Usage Guidelines
This command displays the state of syslog error and event logging, including host addresses, and which logging destinations
(console, monitor, buffer, or host) logging is enabled. This command also displays Simple Network Management Protocol (SNMP)
logging configuration parameters and protocol activity.
This command will display the contents of the standard system logging buffer, if logging to the buffer is enabled. Logging
to the buffer is enabled or disabled using the [no ]
logging
buffered command. The number of system error and debugging messages in the system logging buffer is determined by the configured size
of the syslog buffer. This size of the syslog buffer is also set using the
logging
buffered command.
To enable and set the format for syslog message time stamping, use the
service
timestamps
log command.
If debugging is enabled (using any
debug command), and the logging buffer is configured to include level 7 (debugging) messages, debug output will be included in
the system log. Debugging output is not formatted like system error messages and will not be preceded by the percent symbol
(%).
Examples
The following is sample output from the
show
logging command on a software image that supports the Embedded Syslog Manager (ESM) feature:
Router# show logging
Syslog logging: enabled (10 messages dropped, 5 messages rate-limited,
0 flushes, 0 overruns, xml disabled, filtering disabled)
Console logging: level debugging, 31 messages logged, xml disabled,
filtering disabled
Monitor logging: disabled
Buffer logging: level errors, 36 messages logged, xml disabled,
filtering disabled
Logging Exception size (8192 bytes)
Count and timestamp logging messages: disabled
No active filter modules.
Trap logging: level informational, 45 message lines logged
Log Buffer (8192 bytes):
The following example shows output from the
show
logging command after a message discriminator has been configured. Included in this example is the command to configure the message
discriminator.
c7200-3(config)# logging discriminator ATTFLTR1 severity includes 1,2,5 rate-limit 100
Specified MD by the name ATTFLTR1 is not found.
Adding new MD instance with specified MD attribute values.
Router(config)# end
Router#
000036: *Oct 20 16:26:04.570: %SYS-5-CONFIG_I: Configured from console by console
Router# show logging
Syslog logging: enabled (11 messages dropped, 0 messages rate-limited,
0 flushes, 0 overruns, xml disabled, filtering disabled)
No Active Message Discriminator.
Inactive Message Discriminator:
ATTFLTR1 severity group includes 1,2,5
rate-limit not to exceed 100 messages per second
Console logging: level debugging, 25 messages logged, xml disabled, filtering disabled
Monitor logging: level debugging, 0 messages logged, xml disabled, filtering disabled
Buffer logging: level debugging, 25 messages logged, xml disabled, filtering disabled
Logging Exception size (8192 bytes)
Count and timestamp logging messages: disabled
No active filter modules.
Trap logging: level debugging, 28 message lines logged
Logging to 172.25.126.15 (udp port 1300, audit disabled, authentication disabled, encryption disabled, link up),
28 message lines logged,
0 message lines rate-limited,
0 message lines dropped-by-MD,
xml disabled, sequence number disabled
filtering disabled
Logging to 172.25.126.15 (tcp port 1307, audit disabled, authentication disabled, encryption disabled, link up),
28 message lines logged,
0 message lines rate-limited,
0 message lines dropped-by-MD,
xml disabled, sequence number disabled, filtering disabled
Logging to 172.20.1.1 (udp port 514, audit disabled,
authentication disabled, encryption disabled, link up),
28 message lines logged,
0 message lines rate-limited,
0 message lines dropped-by-MD,
xml disabled, sequence number disabled
filtering disabled
Log Buffer (1000000 bytes):
The table below describes the significant fields shown in the output for the two preceding examples.
Table 7. show logging Field Descriptions
|
Field
|
Description
|
|
Syslog logging:
|
Shows the general state of system logging (enabled or disabled), the status of logged messages (number of messages dropped,
rate-limited, or flushed), and whether XML formatting or ESM filtering is enabled.
|
|
No Active Message Discriminator
|
Indicates that a message discriminator is not being used.
|
|
Inactive Message Discriminator:
|
Identifies a configured message discriminator that has not been invoked.
|
|
Console logging:
|
Logging to the console port. Shows “disabled” or, if enabled, the severity level limit, number of messages logged, and whether
XML formatting or ESM filtering is enabled.
Corresponds to the configuration of the
logging
console ,
logging
console
filtered , or
logging
console
xml command.
|
|
Monitor logging:
|
Logging to the monitor (all TTY lines). Shows “disabled” or, if enabled, the severity level limit, number of messages logged,
and whether XML formatting or ESM filtering is enabled.
Corresponds to the configuration of the
logging
monitor ,
logging
monitor
filtered or
logging
monitor
xml command.
|
|
Buffer logging:
|
Logging to the standard syslog buffer. Shows “disabled” or, if enabled, the severity level limit, number of messages logged,
and whether XML formatting or ESM filtering is enabled.
Corresponds to the configuration of the
logging
buffered ,
logging
buffered
filtered , or
logging
buffered
xml command.
|
|
Trap logging:
|
Logging to a remote host (syslog collector). Shows “disabled” or, if enabled, the severity level limit, number of messages
logged, and whether XML formatting or ESM filtering is enabled.
(The word “trap” means a trigger in the system software for sending error messages to a remote host.)
Corresponds to the configuration of the
logging
host command. The severity level limit is set using the
logging
trap command.
|
|
SNMP logging
|
Displays whether SNMP logging is enabled, the number of messages logged, and the retransmission interval. If not shown on
your platform, use the
show
logging
history command.
|
|
Logging Exception size (8192 bytes)
|
Corresponds to the configuration of the
logging
exception command.
|
|
Count and timestamp logging messages:
|
Corresponds to the configuration of the
logging
count command.
|
|
No active filter modules.
|
Appears if no syslog filter modules are configured with the
logging
filter command.
Syslog filter modules are Tcl script files used when the Embedded Syslog Manager (ESM) is enabled. ESM is enabled when any
of the
filtered keywords are used in the logging commands.
If configured, the URL and filename of configured syslog filter modules will appear at this position in the output. Syslog
filter modules are executed in the order in which they appear here.
|
|
Log Buffer (8192 bytes):
|
The value in parentheses corresponds to the configuration of the
logging
buffered
buffer-size command. If no messages are currently in the buffer, the output ends with this line. If messages are stored in the syslog
buffer, they appear after this line.
|
The following example shows that syslog messages from the system buffer are included, with time stamps. In this example,
the software image does not support XML formatting or ESM filtering of syslog messages.
Router# show logging
Syslog logging:enabled (2 messages dropped, 0 flushes, 0 overruns)
Console logging:disabled
Monitor logging:level debugging, 0 messages logged
Buffer logging:level debugging, 4104 messages logged
Trap logging:level debugging, 4119 message lines logged
Logging to 192.168.111.14, 4119 message lines logged
Log Buffer (262144 bytes):
Jul 11 12:17:49 EDT:%BGP-4-MAXPFX:No. of prefix received from 209.165.200.225
(afi 0) reaches 24, max 24
! THE FOLLOWING LINE IS A DEBUG MESSAGE FROM NTP.
! NOTE THAT IT IS NOT PRECEEDED BY THE % SYMBOL.
Jul 11 12:17:48 EDT: NTP: Maxslew = 213866
Jul 11 15:15:41 EDT:%SYS-5-CONFIG:Configured from
tftp://host.com/addc5505-rsm.nyiix
.Jul 11 15:30:28 EDT:%BGP-5-ADJCHANGE:neighbor 209.165.200.226 Up
.Jul 11 15:31:34 EDT:%BGP-3-MAXPFXEXCEED:No. of prefix received from
209.165.200.226 (afi 0):16444 exceed limit 375
.Jul 11 15:31:34 EDT:%BGP-5-ADJCHANGE:neighbor 209.165.200.226 Down BGP
Notification sent
.Jul 11 15:31:34 EDT:%BGP-3-NOTIFICATION:sent to neighbor 209.165.200.226 3/1
(update malformed) 0 bytes
.
.
.
The software clock keeps an “authoritative” flag that indicates whether the time is authoritative (believed to be accurate).
If the software clock has been set by a timing source (for example, via Network Time Protocol (NTP), the flag is set. If the
time is not authoritative, it will be used only for display purposes. Until the clock is authoritative and the “authoritative”
flag is set, the flag prevents peers from synchronizing to the software clock.
The table below describes the symbols that precede the time stamp.
Table 8. Time-Stamping Symbols for Syslog Messages
|
Symbol
|
Description
|
Example
|
|
*
|
Time is not authoritative: the software clock is not in sync or has never been set.
|
*15:29:03.158 UTC Tue Feb 25 2003:
|
|
(blank)
|
Time is authoritative: the software clock is in sync or has just been set manually.
|
15:29:03.158 UTC Tue Feb 25 2003:
|
|
.
|
Time is authoritative, but NTP is not synchronized: the software clock was in sync, but has since lost contact with all configured
NTP servers.
|
.15:29:03.158 UTC Tue Feb 25 2003:
|
The following is sample output from the
show
logging
summary
command for a Cisco 12012 router. A number in the column indicates that the syslog contains that many messages for the line
card. For example, the line card in slot 9 has 1 error message, 4 warning messages, and 47 notification messages.
Note
|
For similar log counting on other platforms, use the
show
logging
count command.
|
Router# show logging summary
+-----+-------+-------+-------+-------+-------+-------+-------+-------+
SLOT | EMERG | ALERT | CRIT | ERROR |WARNING| NOTICE| INFO | DEBUG |
+-----+-------+-------+-------+-------+-------+-------+-------+-------+
|* 0* | . | . | . | . | . | . | . | . |
| 1 | | | | | | | | |
| 2 | | | | 1 | 4 | 45 | | |
| 3 | | | | | | | | |
| 4 | | | | 5 | 4 | 54 | | |
| 5 | | | | | | | | |
| 6 | | | | | | | | |
| 7 | | | | 17 | 4 | 48 | | |
| 8 | | | | | | | | |
| 9 | | | | 1 | 4 | 47 | | |
| 10 | | | | | | | | |
| 11 | | | | 12 | 4 | 65 | | |
+-----+-------+-------+-------+-------+-------+-------+-------+-------+
Router#
The table below describes the logging level fields shown in the display.
Table 9. show logging summary Field Descriptions
|
Field
|
Description
|
|
SLOT
|
Indicates the slot number of the line card. An asterisk next to the slot number indicates the GRP card whose error message
counts are not displayed. For information on the GRP card, use the
show
logging command.
|
|
EMERG
|
Indicates that the system is unusable.
|
|
ALERT
|
Indicates that immediate action is needed.
|
|
CRIT
|
Indicates a critical condition.
|
|
ERROR
|
Indicates an error condition.
|
|
WARNING
|
Indicates a warning condition.
|
|
NOTICE
|
Indicates a normal but significant condition.
|
|
INFO
|
Indicates an informational message only.
|
|
DEBUG
|
Indicates a debugging message.
|