| 2.4 |  | Router Management |
| 2.4.2 |  | Logging |

| Cisco IOS messages are categorized by severity level. The lower the severity level number, the more critical the message is. The severity levels are described in Figure . Cisco router log messages contain three main parts as shown in Figure . Routers can log system errors, changes in network and interface status, login failures, access list matches, and many other events. The following list contains some motivations for keeping router logs:

- Recording router configuration changes and reboots
- Recording receipt of traffic that violates access lists
- Recording changes in interface and network status
- Recording router cryptographic security violations

There are some events that can be important to security that Cisco routers cannot log. Four such events are as follows:

1. Changing EXEC privilege level
2. Changing a password
3. Changing the configuration via SNMP
4. Saving a new configuration to the NVRAM

Log messages can be directed in five different ways, as discussed in Figure . Messages can be sent to all five destinations, or any combination. The most valuable forms of logging are persistent and can be preserved over time.

Console logging
Figure shows an example that sets the console level to 5, or notifications, which means that important messages will appear on the console, but access list log messages will not. Use the command

logging console info to see all non-debug messages including access list log messages. Use logging console debug to see messages on the console. Be aware that this can place a burden on the router and should be used sparingly.

In general, the logging level at the console should be set to display lots of messages only when the console is in use or its output is being displayed or captured. Set the console logging level to 2 without using the console by using the

logging console critical command.

Buffered logging
For buffered and other forms of persistent logs, recording the time and date of the logged message is very important. Cisco routers have the ability to timestamp messages, but it must be turned on explicitly. As a rule of thumb, log buffer size should be about 16 KB. If the router has more than 16 MB of RAM, then set the log size to 32 or 64 KB. Figure shows how to turn on buffered logging, enable time stamps, and view the buffered log.

Terminal line logging
Any terminal or virtual terminal line can act as a log monitor. There are two parts to setting up terminal monitor logging. First, set the severity level for terminal line monitor log messages. This needs to be done only once. Second, while using a particular line, declare it to be a monitor. This needs to be done once per session. Figure shows how to set up terminal line monitoring for informational severity, level 6 on a telnet session virtual terminal line.

Syslog logging
A network security administrator should always log significant events on the router to the syslog server. A syslog server should be located on a secure internal network to ensure log integrity. The syslog server can be a dedicated server, or another server running syslog services. Refer to the appendix for instructions on how to properly install the syslog server software.

SNMP
The Simple Network Management Protocol (SNMP) is an application-layer protocol that facilitates the exchange of management information between network devices. It is part of the Transmission Control Protocol/Internet Protocol (TCP/IP) protocol suite. SNMP enables network administrators to manage network performance, find and solve network problems, and plan for network growth.

| Lab Activity Lab Exercise: Configure Logging In this lab, the student will use logging to monitor network events.