System Log Message Format
You can access logged system messages by using the switch command-line interface (CLI) or by saving them
to a properly configured syslog server. The switch software saves syslog messages in an internal buffer on a
standalone switch. If a standalone switch , the log is lost unless you had saved it to flash memory.
You can remotely monitor system messages by viewing the logs on a syslog server or by accessing the switch
through Telnet, through the console port, or through the Ethernet management port.
Note
The syslog format is compatible with 4.3 BSD UNIX.
System Log Message Format
System log messages can contain up to 80 characters and a percent sign (%), which follows the optional
sequence number or time-stamp information, if configured. Depending on the switch, messages appear in one
of these formats:
• seq no:timestamp: %facility-severity-MNEMONIC:description (hostname-n)
• seq no:timestamp: %facility-severity-MNEMONIC:description
The part of the message preceding the percent sign depends on the setting of these global configuration
commands:
• service sequence-numbers
• service timestamps log datetime
• service timestamps log datetime [localtime] [msec] [show-timezone]
• service timestamps log uptime
Table 9: System Log Message Elements
Element
seq no:
timestamp formats:
mm/dd h h:mm:ss
or
hh:mm:ss (short
uptime)
or
d h (long uptime)
facility
severity
MNEMONIC
System Management Configuration Guide, Cisco IOS XE Gibraltar 16.10.x (Catalyst 9200 Switches)
120
Description
Stamps log messages with a sequence number only if the service sequence-numbers
global configuration command is configured.
Date and time of the message or event. This information appears only if the service
timestamps log [datetime | log] global configuration command is configured.
The facility to which the message refers (for example, SNMP, SYS, and so forth).
Single-digit code from 0 to 7 that is the severity of the message.
Text string that uniquely describes the message.
Configuring System Message Logs