So before we begin talking about how to configure logging on a Cisco device, we need to understand
what kind of logging does it do and why you want to log in the first place.
When you launch the virtual lab, go ahead and launch the virtual lab.
We'll log in to the server one RDP session right there, which is just a virtual machine
running on this box. And then we'll connect to any Cisco device. You don't have to even
use the virtual lab. If you've got physical equipment, that's fine as long as it's not WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
use the virtual lab. If you've got physical equipment, that's fine as long as it's not
in production service. The idea here is really any Cisco device will work for basically all
of the content that we're about to cover in this skill. So with any console launched up right here,
I'll just flip on over to R1, hit space bar a couple of times and bring it down. And now I'm
on R1. Great. As you can see, here we are. So what do we need to do or understand about
logging? Well, really it's important to understand why logging matters. Every good application that WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
logging? Well, really it's important to understand why logging matters. Every good application that
exists, not just Cisco's iOS and not just Windows Event Viewer or anything like that, every good
application that exists allows you to read what it's doing. It writes logs to the terminal to let
you know what it's doing. So let me show you an example here. Let's just see it in real time.
Here. Here's a production application that I run in my own business. Don't worry. There's WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
Here. Here's a production application that I run in my own business. Don't worry. There's
nothing sensitive on the screen here, but this is the applications logs that it's generating.
This is how much data it processes in real time. Thousands of things per second go on during this
application. So why does it matter? Because when things break or when something goes wrong,
I can come back to these logs and see exactly what data it was trying to process and what went wrong. WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
I can come back to these logs and see exactly what data it was trying to process and what went wrong.
I can also check and confirm that everything is going right. Logs are important. They are the
most in-depth type of information you can get on your system at any given moment.
So back on my Cisco device here, what kind of logs do we get to work with? Well, by default,
when we think about logs, what we really think about is kind of the industry standard kind of log WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
when we think about logs, what we really think about is kind of the industry standard kind of log
called syslog. Syslog allows you to write information to really anything. You can write
it to a file, you can write it to a console session or a terminal, or you can send your
syslog message to a syslog collector, basically a database where it stores all of your syslogs
from all of your devices, and then you can analyze them from one central place. Now, what you just
saw on the screen seemed like a lot of information, right? It seemed pretty verbose. There was a lot WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
saw on the screen seemed like a lot of information, right? It seemed pretty verbose. There was a lot
going on, and that's why syslog actually offers eight different levels of log information that
you might print out to the terminal. Now, the way we think about this is syslog level seven is the
broadest level of information. Syslog level zero is the most specific level of information. This is
usually in a disaster scenario. Something has failed, something has broken. Everything in WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
usually in a disaster scenario. Something has failed, something has broken. Everything in
between, you could think about it as like emergency but not broken all the way up to level six,
which is what we were just viewing, which is information. Now, seven is debugging. Usually,
we only turn debugging on when we need to see software developers use debugging,
when they are working on changing the code and they want to see every single thing that the WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
when they are working on changing the code and they want to see every single thing that the
entire software is doing one step at a time. When we don't need that level of verbosity,
when we don't need every single thing printed to the terminal but we do want important information,
we can use the information level. All the way down here at zero, we're thinking emergency
scenarios. So what does that leave in between? Check this out. If I go into configuration mode
and I say logging, monitor, and then just hit it with a question mark, you can actually see the WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
and I say logging, monitor, and then just hit it with a question mark, you can actually see the
list of everything in between right here. Now, don't worry about the command itself. We're going
to talk about that in the next video. But you can see right here, seven was debugging, six,
information, five, notification, four, warning. You can see, okay, wait, we're starting to get
new important stuff. Three, there was an error. Two, something critical has happened. One, alert,
alert, alert. Zero, you're dead, or the whole thing has died. You see zero right here. Look WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
alert, alert. Zero, you're dead, or the whole thing has died. You see zero right here. Look
at the description. System is unusable. So these syslog levels matter. Now, what you just saw on
my application that I was running, I have it logging level six and below. I can change that.
I can say only log warnings to me or only log errors to me. And that, of course, would reduce
the amount that I see on my terminal or in my file, because I'm actually writing those
logs to a file. All that's being written to a disk. Thank God for NVMe. And that's what we would see WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
logs to a file. All that's being written to a disk. Thank God for NVMe. And that's what we would see
on the terminal. Now, watch this. When I hit end right here to exit out of configuration mode, boom,
this is a log message. Now, it doesn't give me a lot of information. I don't see a timestamp of
when this log message occurred. I don't know my time zone. I don't know, well, there's all sorts
of things that I don't know. I don't even really know what log level this is, do I? So these are
things that we can change. We can get more information out of our logs, and that's what WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
things that we can change. We can get more information out of our logs, and that's what
we'll talk about in the next video. But for now, do this. Give me a show logging. And look at this.
Right here on the Cisco terminal, there are three types of logging locations. One is if you're
connected via a console cable. And right now, it is logging level debugging and below. So when you
say level debugging, that's level seven and below. It's not just debug messages. It's debug information, WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
say level debugging, that's level seven and below. It's not just debug messages. It's debug information,
warning errors, critical, and so on. Monitor logging. This is your Telnet and SSH connections.
This is anything that's line VTY. Now, it is set to level debugging. But interestingly,
when people SSH in or Telnet in, it doesn't actually log anything to the terminal.
You have to turn that on. Now, buffer logging is whenever we're exporting logs somewhere else. WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
You have to turn that on. Now, buffer logging is whenever we're exporting logs somewhere else.
Something like a syslog server. This is what is going to be stored in RAM to be exported to an
external server. You can also think about this as like SNMP traps. You'll see these considered under
buffer logging too. So the big things that you really want to focus in on are console logging
and monitor logging, because you're either going to be connecting in with a console cable,
which is going to display the messages by default, or a SSH connection, which does have WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
which is going to display the messages by default, or a SSH connection, which does have
logging enabled, but you don't see them by default. You actually have to say,
show me my log messages. In the next video, now that we understand syslog messages, the eight
levels, and how Cisco kind of breaks them up between console, monitor, and buffer, we'll take
a look at how we can customize the outputs from there.