hey what's up guys welcome to serpros in
this video we're going to be looking at
[Music]
syslog
meet bill bill is a network admin
and it's his job to manage and
troubleshoot the network
part of that job means searching through
log files when things go wrong
this network is pretty small so it's
easy to keep on top of all of the log
information
the problem is as the business grew so
did the network
it got bigger and bigger and bigger
now it's nearly impossible to keep on
top of all of the network
log information so bill decided to find
a solution and he discovered syslog
servers a syslog server allows all of
his network devices
to send their log information to one
centralized place
the log messages will be sent on udp
port
514 to the syslog server
from here he can manage search and
archive
all of the log information okay so i
hope you liked my little story there
using a syslog server allows us to
centrally manage our log
information why would you want to do
that well there are a few reasons why
first log information is very important
when troubleshooting problems
let's say a user reports a network
outage
you can go through all of the log
information to see if there were any
problems
another benefit of storing log
information in a central place
is data retention cisco devices
by default store log information in ram
this means when a device reboots the
logs
are erased other vendors may write log
information to disk
but network devices tend to have a small
amount of storage available
keeping all of your log information in
one place allows for easy archiving
okay so now we know what a syslog server
is and why we use them
let's look at some log messages this is
a syslog
message it will probably look familiar
to you by now
it's the messages you see when
configuring routers and switches
it may not seem like it straight away
but these messages follow an industry
standard
this makes it easy to correlate logs
from different vendors
the first part is the timestamp or
sequence number
on cisco devices you can choose which
one you want to use
the next part is called the facility
this shows the source of the message
next we have severity this shows you how
urgent the log message
is then we have something called the
mnemonic
this is a code to identify the message
and finally we have the description
which contains
the log message there are two key bits
of information here that we need to look
at
further these are facility and severity
first let's look at the facility
here is a table of all available
facilities
remember the facility represents the
process that generated
the message because this log was adopted
early by unix systems
these facility codes are mostly
unix-based
for example if a unix kernel generated a
message
the facility would be kern if an
authentication message was locked
the facility may show auth you'll notice
there
aren't many network related facilities
at the bottom we have 16 to 23 local use
these are undefined custom values that
are generally used for network devices
so the next and probably the most
important bit of information here
is the severity syslog has
eight severity levels ranging from zero
to seven the top is the most urgent
so severity is zero and the bottom is
the least urgent
which is seven for debug messages
this is important because you likely
don't want to send
all log messages to your server you can
choose which messages are sent
based on their severity this way your
server doesn't get clogged up with
messages you'd
rather not see now unfortunately
this is one of those tables you're going
to have to memorize
for your ccna exam you need to know
not only the severity levels but which
order they're in
as with most of these things mnemonics
come to the rescue
a popular one is every awesome
cisco engineer will need ice cream
daily another one i found
was ernie always cries even when
no one is dying which made me laugh
probably more than it should
okay so now we've been over the theory
let's see it
in action here is my computer
i'm running a program called kiwi syslog
server
there are lots of different syslog
servers out there some are free
some are paid i'm using this one because
it's free
for up to five devices as you can see
nothing is going on here that's because
we haven't configured anything
the first thing i'm going to do is go to
file
setup
scroll down to inputs and if you're
doing this at home
you will need to input the ip address of
the device you want to receive
syslog messages from i've already
entered the ip address of my cisco
router
after you've done that just click ok
our server is now ready to receive
syslog messages
but still nothing is happening
we need to configure the router to send
syslog messages to the server
so i'll open the router and you'll
already see some familiar looking
messages
these are syslog messages showing when
the router boots up
you'll notice the timestamps are
completely wrong
so we'll need to fix that it's
recommended to use an
ntp server to sync our time correctly
but in this example
i'll just set the time manually i'm
already in privilege
exec mode so i don't have to type enable
now i'll type
clock question mark
we only have one option here and that is
to set the clock manually
if i type clock set question mark
we can see that it asks for the hours
minutes and seconds
it's 8 22 so i'll just type 0 8
22 0 0 it then wants the day
and the month i'll type 0 7 september
and if i press the question mark one
more time it asks us
for the year so i'll type good old 2020.
when we hit enter we're greeted with an
information message
telling us the clock has been changed
now the time is set
we need to make sure it's included in
the syslog messages
to do this we need to enter global
configuration
by typing configure terminal
now i'll type service question mark
lots of information here the two main
ones are sequence numbers
and timestamps remember earlier when i
said syslog messages can either have a
sequence number or a timestamp
but this is where we choose i'll choose
timestamps
and if i type question mark we have the
option for debugging
and log messages we want to change the
log messages
so we'll type log again
question mark and now we get the choice
between
date time or system uptime of course we
want the date time
so we type date time
the last few options here if we choose
msec then it will include the
milliseconds in the timestamp
this can be very handy when
troubleshooting
hit enter and now the timestamps are set
we're now ready to tell the router to
send log messages to our syslog server
first we tell the router where to send
the logs
we do this with the command logging
and then the ip address of our server in
my case
it's 192.168.0.1
now we need to choose which logs to send
if i type logging again but this time
with a question mark
we'll see lots of options the one i want
is trap the description says set
syslog server logging level so we type
logging trap and to see the levels
we type a question mark here we choose
the severity of logs we want to send
in this example we're going to choose
informational
an important note here is that whichever
level you choose
it will send those logs as well as the
logs with a higher severity
so we've chosen informational which is
level six
the router will send all log messages
with a severity
of zero to six
the last thing i need to do is configure
the ip address
so i'll type interface
fast ethernet 0 0
then ip address 192.168.0.254
and a subnet mask of 255.25
and i'll bring the interface up by
typing no shutdown
now our router is configured and waiting
to send some log messages
we just need to generate some logs to do
this i'll just exit here
go into another interface and this time
it will be fast ethernet 0
1
and type no shutdown
our router will generate some logs
saying the interface is now up
i'll now shut it down again to generate
a few more
if we now go back to our syslog server
we can now see our router's logs
from here we could search filter and
correlate
all of our log messages this video is
part of the full ccna course which can
be found
in the description so please feel free
to go and check that out
if you like this video don't forget to
give it a thumbs up
leave a comment and subscribe the
support from you guys
really helps this channel grow other
than that
thank you for watching
you