RE: what is facility in the command logging facility?

From: Bryant, Paul M (paul.m.bryant@uk.mci.com)
Date: Wed Jan 04 2006 - 07:29:17 GMT-3

Hi Tim

Thanks very much for response. I understand what it is about now.

Thanks

Paul

-----Original Message-----
From: Tim [mailto:ccie2be@nyc.rr.com]
Sent: 03 January 2006 18:58
To: Bryant, Paul M; 'Montiean'; 'Ashok M A'; ccielab@groupstudy.com
Subject: RE: what is facility in the command logging facility?

Hi Paul,

Those people who wrote IOS, assigned various trap levels to various events.
For example, if an interface goes up or down (link state change), that's
considered by IOS to be (I believe) a "Normal but significant conditions".
Why? Because the writers of IOS decided that.

Now, you don't have any say in how IOS categorizes the system messages. All
you get to decide is which level and lower you want IOS to save or send
somewhere.

So, for example, if you want to see all system messages that are
informational, you'll select severity 6. But, IOS will also send severity
5, 4, 3, 2, 1, and 0.

You don't have any choice about that either AFAIK. (Maybe there's some means
of filtering but if so, that's done outside of the standard logging
commands.)

If you're curious, you can see ALL the system messages and how they're
categorized. Just follow this link:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios124/124sup/124sm
s/124smsv1/sm_over1.htm

BTW, if you're planning on taking the ccie lab, you might want to survey the
system messages related to things like ospf, frame relay, ip addressing,
etc, just to get an idea of what's there.

There's also a decent explanation of IOS logging at that link as well.

I'll just add 1 more thought about facility which might put things in better
context.

Imagine a large data processing shop with lots of servers and other devices.
All or most of these devices can also be configured to log system messages
to a syslog server. If all these messages from all these different devices
were ending up in 1 big file, it might be quite confusing. There could be
oracle messages, sql server messages, ACS messages, and on and on all mixed
together in this one huge file. By having this thing called "facility",
you're able to keep all these syslog messages separate which could be useful
especially if different people review the logs. The Oracle admin probably
doesn't want to see the router messages.

HTH, Tim

-----Original Message-----
From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On Behalf Of
Bryant, Paul M
Sent: Tuesday, January 03, 2006 1:03 PM
To: 'Montiean'; Ashok M A; ccielab@groupstudy.com
Subject: RE: what is facility in the command logging facility?

Hi all

On a related subject. I have seen questions in some of the workbooks which
ask you to enable logging for certain events. Now I guess they mean logging
traps, but does anyone know what actually constitutes each of the levels
below. I have done some searches but cannot find a definition.

Here are the groups I mean.

R2(config)#logging trap ?
  <0-7> Logging severity level
  alerts Immediate action needed (severity=1)
  critical Critical conditions (severity=2)
  debugging Debugging messages (severity=7)
  emergencies System is unusable (severity=0)
  errors Error conditions (severity=3)
  informational Informational messages (severity=6)
  notifications Normal but significant conditions (severity=5)
  warnings Warning conditions (severity=4)
  <cr>

Can you define these somewhere or is there a list somewhere in the depths of
CCO. Or are these something else entirely and I am missing the point.

This could be a silly question that is easily answered but to me it seems
puzzling.

Any help would be much appreciated.

Thanks

Paul

-----Original Message-----
From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On Behalf Of
Montiean
Sent: 02 January 2006 16:36
To: Ashok M A; ccielab@groupstudy.com
Subject: Re: what is facility in the command logging facility?

Assuming we configured the syslog server to have each facility locating in
seperate file. For an example, facility local0 is located in file name
local0, facility local1 is in local1 file, facility local2 is in local2
file. If you are familiar with unix, it would be easy to see it. Then we
decide to configured cisco to send logging to facility local2 which mean the

messages will get into local2 file.

logging facility local2

Now you have to decide what level of the messages that we need to send and
locate in that local2 file. Asssume we need to send only level 4 and below
so we use

logging trap warning

Does this help?

Montiean
From: "Ashok M A" <maashok@cyberwerx.com>
To: <ccielab@groupstudy.com>
Sent: Monday, January 02, 2006 8:09 AM
Subject: what is facility in the command logging facility?

> Hi,
>
> I have question on where the command logging facility and logging trap
> should be used? I can't make out what exactly is logging facility
> command mean?
>
> Answers from you are appreciated.
>
> Ashok
>
> ______________________________________________________________________
> _
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html

This archive was generated by hypermail 2.1.4 : Wed Feb 01 2006 - 07:45:47 GMT-3