Hands-On Lab: Configuring Syslog

Lab Objective

Configure a router to forward its log messages to a centralized syslog server, set the logging severity level appropriately, and verify both that messages are transmitted and that they appear correctly categorized on the receiving server.

Lab Purpose

Reviewing logs on each device individually does not scale across dozens or hundreds of network devices. Centralized syslog collection lets an administrator review events from every device in one place, and understanding severity levels ensures the right amount of detail is captured without overwhelming the server with excessive noise.

Lab Topology

R1 ---- Gi0/0: 192.168.90.1/24

Syslog server: 192.168.90.50/24

Task 1: Configure Basic Addressing

Configure R1's interface connecting to the segment where the syslog server resides.

Task 2: Configure the Syslog Server Destination

Point R1 to the syslog server's IP address.

Task 3: Set the Logging Severity Level

Configure logging to send messages at the informational level and above.

Task 4: Generate a Test Log Message

Trigger an interface state change to generate a log message and confirm it appears locally.

Task 5: Verify the Message Arrives at the Syslog Server

Confirm the same message is received and logged on the syslog server.

Solution and Verification

R1(config)# interface gigabitethernet0/0
R1(config-if)# ip address 192.168.90.1 255.255.255.0
R1(config-if)# no shutdown

R1(config)# logging host 192.168.90.50

R1(config)# logging trap informational

-- Severity levels range from 0 (emergencies,
-- most severe) to 7 (debugging, most verbose)
-- -- "informational" is severity 6, capturing
-- routine operational events without the
-- excessive volume of full debug-level logging

R1(config)# interface gigabitethernet0/1
R1(config-if)# shutdown
R1(config-if)# no shutdown

*Jun 15 14:10:22.101: %LINK-3-UPDOWN: Interface
GigabitEthernet0/1, changed state to down
*Jun 15 14:10:25.204: %LINK-3-UPDOWN: Interface
GigabitEthernet0/1, changed state to up
-- Confirmed appearing in the local console
-- output first

-- On the syslog server:

Jun 15 14:10:22 192.168.90.1 %LINK-3-UPDOWN:
Interface GigabitEthernet0/1, changed state to down
Jun 15 14:10:25 192.168.90.1 %LINK-3-UPDOWN:
Interface GigabitEthernet0/1, changed state to up
-- The exact same messages arrived at the
-- centralized server, tagged with the
-- source device's address

Key Takeaway

Severity level 3 (errors) is the level assigned to this particular link state change message, and since the configured trap level (informational, severity 6) captures everything at severity 6 and more severe (lower-numbered) levels, this message and every less-severe informational event both get forwarded — understanding that lower severity numbers mean higher importance is essential for setting a logging trap level that captures what actually matters without drowning the server in noise.