physical console. Run terminal monitor (privileged EXEC) to see them live in the session; terminal no monitor turns it off again.
On the syslog server itself, confirm messages are actually arriving — a switch configured to log to a server that's unreachable fails silently from the switch's perspective.