Cisco routers log messages can handle in five different ways:
1. Console logging: By default, the router sends all log messages to its console port. Hence only the users that are physically connected to the router console port can view these messages.
2. Terminal logging: It is similar to console logging, but it displays log messages to the router's VTY lines instead. This is not enabled by default.
Use the following commands to collect the Syslog messages when you are connected to an SSH terminal.
CertExamsR1#terminal monitor
3. Buffered logging: This type of logging uses router's RAM for storing log messages. buffer has a fixed size to ensure that the log will not deplete valuable system memory. The router accomplishes this by deleting old messages from the buffer as new messages are added.
Use the following commands to store the Syslog messages in Cisco Router's / Switch's memory. "4048" is the size of memory allocated to store Syslog messages and "0" is the severity level.
CertExamsR1#configure terminal
CertExamsR1(config)#logging buffered
4048 0
CertExamsR1(config)#exit
CertExamsR1#
4. Syslog Server logging : The router can use syslog to forward log messages to external syslog servers for storage. This is considered to be the best best practice as there is no loss of data (huge storage capacities) and there is no overload on the router or switch as in the case of buffered logging. A syslog server also provides for centralized logging for all network devices.
Use the following commands to send Syslog messages to a Syslog server, configured at 192.168.1.100.
CertExamsR1#configure terminal
CertExamsR1(config)#logging 192.168.1.100
CertExamsR1(config)#exit
CertExamsR1#
5. SNMP trap logging: The router can send syslog message to an external SNMP server. This is accomplished using SNMP trap.
By default, the timestamps are in hr:min:sec. If you want to enable greater resolution, you can enable millisecond level resolution by using the command service timestamps log datetime msec
The syntax is as given below:
Router(Config)# service timestamps log {uptime |datetime [msec |localtime |show-timezone]}
