A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Every log message follows a format: `*timestamp: %FACILITY-SEVERITY-MNEMONIC: message text`. The facility (%LINK, %OSPF, %SYS) tells you which subsystem generated it. Severity is a number 0-7. Mnemonic is a short identifier. The message text carries the details.
| Level | Name | Meaning | Example |
|---|---|---|---|
| 0 | Emergency | System unusable | Device crashing |
| 1 | Alert | Immediate action needed | Interface down critical |
| 2 | Critical | Critical condition | Router memory exhausted |
| 3 | Error | Error condition | Interface failed |
| 4 | Warning | Warning condition | Duplicate IP detected |
| 5 | Notification | Normal but significant | Interface up/down, OSPF neighbor change |
| 6 | Informational | Informational | Config change, access list matches |
| 7 | Debugging | Debug output | Output of debug commands |
Lower numbers are more severe. Level 0 is worst; level 7 is most verbose. Most devices are configured to log levels 0–5 to local buffer and 0–6 to a remote server. Debug (7) is rarely logged by default because of volume — it's only enabled per-feature when troubleshooting.
! Enable timestamps on log messagesR1(config)# service timestamps log datetime msec localtime show-timezone! Configure local bufferR1(config)# logging buffered 16384 informational! Send logs to a remote syslog serverR1(config)# logging host 10.10.20.100R1(config)# logging trap informational! Add a source interface for the logsR1(config)# logging source-interface loopback0! VerifyR1# show logging | include host
Always configure timestamps. Without them, log correlation across devices is impossible — you have messages but no way to order them. The `service timestamps log datetime msec localtime show-timezone` command is the standard — millisecond precision, local time with timezone.
Finish the lesson once you have worked through the material. This awards ★ 30 XP.