Sending Cisco logging messages to a buffer/syslog server. To console, or not to console – That is the question!

Posted by shands on June 10, 2009 · 1 Comment

So you’ve configured up your Cisco box, enabled remote access and the serial console cable is long gone. But hey – what about all those potentially crucial console messages? Well, you’ ve got a few choices…

First is to leave it as it is - going off to a serial port – but add a permanent terminal to display the results. Not very practical – especially if the router is at a remote site.

Second option is to send the messages off to a syslog server – which is good if you’ve got routers spread all over and want to report back to a central point. Ok! Time to get yourself a syslog server up and running. If you’ve not already got it, Tftpd32 has funcitionality for this (which is also useful for the transfer of IOS images – more on this some other time maybe). You can get it from http://tftpd32.jounin.net. Configuring tftpd32 is beyond the scope of this guide – but it’s easy enough. Google it if in doubt. Enter global config mode on your router (conf t) and then:

phbrouter(config)# logging <ip address of syslog server>
phbrouter(config)# exit
phbrouter# wr mem

It’s that easy! Future messages will now be directed to your syslog server.

The third option is to get the router to store messages in a buffer for retrieval later. This is really useful to debug network failure at remote sites (say for instance your remote routers can’t report back to you whats going on - because its outside link is down! You’d wait for the line to come back up, log in and check what happened). Again, this is easy to configure. Enter global config mode and:

phbrouter# conf t
phbrouter(config)# logging buffered
phbrouter(config)# exit
phbrouter# wr mem
phbrouter#

And to retrieve the messages, issue:

phbrouter#
phbrouter#sh logging
Syslog logging: enabled (11 messages dropped, 1 messages rate-limited,
                0 flushes, 0 overruns, xml disabled, filtering disabled)
    Console logging: level debugging, 4873 messages logged, xml disabled,
                     filtering disabled
    Monitor logging: level debugging, 0 messages logged, xml disabled,
                     filtering disabled
    Buffer logging: level debugging, 3 messages logged, xml disabled,
                    filtering disabled
    Logging Exception size (4096 bytes)
    Count and timestamp logging messages: disabled

No active filter modules.

    Trap logging: level debugging, 4879 message lines logged
        Logging to 192.168.0.1(global) (udp port 514, audit disabled, link up), 4879 message lines logged, xml disabled,
               filtering disabled

Log Buffer (4096 bytes):

*Jun 10 18:01:01: %SYS-5-CONFIG_I: Configured from console by admin on vty0 (192.168.0.107)
*Jun 10 18:14:57: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: admin] [Source: 192.168.0.107] [localport: 22] at 18:14:57 GMT Wed Jun 10 2009
*Jun 10 18:20:49: %SYS-5-CONFIG_I: Configured from console by admin on vty0 (192.168.0.107)

If you getting too much crap in the buffer, you can clear it by issuing the ‘clear logging’ command. Incidentally, you can set the amount of buffer space by tagging on a byte value at the end of ‘logging buffered’ (between 4096 to 2147483647).

Finally, if you’re sick of the logging messages appearing on the serial console (or if you want to hide the messages from prying eyes!) you can stop them by entering global config mode and issuing: