Examkin

Question

Difficulty: Very hardSyslog Operations, Severity Levels, and Log Destination Configuration

A Cisco IOS router is configured with the following logging parameters:

text
logging buffered warnings
logging trap 3
logging monitor notifications

An engineer connects to the router over SSH, enters privileged EXEC mode, and executes the command `terminal monitor`. Shortly after, the following two syslog events occur on the router in rapid succession:

1. `%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down`
2. `%LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down`

Which logging destination(s) will successfully display or store BOTH of these log events?

  1. Only the active SSH sessionAnswer
  2. B
    Both the internal logging buffer and the active SSH session
  3. C
    Only the remote syslog server
  4. D
    The internal logging buffer, remote syslog server, and active SSH session

Answer

Only the active SSH session will display both events.
Cisco IOS syslog severity levels range from 0 (Emergency, most critical) to 7 (Debugging, least critical). When a threshold is set for a logging destination, messages with severity numbers less than or equal to that threshold are logged. Event 1 has severity 5 (Notifications) and Event 2 has severity 3 (Errors). The SSH session monitoring threshold is set to notifications (level 5), which accepts severity levels 0, 1, 2, 3, 4, and 5. Thus, both events are displayed in the terminal session after executing `terminal monitor`.

Step-by-Step Solution

1
Identify the severity level of each generated log message from its header mnemonic.
Event 1 (%LINEPROTO-5-UPDOWN) has a severity level of 5 (Notice / Notifications). Event 2 (%LINK-3-UPDOWN) has a severity level of 3 (Error / Errors).
Cisco IOS syslog messages encode the severity level as a single digit between the facility name and the mnemonic string.
2
Evaluate Cisco IOS syslog severity filtering rules.
A destination configured for severity level NN will record or display all messages with severity levels from 0 (Emergency) up to and including NN. Messages with numerical severity greater than NN are filtered out.
Lower numerical severity values indicate higher criticality in the Syslog standard.
3
Analyze each configured logging destination against the two events.
- Internal Buffer (`logging buffered warnings` = level 4): Stores levels 0–4. Captures Event 2 (level 3), drops Event 1 (level 5).
- Remote Syslog Server (`logging trap 3` = level 3): Captures levels 0–3. Captures Event 2 (level 3), drops Event 1 (level 5).
- SSH Session (`logging monitor notifications` = level 5, enabled via `terminal monitor`): Displays levels 0–5. Captures both Event 1 (level 5) and Event 2 (level 3).
Only level 5 threshold includes both level 3 and level 5 messages.

Key Concept

Cisco IOS Syslog Severity Hierarchy and Destination Filtering
Rate this question

Topics

Syslog Operations, Severity Levels, and Log Destination Configuration

More questions from this topic