Syslog Logging Levels (Severity 0–7) - Complete Guide
1. What is Syslog?
Syslog is a standard logging protocol used by network devices (routers, switches, servers) to send event messages to a centralized log server (called a Syslog server).
Purpose:
- Centralized log collection and analysis
- Severity-based filtering for prioritization
- Security auditing and compliance tracking
2. Syslog Severity Levels (0–7)
Syslog categorizes logs into eight severity levels, from 0 (most severe) to 7 (least severe):
| Level | Name | Meaning | Example |
|---|---|---|---|
| 0 | Emergency (emerg) | System unusable | Router crash, kernel panic |
| 1 | Alert | Immediate action required | Disk full, power supply failure |
| 2 | Critical (crit) | Critical condition | BGP neighbor down |
| 3 | Error (err) | Error condition | Interface drops |
| 4 | Warning (warn) | Potential issue | High CPU usage |
| 5 | Notice | Significant but normal | User login, config saved |
| 6 | Informational | Routine information | Interface up/down |
| 7 | Debug | Debugging messages | Routing table updates |
Mnemonic: "Every Awesome Cat Eats Whiskas Near Its Dish"
3. Default Logging Level on Devices
- Cisco Devices: Default is level 6 (Informational)
- Linux (rsyslog): Typically logs level 6 and above into
/var/log/messages
4. Configuring Logging Levels
On Cisco Devices:
Router(config)# logging trap warnings # Logs levels 0–4
Router(config)# logging host 192.168.1.100 # Syslog server IPOn Linux (rsyslog):
# Edit /etc/rsyslog.conf
*.info;mail.none;authpriv.none /var/log/messages5. Filtering Logs by Severity
Cisco:
Router# show logging | include %CRITICALLinux:
grep "error" /var/log/syslog6. Syslog Message Format
Every Syslog message contains:
- Timestamp: e.g., Dec 15 10:30:45
- Hostname: e.g., Router1
- Facility: e.g., %SYS, %LINEPROTO
- Severity: e.g., %CRITICAL
- Message: Description of the event
Example:
Dec 15 10:30:45 Router1 %SYS-3-CRITICAL: Temperature threshold exceeded7. Use Cases for Each Level
| Level | When to Use |
|---|---|
| 0 (Emergency) | Complete system failure |
| 1 (Alert) | Immediate system-wide actions |
| 2 (Critical) | Major routing or failover issues |
| 3 (Error) | Connectivity drops, packet loss |
| 4 (Warning) | CPU/memory spikes |
| 5 (Notice) | Config changes, logins |
| 6 (Info) | Interface up/down notifications |
| 7 (Debug) | Packet-level diagnostics |
8. Local vs. Remote Syslog
| Feature | Local Logging | Remote Syslog |
|---|---|---|
| Storage | On-device (RAM or flash) | Central server |
| Retention | Lost on reboot | Persistent |
| Use Case | Quick troubleshooting | Audit and compliance |
9. Syslog Facility vs. Severity
| Term | Purpose | Example |
|---|---|---|
| Facility | Categorizes log source | auth, kernel, local0 |
| Severity | Indicates urgency | error, warning |
Common Linux Facility Codes:
0= kernel1= user-level16–23= local0 to local7 (often used for network equipment)
10. Best Practices
- ✅ Use appropriate logging level (e.g., level 4 for production)
- ✅ Always configure remote Syslog for redundancy
- ✅ Rotate logs regularly (Linux:
logrotate) - ❌ Avoid logging debug level (7) in production unless troubleshooting
11. Performance Impact
- Levels 0–4: Minimal logging impact (rare, critical events)
- Levels 5–7: Higher volume, may increase CPU/disk usage
12. Testing & Verification
On Cisco:
Router# debug ip packet # Generates level 7 logs
Router# show loggingOn Linux:
logger -p local0.err "Test error message"
tail -f /var/log/syslog13. Summary
- Levels 0–3: High severity, must monitor immediately
- Levels 4–5: Moderate concern, monitor regularly
- Levels 6–7: Informational, use mainly for diagnostics
Always: Enable remote logging, apply filters, and audit logs.