Examkin

Question

Difficulty: HardSyslog Operations, Severity Levels, and Log Destination Configuration

A network engineer applies the following logging configuration to a Cisco IOS router:

text
logging buffered 8192 notifications
logging trap 4
logging host 172.16.10.50

Shortly after applying this configuration, the router experiences several events and generates the following syslog messages:

1. `%SYS-5-CONFIG_I: Configured from console by admin on vty0 (192.168.1.10)`
2. `%LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down`
3. `%SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 172.16.10.50 started`
4. `%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down`

Which syslog message will be successfully transmitted to the remote syslog server at 172.16.10.50?

  1. Only the %LINK-3-UPDOWN messageAnswer
  2. B
    Only the %SYS-5-CONFIG_I, %SYS-6-LOGGINGHOST_STARTSTOP, and %LINEPROTO-5-UPDOWN messages
  3. C
    All four syslog messages
  4. D
    None of the messages, because severity level 4 excludes errors

Answer

Only the %LINK-3-UPDOWN message will be transmitted to the syslog server.
The option specifying that only the link state message (%LINK-3-UPDOWN) will be sent is correct. Cisco IOS syslog trap logging forwards messages whose numeric severity level is less than or equal to the configured trap level. With 'logging trap 4' configured, messages with severity levels 0, 1, 2, 3, and 4 are forwarded. %LINK-3-UPDOWN has a severity code of 3 (Error), which is within this threshold.

Step-by-Step Solution

1
Analyze the syslog trap destination command and identify its severity threshold.
The command 'logging trap 4' sets the trap severity threshold to level 4 (warnings).
The 'logging trap' command controls which log severity levels are forwarded to configured remote syslog hosts.
2
Determine the range of numeric severity levels sent under threshold level 4.
Messages with severity levels 0 (Emergency), 1 (Alert), 2 (Critical), 3 (Error), and 4 (Warning) are forwarded to the remote host. Messages with severity levels 5, 6, and 7 are dropped.
Syslog numeric codes run inversely to priority: 0 is the most urgent and 7 is the least urgent (debugging). A threshold permits all logs with a numeric code less than or equal to the specified value.
3
Evaluate each generated message against the threshold (severity <= 4).
Message 1 (%SYS-5-CONFIG_I) is level 5 (Notification) -> Excluded. Message 2 (%LINK-3-UPDOWN) is level 3 (Error) -> Included. Message 3 (%SYS-6-LOGGINGHOST_STARTSTOP) is level 6 (Informational) -> Excluded. Message 4 (%LINEPROTO-5-UPDOWN) is level 5 (Notification) -> Excluded.
Only message 2 has a numeric severity code (3) that is less than or equal to the configured trap threshold of 4.

Key Concept

Cisco IOS Syslog Severity Levels and Trap Destinations
Estimated Time:2m 0s
Rate this question

Topics

Syslog Operations, Severity Levels, and Log Destination Configuration

More questions from this topic