Re: how to enable syslog and prevent syslog messages from

There are 4 independent forms of logging, all of which can have their
own logging level.

(Practical knowledge, not so much ccie)

logging console <on by default at debugging level>
logging console should ALWAYS be turned off. Every line (or character,
can't remember) is sent as an interrupt to the CPU. This is the
reasons debugs crash routers. Turn this off. This only sends it to
'line con 0', even when there isn't anything connected.

logging monitor <on by default at debugging level>
This applies to your SSH/telnet connections when you use the 'terminal
monitor' command. If you're doing a very large amount of debugs, you
probably want to turn this off. Generally this is alright.

logging buffered <platform specific, sometimes 4096 bytes at
informational level, other times off>
This is the preferred way of collecting intensive debugs as the router
writes the debugs directly to RAM. Default size is 4096, which really
isn't enough for much. I like it because you can use the include,
exclude, begin, and section keywords with the 'show logging' command.
I've run 'debug all' with just logging buffered on and the router was
fine. It was a low volume router, but it still illustrates the point.

logging <ip or dns name, off by default>
This is the logging that will send the messages to a syslog. The
level for this is set with 'logging trap <level>'. The default level
is informational, and is set for all syslog servers. If you're
running a ton of debugs, you will almost assuredly drop messages using
syslog. Syslogging is built for periodic informational debugs like
CDR and the likes.

General notes:
If you're running a lot of debugs you'll want to make sure 'no logging
rate' is enabled.
'service sequence' is awesome to make sure you're not losing debugs to
logging rate or packet loss
Each one of the 4 logging methods before can be set to its own level.
You can set the logging trap to debugging while having your console
and monitor to informational.
I suggest using telnet/ssh and the 'terminal monitor' command and
disabling logging console. For lab purposes logging console is fine.

In short I think you're looking for:
logging console informational
logging monitor informational
logging 1.1.1.1 ! syslog
logging trap debugging

Personal preference:
no logging monitor
no logging console
no logging rate
service sequence
service timestamps debug datetime msec local
logging buffered 2000000 debugging

-nick

On Sun, May 17, 2009 at 1:23 PM, Bhuvanesh Rajput <ashu2084_at_gmail.com> wrote:
> You just try by enabling logging buffered. Even after enabling this
> feature some how you won't see dubug on con ..... but you can find
> them in sh logging..
>
> Hope it will help you.
>
> Brgds
> Bhuvanesh
>
> CCIE R&S # 24341
>
> On Thu, Apr 16, 2009 at 10:38 PM, jeremy co <jeremy.cool14_at_gmail.com> wrote:
>> Well ,
>>
>> I want to enable accounting on my gateway by:
>>
>> gw-accounting syslog
>>
>> syslog x.x.x.x
>>
>>
>> so every time call goes through router ,ruter generate CDR of call and send
>> it to syslog. problem is this ugly CDR log comes up to my console.
>>
>> I want router just send this msg to syslog serverand I can keep my console
>> clean, so it doesn't bother me when I do debgging on other stuff.
>>
>>
>> Any idea?
>>
>>
>> Jeremy
>>
>>
>>
>>
>>
>>
>> On Fri, Apr 17, 2009 at 2:48 AM, Bryan Bartik <bbartik_at_ipexpert.com> wrote:
>>
>>> Hi Jeremy,
>>>
>>> Not entirely sure I understand but it sounds like you only want debugs to
>>> show up on the console, and not the other logging levels. As far as I know,
>>> enabling a certain level includes all the lower ones as well. Once you
>>> enable debugging to the console, you enable everything else. Remember debug
>>> is just syslog level 7.
>>>
>>>
>>> Bryan Bartik
>>> CCIE #23707, CCNP
>>> Sr. Support Engineer - IPexpert, Inc.
>>> URL: http://www.IPexpert.com
>>>
>>> On Thu, Apr 16, 2009 at 9:38 AM, rakesh m <raaki.88_at_gmail.com> wrote:
>>>
>>>> i have never tried the options listed but i think the below command should
>>>> meet your requirements
>>>>
>>>> Router(config)#logg con ?
>>>> <0-7> Logging severity level
>>>> alerts Immediate action needed (severity=1)
>>>> critical Critical conditions (severity=2)
>>>> debugging Debugging messages (severity=7)
>>>> discriminator Establish MD-Console association
>>>> emergencies System is unusable (severity=0)
>>>> errors Error conditions (severity=3)
>>>> filtered Enable filtered logging
>>>> guaranteed Guarantee console messages
>>>> informational Informational messages (severity=6)
>>>> notifications Normal but significant conditions (severity=5)
>>>> warnings Warning conditions (severity=4)
>>>> xml Enable logging in XML
>>>> <cr>
>>>>
>>>>
>>>> Blogs and organic groups at http://www.ccie.net
>>>>
>>>> _______________________________________________________________________
>>>> Subscription information may be found at:
>>>> http://www.groupstudy.com/list/CCIELab.html
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>
>>>
>>> --
>>
>>
>> Blogs and organic groups at http://www.ccie.net
>>
>> _______________________________________________________________________
>> Subscription information may be found at:
>> http://www.groupstudy.com/list/CCIELab.html
>
>
> Blogs and organic groups at http://www.ccie.net
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html

Blogs and organic groups at http://www.ccie.net
Received on Sun May 17 2009 - 19:54:06 ART