| 5.3 |  | Monitoring with Logging and Syslog |
| 5.3.2 |  | Configure logging |

| By default, routers send debug command output and system error messages to a logging process. The logging process controls the distribution of logging messages to the various destinations, such as the logging buffer, terminal lines, or a syslog server depending on the configuration. The process also sends messages to the console. When the logging process is on, the messages are displayed on the console after the process that generated them has finished.

When the logging process is disabled, messages are sent only to the console. The messages are sent as they are generated, so error and debug output will be interspersed with prompts or output from the command.

Administrators can set the severity level of the messages to control the type of messages displayed for the console and each destination. Timestamp log messages can also be configured or the syslog source address can be set to enhance real-time debugging and management.

Enabling message logging
Message logging is enabled by default. It must be enabled in order to send messages to any destination other than the console. To disable message logging, use the no logging on command. Note that disabling the logging process can slow down the router because a process cannot continue until the messages are written to the console.

To re-enable message logging after it has been disabled, use the following command in global configuration mode:

> logging on

Setting the error message display device
If message logging is enabled, messages can be sent to specific locations, in addition to the console.

To set the locations that receive messages, use the following commands in global configuration:

- The logging buffered command copies logging messages to an internal buffer. The buffer is circular, so newer messages overwrite older messages after the buffer is full.
- To display the messages that are logged in the buffer, use the show logging EXEC command. The first message displayed is the oldest message in the buffer.
- To clear the current contents of the buffer, use the clear logging privileged EXEC command.
- The terminal monitor EXEC command accomplishes the task of displaying the system error messages to a nonconsole terminal locally.
- The logging command identifies a syslog server host to receive logging messages. The host argument is the name or Internet address of the host. By issuing this command more than once, administrators can build a list of syslog servers that receive logging messages.
- The no logging command deletes the syslog server with the specified address from the list of syslogs.

Displaying logging information
To display logging information, use the show logging and show logging history commands as needed.