First, the essential ideas
- Syslog
- Syslog carries event messages to local or remote destinations. An event message is evidence of what a component reported, not necessarily a complete explanation of its cause.
- Severity
- Severity is a numbered importance classification: 0 emergency, 1 alert, 2 critical, 3 error, 4 warning, 5 notice/notification, 6 informational and 7 debug. Lower numbers are more severe.
- Facility and mnemonic
- In Cisco text such as %LINK-5-CHANGED, LINK names the message subsystem, 5 is severity and CHANGED identifies the message kind. The transport facility such as local6 is a separate syslog classification.
- Threshold
- A logging threshold includes that numeric severity and all more severe lower numbers. Informational 6 includes 0 through 6; warnings 4 excludes severity 5 and 6.
- Collector and buffer
- A collector receives messages from other devices. A device buffer stores a limited local history that can wrap or disappear; neither is guaranteed to contain every event.
- Event time and receipt time
- Event time is the timestamp supplied by the sender. Receipt time is when the collector received the message. Different clocks and network delays can make them disagree.
- PRI and UDP
- Syslog priority PRI combines numeric transport facility and severity as facility times eight plus severity. User Datagram Protocol carries this lab's messages without delivery acknowledgement or encryption.
- Console and synthetic example
- Open each named GNS3 node's Console. IOS # allows inspection and configuration entry; Linux uses its shell. A synthetic message is an invented teaching example, not captured runtime.
The lesson uses one router and one private raw-message receiver. The receiver prints arrival time, source socket and bytes without pretending to be a production log platform. Its output can be compared with the router's buffer, but neither copy is a guaranteed complete history.
See the idea
A reported event must reach retained evidence
Generation, filtering, delivery and retention are separate steps in a logging path.
Apply the threshold
R1's informational threshold admits severity 0-6. Warnings admits only 0-4 and excludes a severity-5 loopback event.
What this model leaves out: R1-to-Collector1 is the only cable. The file is a logical storage endpoint. UDP delivery, trusted timestamps and production retention are not guaranteed.
Full visual explanation and references
R1 sends eligible syslog messages to Collector1, which writes their source, receipt time and raw bytes to the private evidence file.
R1-to-Collector1 is the only cable. The file is a logical storage endpoint. UDP delivery, trusted timestamps and production retention are not guaranteed.
- Apply the threshold
R1's informational threshold admits severity 0-6. Warnings admits only 0-4 and excludes a severity-5 loopback event.
www.cisco.com - Reach the collector
Eligible messages travel to Collector1. UDP does not acknowledge delivery, so a configured host alone does not prove receipt.
www.rfc-editor.org - Preserve the receipt
Collector1 records arrival time, source and raw bytes in the file. Compare these with local events without inventing missing history.
www.rfc-editor.orgwww.rfc-editor.org
One idea at a time
Start with something familiar.
Read a log line in parts before guessing a root cause. Identify which device produced it, what component reported the event and which object changed. Then ask whether its clock was trustworthy at that moment.
Why learn this?
An alarming severity is not a complete diagnosis, and a quiet collector is not proof of a healthy network. Filters, clocks, transport and storage can all change what appears in a timeline.
An everyday comparison
A receptionist records a visitor's reported arrival time and the time the report reached the desk. A missing entry could mean no visitor, a lost note or a recording rule that excluded the note.
What happens in a network
The two times resemble event and receipt timestamps. The recording rule resembles a severity threshold, while lost notes resemble transport or collection gaps.
Where the comparison stopsA syslog message has defined protocol fields and platform-specific text. The analogy does not establish causality, message authenticity or guaranteed chronological delivery.
Follow one worked example
- Parse a synthetic message explicitly.
In the teaching token %LINK-5-CHANGED, LINK is the Cisco subsystem, 5 is notification severity and CHANGED is the mnemonic.
Why: Each component answers a different question; LINK is not the numeric local6 transport facility.
- Predict the threshold result.
Informational 6 includes the severity-5 link event, but warnings 4 excludes it from that destination.
Why: Lower numbers mean more severe, so increasing the threshold can include more messages.
- Compare local and remote evidence.
A local buffer can retain an event excluded by the remote threshold. The collector's absence alone cannot distinguish filtering from transport loss.
Why: Different destinations have their own controls and storage behavior.
- Restore and generate a new event.
After restoring informational logging, toggle only the unused lab loopback and inspect both records again.
Why: Changing a threshold does not automatically replay previously discarded UDP events.
Your first small task
On paper, write severity numbers 0 through 7. Circle those admitted by logging trap warnings. Then decide whether a synthetic %LINK-5-CHANGED message should be forwarded under that threshold.
Show a hint
The configured threshold is the largest admitted numeric value, not the smallest.
Check the expected result
Warnings admits 0, 1, 2, 3 and 4. The severity-5 message is excluded from that remote stream.
Pause and explain it in your own words
The remote collector has no loopback event, but the local buffer does. Did the event fail to happen?
Show a hint
Compare the two destination thresholds and the collector's transport and process state.
Show the explanation
No. The local message establishes that the router reported an event. Remote filtering, delivery or collection can explain the missing remote copy; investigate those dependencies before concluding there was no event.
Short answer
What should you understand today?
Read a syslog message's sender, timestamp, subsystem, severity, mnemonic and text together. A threshold includes its severity and more severe lower numbers. Missing collector events can reflect filtering, transport loss or collection failure, not proof that nothing happened. Preserve event time separately from receipt time and qualify chronology when clocks are uncertain.
Before you begin
Learning targets
- Review Day 41 clock-source uncertainty and Day 15 safe Console changes.
- Use GNS3 2.2.55 with an entitled C8000v IOS XE 17.12.1a router and an Ubuntu 24.04 LTS collector with Python 3.12.
- Use only a disposable Loopback99 for state changes; never shut the actual management cable.
- Read all eight severity levels and calculate what a threshold includes.
- Separate Cisco subsystem labels from the syslog transport facility.
- Preserve event timestamps, collector receipt timestamps and source identity.
- Compare local buffer evidence with a raw remote collector.
- Restore a restrictive threshold and generate a new event to verify recovery.
Words you will meet
Open a word when you need its meaning. You do not need to memorize the whole list before reading.
Syslog
Syslog carries event messages to local or remote destinations. An event message is evidence of what a component reported, not necessarily a complete explanation of its cause.
Severity
Severity is a numbered importance classification: 0 emergency, 1 alert, 2 critical, 3 error, 4 warning, 5 notice/notification, 6 informational and 7 debug. Lower numbers are more severe.
Facility and mnemonic
In Cisco text such as %LINK-5-CHANGED, LINK names the message subsystem, 5 is severity and CHANGED identifies the message kind. The transport facility such as local6 is a separate syslog classification.
Threshold
A logging threshold includes that numeric severity and all more severe lower numbers. Informational 6 includes 0 through 6; warnings 4 excludes severity 5 and 6.
Collector and buffer
A collector receives messages from other devices. A device buffer stores a limited local history that can wrap or disappear; neither is guaranteed to contain every event.
Event time and receipt time
Event time is the timestamp supplied by the sender. Receipt time is when the collector received the message. Different clocks and network delays can make them disagree.
PRI and UDP
Syslog priority PRI combines numeric transport facility and severity as facility times eight plus severity. User Datagram Protocol carries this lab's messages without delivery acknowledgement or encryption.
Console and synthetic example
Open each named GNS3 node's Console. IOS # allows inspection and configuration entry; Linux uses its shell. A synthetic message is an invented teaching example, not captured runtime.
Severity is a classification, not a root-cause verdict
The eight conventional levels run from 0 emergency through 7 debug. In order they are emergency, alert, critical, error, warning, notice, informational and debug; Cisco commonly calls level 5 notifications. Lower numeric values indicate greater severity. Importance still depends on device role, service impact and surrounding evidence; a routine change notification can explain an outage more directly than an unrelated critical message.
- Read severity together with sender, object and message text.
- A threshold is inclusive of the chosen level and lower numbers.
Two uses of facility must not be confused
Cisco's familiar text layout is percent sign, subsystem, severity, mnemonic and message text. A synthetic %LINK-5-CHANGED token identifies a link subsystem notification. The syslog transport facility is a different category, often configured as a local-use value such as local6. The standard PRI number combines that transport facility and severity, not the word LINK.
- A mnemonic identifies a message type but does not by itself establish the cause.
- Do not force every legacy Cisco message into a modern structured format.
Timestamps need source and uncertainty
Sender event time and collector receipt time answer different questions. Unsynchronized device clocks, timezones, queueing and transport delay can change their relationship. Cisco may prefix a timestamp with an asterisk to indicate an unreliable clock. Sequence numbers can help relate local messages but are not a universal global timeline and can reset.
- Receipt time does not retroactively prove the sender's clock accuracy.
- Clock recovery today cannot establish exact historical event times.
A logging path has more than one failure point
An event must be generated, pass the destination's filters, traverse the network, reach a listening process and be retained. Local buffers have size limits; UDP can lose or reorder datagrams and does not acknowledge delivery. A receiver can print a message while a downstream storage or alerting component fails. The lab's raw receiver intentionally stops before those production features.
- A configured logging host is not proof of receipt.
- Transport security and retention policy require separate production design.
Build an incident timeline without inventing causality
A timeline should separate observations from explanations. Record original timestamps, source, subsystem, severity, object, text and collection context. Correlate interface state, routing and authentication evidence as appropriate. Two messages close in time may share a cause, be unrelated or reflect clock skew. Avoid claiming that whichever appears first must have caused the other.
- Keep raw records and derived conclusions separately.
- State gaps and uncertainty instead of filling missing messages with invented lines.
Restore the stream and verify with a new event
Restoring a threshold permits future eligible messages. It does not guarantee that discarded UDP events will be replayed. Generate a new, bounded event in this disposable project, then compare the local and collector evidence. Keep the management cable up throughout so the fault concerns filtering rather than an intentionally severed delivery path.
- Use the same event type before, during and after the threshold fault.
- Record actual message mnemonics and counts rather than assuming a platform's output.
Real-world walkthrough
The collector missed a planned state change
In a fictional maintenance review, an operator sees a loopback state event in a router's local buffer but cannot find it in the collector. The collector was configured to accept the router's UDP stream, but the router's remote threshold was recently tightened. The review should compare configuration and actual receipt evidence before blaming storage or deleting logs.
- Preserve the local event and record the source device, original time, severity and current clock reliability.
- Inspect the remote logging host, transport port, threshold and source interface; compare them with the approved baseline.
- Confirm the collector process and private address were active during the test, while acknowledging that UDP offers no delivery guarantee.
- Restore the intended threshold and generate a fresh event on the unused lab loopback, leaving the management interface untouched.
- Compare both new records and state which older event remains missing. Do not manufacture a replay or infer exact cross-device timing.
Guided GNS3 lab
Local versus collected events across a threshold fault
Configure local buffering and a raw UDP receiver, create a bounded loopback event, suppress its remote severity and restore it. No router or Python runtime was executed during authoring.
Addressing plan
| Device | Interface | Address | Purpose |
|---|---|---|---|
| R1 | GigabitEthernet1 | 192.0.2.1/24 | Syslog source and private management link. |
| Collector1 | ens3 | 192.0.2.10/24 | UDP receiver on port 5514. |
| R1 | Loopback99 | 198.51.100.99/32 | Unused event source; never the management path. |
Set up the lab
- Create the single cable and fresh nodes. Keep R1 Console open; do not attach a physical adapter, NAT node or external bridge.
- No trusted clock synchronization is configured. Preserve sender timestamps and Python receipt timestamps separately and label both clock-quality limitations.
- The Python receiver prints raw byte representations without executing message content. It uses unprivileged port 5514 and is only for this private exercise.
- Use a fresh /tmp/qcs44-received.txt path; tee overwrites it when starting. Start the collector once and leave it running until all phases finish.
- Paper alternative: parse synthetic messages and compute threshold inclusion. Do not claim actual delivery, retention or device event generation.
Configure the router link
In GNS3, right-click R1 and choose Console before typing. Start at > or # on the disposable router. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
enable
configure terminal
hostname R1
interface GigabitEthernet1
ip address 192.0.2.1 255.255.255.0
no shutdown
end
show clock detailWhat each command means
enable- Enter privileged EXEC (#) from user EXEC (>); use only your authorized lab credentials.
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
hostname R1- Name the sender so its local identity is clear.
interface GigabitEthernet1- Select the only cable toward Collector1.
ip address 192.0.2.1 255.255.255.0- Assign the syslog source interface address.
no shutdown- Enable this management link and leave it enabled throughout.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
show clock detail- Record the clock source and its uncertainty before creating events.
- What you should see
- The sender owns .1; clock trust is recorded rather than assumed.
- Why this step matters
- The safe event will use a loopback so logging transport is not deliberately interrupted.
Start the isolated raw receiver
In GNS3, right-click Collector1 and choose Console before typing. At the Linux shell configure the sole ens3 link, then run the multiline Python command as one shell command. Leave it running; use R1's separate Console for subsequent steps. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
sudo ip address add 192.0.2.10/24 dev ens3
sudo ip link set ens3 up
python3 -u -c 'import socket,datetime
s=socket.socket(socket.AF_INET,socket.SOCK_DGRAM)
s.bind(("192.0.2.10",5514))
while True:
data,peer=s.recvfrom(65535)
print(datetime.datetime.now(datetime.timezone.utc).isoformat(),peer,repr(data))
' | tee /tmp/qcs44-received.txtWhat each command means
sudo ip address add 192.0.2.10/24 dev ens3- Assign the collector's private address; ens3 must be the recorded isolated interface.
sudo ip link set ens3 up- Enable the collector link without adding a default route.
python3 -u -c 'import socket,datetime s=socket.socket(socket.AF_INET,socket.SOCK_DGRAM) s.bind(("192.0.2.10",5514)) while True: data,peer=s.recvfrom(65535) print(datetime.datetime.now(datetime.timezone.utc).isoformat(),peer,repr(data)) ' | tee /tmp/qcs44-received.txt- Create an IPv4 UDP socket on .10 port 5514, print UTC-formatted receipt time, source and raw bytes for each datagram, and tee them to the dedicated local file.
- What you should see
- The process waits for datagrams. No output yet is normal and does not prove later receipt.
- Why this step matters
- This minimal receiver makes the endpoint and stored evidence explicit without claiming encryption, authentication or production retention.
Configure both logging destinations
In GNS3, right-click R1 and choose Console before typing. Start at # while Collector1's receiver remains running. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
configure terminal
service timestamps log datetime msec show-timezone
service sequence-numbers
logging buffered 16384 informational
logging host 192.0.2.10 transport udp port 5514
logging source-interface GigabitEthernet1
logging facility local6
logging trap informational
end
show loggingWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
service timestamps log datetime msec show-timezone- Include sender date/time, milliseconds and timezone in log messages; this does not synchronize the clock.
service sequence-numbers- Add local sequence numbers for additional ordering context.
logging buffered 16384 informational- Retain up to the configured 16384-byte local buffer at levels 0 through 6.
logging host 192.0.2.10 transport udp port 5514- Send remote messages to the exact private receiver and nondefault UDP port.
logging source-interface GigabitEthernet1- Use the declared .1 interface address as the remote logging source.
logging facility local6- Set the transport facility to local6, distinct from Cisco message subsystems.
logging trap informational- Include severity 0 through 6 in the remote stream.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
show logging- Inspect actual destinations, levels and buffer state.
- What you should see
- The configured receiver and thresholds should match the plan.
- Why this step matters
- The word trap in logging trap is Cisco's remote logging terminology, not proof of an SNMP trap receiver.
Generate a baseline loopback event
In GNS3, right-click R1 and choose Console before typing. Start at #. Create only the unused logical test interface, then disable and restore it. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
configure terminal
interface Loopback99
ip address 198.51.100.99 255.255.255.255
shutdown
no shutdown
end
show loggingWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
interface Loopback99- Create/select the dedicated logical test interface, not the cabled management port.
ip address 198.51.100.99 255.255.255.255- Assign the /32 teaching address to identify this event source.
shutdown- Disable only Loopback99 to generate a bounded state change.
no shutdown- Restore only Loopback99 to its intended enabled state.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
show logging- Find the actual Loopback99 messages and record their severity and mnemonic.
- What you should see
- Local and remote state messages should be observable; exact count and wording depend on the image.
- Why this step matters
- Proceed with the threshold comparison only if a severity-5 event is actually present in the baseline.
Tighten the remote threshold and repeat
In GNS3, right-click R1 and choose Console before typing. Start at # after the baseline is recorded. Change only the remote threshold, then repeat the same loopback state changes. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
configure terminal
logging trap warnings
interface Loopback99
shutdown
no shutdown
end
show loggingWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
logging trap warnings- Restrict remote forwarding to severity 0 through 4; the informational local buffer remains unchanged.
interface Loopback99- Select the same unused logical event source.
shutdown- Generate a new down-state event without touching the management link.
no shutdown- Restore the loopback and generate the corresponding recovery event.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
show logging- Compare locally recorded new events with Collector1's visible stream.
- What you should see
- Severity-5 loopback events should remain locally visible but be excluded from the remote stream.
- Why this step matters
- The missing remote copy demonstrates a threshold dependency, not a claim that UDP delivery is otherwise guaranteed.
Restore the threshold and generate fresh events
In GNS3, right-click R1 and choose Console before typing. Start at #. Restore the original remote threshold before creating a new comparison event. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
configure terminal
logging trap informational
interface Loopback99
shutdown
no shutdown
end
show loggingWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
logging trap informational- Restore admission of levels 0 through 6 for future remote messages.
interface Loopback99- Select the same logical interface for a comparable event.
shutdown- Generate a fresh controlled down event after restoration.
no shutdown- Return the loopback to the enabled baseline.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
show logging- Record the new local messages and configured informational remote threshold.
- What you should see
- New eligible events should reach the collector again; earlier excluded events are not promised a replay.
- Why this step matters
- A new event tests recovery of forwarding rather than assuming an old missing message will reappear.
Check final interface and clock context
In GNS3, right-click R1 and choose Console before typing. Start at # and retain the state used to interpret the timeline. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
show ip interface brief
show clock detail
show loggingWhat each command means
show ip interface brief- Confirm GigabitEthernet1 and Loopback99 are in the intended enabled state.
show clock detail- Record current sender clock context without treating it as historical proof.
show logging- Preserve the actual event sequence and local/remote configuration before cleanup.
- What you should see
- The management link and loopback should be enabled; observations retain clock limitations.
- Why this step matters
- State verification prevents an event-generation exercise from leaving a disabled lab interface unnoticed.
Stop the receiver and inspect retained bytes
In GNS3, right-click Collector1 and choose Console before typing. Press Ctrl+C in the running receiver Console to return to the Linux shell, then read only the dedicated lab file. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
sed -n '1,160p' /tmp/qcs44-received.txt
wc -l /tmp/qcs44-received.txtWhat each command means
sed -n '1,160p' /tmp/qcs44-received.txt- Display the first 160 received lines without editing their raw payload representation; use later line ranges if needed.
wc -l /tmp/qcs44-received.txt- Count retained lines without treating the count as proof of complete delivery.
- What you should see
- The file should contain actual received baseline and restored-phase messages; compare by source, loopback text and phase notes.
- Why this step matters
- Raw receipts, local events and analytical conclusions remain separate. Stop both nodes after recording any gaps.
Verify
- Identify severity and mnemonic from actual Loopback99 events before using them in the threshold comparison.
- Confirm informational means 0-6 and warnings means 0-4; compare local and remote destinations separately.
- Retain sender event time, collector receipt time and source socket without silently merging them.
- Verify fresh events after restoration and explicitly record that UDP delivery, clock trust and production retention were not guaranteed.
Troubleshoot
- No collector output: verify .10 address, UDP 5514 listener, configured host/port and source path; a ping does not prove the receiver process is listening.
- No expected local event: inspect actual platform message behavior and Loopback99 state; do not fabricate a LINK message to satisfy the exercise.
- Remote event appears during the fault: verify its actual severity and whether it belongs to a prior phase; not every configuration message has the same severity.
- Different sender and receipt order: record clock state, sequence numbers and delivery uncertainty; do not rewrite raw evidence to force a causal story.
GNS3 does not provide Cisco software images. Use Cisco images only when the applicable license or entitlement permits this environment. Do not share or redistribute image files. Cisco Modeling Labs is an official alternative; its supplied reference images are licensed for CML, not automatically for export to GNS3. Use the labeled paper alternative when authorized software is unavailable. No emulator execution is claimed by this lesson.
- Leave the loopback enabled, stop both nodes and revert the dedicated router snapshot before reuse.
- Keep the raw file private and preserve known gaps; this training receiver must not be exposed as an unauthenticated public log endpoint.
Practice set
Answer before you reveal
01Which levels pass a warnings threshold?
Lower numbers are more severe. Severity 5 notifications and 6 informational messages are excluded by threshold 4.
02Is LINK the same as local6?
These separate classifications can appear within the same collected message. PRI calculations use the numeric transport facility.
03What is PRI for local6 and severity 5?
This is a standard priority calculation, not a claim that every default IOS payload uses the complete RFC 5424 structured format.
04Does restoring a threshold replay omitted UDP events?
The restoration permits future eligible messages. Generate a fresh controlled event to test the recovered stream.
05Why keep receipt time separate?
Clocks, buffering and transport delay can differ. Preserving both supports honest analysis rather than false chronology.
06Does a severe message identify the root cause?
Severity expresses reported importance. Device role, affected object, configuration and adjacent events are still needed for diagnosis.
Knowledge check
Quiz: prove the reasoning
Keep these
Technical takeaways
- Lower severity numbers indicate greater severity.
- Cisco subsystem names and transport facilities are distinct.
- Event time and collector receipt time must remain distinguishable.
- A quiet collector does not prove no event occurred.
- Verify restored logging with fresh bounded events and preserve known gaps.