Cisco Certified Network Associate (CCNA) 200-301 · Free study guide

Objective 4.5 — Interpret syslog facilities and severities

Syslog carries event messages from devices to local buffers or remote collectors. Useful logging requires correct severity interpretation, synchronized time, stable identity, transport reachability, retention, and an operator workflow.

Severity scale

Syslog severities range from 0 through 7:

Lower numbers are more severe. A threshold configured at level 4 commonly includes levels 0 through 4, not 4 through 7. Exact platform syntax determines selection, so verify the operational result.

Facilities and sources

A facility identifies a generating subsystem or category. Network platforms may show mnemonics or source processes that play a similar triage role. Facility does not mean severity. Two messages from one facility can have different urgency.

Include hostname or source IP, sequence where available, timestamp, facility, severity, mnemonic, and message body when analyzing an event.

Local and remote logging

Local buffers help during immediate troubleshooting but can wrap or disappear after a reload. A remote collector centralizes retention and cross-device search. Design the source interface, routing, security policy, transport, and collector capacity. Logging over an unreliable path may lose messages during the very failure being investigated.

Time and correlation

NTP-synchronized timestamps let operators order events across devices. Include timezone or use UTC consistently. A collector receive time is not always the same as event occurrence time, especially during congestion or retry.

Worked scenario

A collector is configured for warning level but operators expect debug output. Because warning is severity 4, ordinary informational and debug messages are filtered. Raising verbosity to debugging can produce high volume, so do it only for a scoped period and confirm collector capacity. Do not reinterpret level 7 as the most urgent because it has the largest number.

Verification

Generate a safe known event, confirm it appears locally and remotely with correct source and timestamp, and test the configured threshold. Monitor message loss, collector storage, and clock state. Remove temporary debugging after evidence is captured.

Common traps

• Reversing severity order.
• Confusing facility and severity.
• Treating remote collection as guaranteed delivery.
• Correlating unsynchronized clocks.
• Leaving debug volume enabled indefinitely.

Readiness checklist

• I can order severities zero through seven.
• I can explain threshold inclusion.
• I distinguish facility from urgency.
• I verify collection, time, and retention.