300-410 Network Logging and Syslog — 20 Questions

Question 1

A network engineer notices that the syslog server at 10.1.1.100 is not receiving any log messages from a Cisco router running IOS-XE 16.9. The engineer has configured 'logging host 10.1.1.100' and 'logging trap debugging'. The router can ping the syslog server successfully. What is the most likely cause of the missing syslog messages?

Accepted Answer

The 'logging on' command is not configured globally.. The 'logging trap debugging' command sets the severity level to 7 (debugging), but the default logging source interface is the lowest-numbered IP address on the router. If that interface is not reachable from the syslog server, messages may be dropped. However, the more common issue is that the 'logging on' command is missing, which globally disables syslog output. Without 'logging on', no messages are sent to any syslog server regardless of other configurations.

Answer

The syslog server is using UDP port 514, but the router is sending over TCP.

Answer

The 'logging source-interface' is set to a loopback that is not advertised in the routing table.

Answer

The 'logging buffered' command is overriding the remote logging configuration.

Question 2

An engineer is troubleshooting why syslog messages from a router are not being received by the syslog server at 192.168.1.10. The router configuration includes 'logging host 192.168.1.10' and 'logging trap 6'. The engineer runs 'debug ip packet' and sees packets destined for 192.168.1.10 being sent but no response. What should the engineer check first?

Accepted Answer

Verify that the syslog server is running and listening on UDP port 514.. Syslog uses UDP, which is connectionless; the server does not send acknowledgments. The debug showing packets being sent indicates the router is transmitting, but the server may not be listening on UDP 514, or a firewall may be blocking the traffic. Checking the server's syslog service status and firewall rules is the logical first step.

Answer

Change the logging trap level to 7 (debugging) to ensure all messages are sent.

Answer

Add the 'logging source-interface' command to use a loopback interface.

Answer

Configure 'logging on' if it is not already enabled.

Question 3

A network engineer is troubleshooting a router that is generating excessive syslog messages, filling up the local logging buffer and causing performance issues. The engineer wants to reduce the volume of messages sent to the remote syslog server while still capturing critical alerts locally. The current configuration includes 'logging buffered 4096 debugging' and 'logging host 10.1.1.100'. What is the best approach?

Accepted Answer

Configure 'logging trap errors' under the logging host configuration to limit remote messages to severity 3 and above.. To reduce remote syslog volume without affecting local logging, the engineer should set a higher severity threshold for the remote server using 'logging trap' (e.g., 'logging trap 3' for errors only). The local buffer can remain at debugging level for detailed troubleshooting. This separates the logging levels.

Answer

Change 'logging buffered 4096 debugging' to 'logging buffered 4096 errors' to reduce local messages.

Answer

Remove the 'logging buffered' command to stop all local logging.

Answer

Add 'logging rate-limit 10' to limit the number of messages per second.

Question 4

A router is configured with 'logging host 10.1.1.100' and 'logging trap informational'. The engineer notices that syslog messages with severity 5 (notice) are being sent, but messages with severity 6 (informational) are not. What is the most likely cause?

Accepted Answer

The 'logging trap' command is set to 5 (notice) rather than 6 (informational).. The 'logging trap informational' command sets the severity threshold to 6, meaning messages of severity 0-6 are sent. However, if the engineer sees that severity 5 messages are sent but severity 6 are not, the issue is likely that the specific informational messages are not being generated by the router, or they are being filtered by a different mechanism such as 'logging filter' or 'exception' settings. But the most common cause is that the 'logging trap' level is actually set to 5 (notice) instead of 6. A misconfiguration or misunderstanding of the command is typical.

Answer

The syslog server is dropping severity 6 messages due to its own configuration.

Answer

The 'logging console' command is overriding the remote logging level.

Answer

The router's clock is not synchronized, causing timestamp issues.

Question 5

An engineer is troubleshooting a router that is not sending syslog messages to the remote server at 192.168.1.10. The configuration includes 'logging host 192.168.1.10' and 'logging trap 7'. The router can ping 192.168.1.10. The engineer runs 'show logging' and sees 'Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns)'. What is the most likely cause?

Accepted Answer

The 'logging source-interface' is configured to an interface that is administratively down.. The 'show logging' output shows that syslog is enabled but no messages are being sent. A common reason is that the 'logging source-interface' is set to an interface that is down or not reachable, causing the router to use an incorrect source IP that the server may filter or that routing may not support. Alternatively, the server may be configured to accept messages only from specific source IPs.

Answer

The 'logging on' command is missing from the configuration.

Answer

The syslog server is using TCP, but the router is configured for UDP.

Answer

The logging buffer is full, preventing new messages from being generated.

Question 6

A router is configured to send syslog messages to two servers: 10.1.1.100 and 10.1.1.200. The engineer notices that only server 10.1.1.100 is receiving messages. The configuration shows 'logging host 10.1.1.100' and 'logging host 10.1.1.200'. Both servers are reachable via ping. What is the most likely cause?

Accepted Answer

The syslog service on 10.1.1.200 is not running or is blocked by a firewall.. Cisco IOS allows multiple logging hosts, but each must be configured with a separate 'logging host' command. If the second server is not receiving messages, it may be because the 'logging trap' level for that specific host is set to a higher severity (e.g., 'logging host 10.1.1.200 trap errors') that filters out most messages, or the server is not listening. However, a common mistake is that the second host is configured with a different port or protocol that is not supported. But the most typical cause is that the second server's syslog service is not running or is firewalled.

Answer

The router can only send to one syslog server at a time.

Answer

The 'logging host 10.1.1.200' command is missing the 'transport udp' keyword.

Answer

The second server is configured with a different severity level using 'logging trap' under the host.

Question 7

An engineer is troubleshooting a router that is generating syslog messages with incorrect timestamps. The router has 'service timestamps log datetime msec' configured, but the timestamps show the wrong time zone. The router's clock is set correctly via NTP. What is the most likely cause?

Accepted Answer

The 'clock timezone' command is not configured on the router.. The 'service timestamps log datetime msec' command uses the router's local time, but if the time zone is not configured, the timestamps will appear in UTC (the default). To show the correct local time, the 'clock timezone' command must be configured to set the appropriate offset.

Answer

The NTP server is not providing timezone information.

Answer

The 'service timestamps log' command should use 'localtime' instead of 'datetime'.

Answer

The syslog server is overwriting the timestamps with its own.

Question 8

A router is configured with 'logging host 10.1.1.100' and 'logging trap debugging'. The engineer notices that the router is sending a large number of debug messages to the syslog server, causing high CPU usage. The engineer wants to stop sending debug messages to the remote server but keep them in the local buffer. What is the best command to achieve this?

Accepted Answer

Configure 'logging host 10.1.1.100 trap notifications' to set the remote threshold to severity 5.. To stop sending debug messages to the remote server without affecting local logging, the engineer should change the remote logging severity to a higher level (e.g., 'logging host 10.1.1.100 trap notifications' to set severity 5). This will exclude debug (severity 7) messages from being sent to that specific host. The local buffer can remain at debugging level.

Answer

Configure 'no logging trap debugging' globally.

Answer

Use 'undebug all' to stop all debug output.

Answer

Set 'logging buffered 4096 notifications' to limit local buffer to severity 5.

Question 9

A network engineer is troubleshooting a router that is not generating any syslog messages at all, even for critical events like interface flaps. The 'show logging' output shows 'Syslog logging: disabled'. What is the most likely cause?

Accepted Answer

The 'logging on' command is not configured.. The 'show logging' output clearly states that syslog logging is disabled. The most common cause is that the global 'logging on' command is missing from the configuration. Without this command, no syslog messages are generated or sent to any destination.

Answer

The logging buffer is full and needs to be cleared.

Answer

The router has run out of memory to generate syslog messages.

Answer

The 'logging host' command is missing, so no destination is configured.

Question 10

A network engineer runs the following command on Router R1:

R1# show logging

Syslog logging: enabled (0 messages dropped, 3 messages rate-limited, 0 flushes, 0 overruns, xml disabled, small buffer)
    Console logging: level debugging, 37 messages logged, xml disabled,
                     filtering disabled
    Monitor logging: level debugging, 0 messages logged, xml disabled,
                     filtering disabled
    Buffer logging: level informational, 5 messages logged, xml disabled,
                    filtering disabled
    Logging Exception size (4096 bytes)
    Count and timestamp logging messages: disabled
    Persistent logging: disabled

No active filter modules.

Trap logging: level informational, 0 message lines logged
        Logging to 192.168.1.100 (udp port 514, audit disabled,
                link up),
          0 message lines logged, xml disabled,
          filtering disabled
        Logging Source Interface: Loopback0

Log Buffer (4096 bytes):

*Mar  1 00:01:23.456: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up
*Mar  1 00:02:34.567: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up

Based on this output, which statement is correct?

Accepted Answer

Console logging is set to debugging level, meaning all debug messages will appear on the console.. The output shows that buffer logging is set to level informational, but the buffer only contains 4096 bytes and has logged only 5 messages. The trap logging (syslog server) is set to informational but has logged 0 messages, and the server 192.168.1.100 is reachable (link up). The key issue is that the syslog server is not receiving messages despite being configured correctly, likely due to the source interface being Loopback0 which may not have a route to the server or the server is not processing the messages. However, the question asks for a correct statement based on the output. The correct answer is that console logging is set to debugging, which is the most detailed level, and this is confirmed by the output showing 'level debugging' for console logging.

Answer

The syslog server at 192.168.1.100 is receiving messages because the link is up.

Answer

Buffer logging is set to debugging level, so all debug messages are stored in the buffer.

Answer

The logging buffer size is 4096 bytes, which is sufficient to store all messages without overwriting.

Question 11

A network engineer runs the following command on Router R2:

R2# show logging | include %SYS-5-CONFIG_I

*Mar  1 00:10:15.123: %SYS-5-CONFIG_I: Configured from console by console
*Mar  1 00:12:45.678: %SYS-5-CONFIG_I: Configured from console by console
*Mar  1 00:15:30.001: %SYS-5-CONFIG_I: Configured from console by console
*Mar  1 00:20:00.999: %SYS-5-CONFIG_I: Configured from console by console

Based on this output, what is the most likely problem?

Accepted Answer

The router is being reconfigured repeatedly from the console, which could indicate unauthorized access or a script issue.. The output shows multiple configuration changes being made from the console in a short period of time. This could indicate unauthorized access or a misconfiguration that is causing repeated configuration changes. However, the most likely problem is that the logging level is set too low, and these messages are being generated due to a loop or automated script. But the key clue is that the messages are from the console, suggesting someone is making changes repeatedly. The correct answer is that the router is being reconfigured frequently, possibly due to a configuration loop or an attacker.

Answer

The router has a memory leak causing frequent reloads.

Answer

The logging buffer is full and messages are being overwritten.

Answer

The syslog server is not reachable, so messages are only logged locally.

Question 12

A network engineer runs the following command on Router R3:

R3# show logging | include %OSPF-5-ADJCHG

*Mar  1 00:05:10.123: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from LOADING to FULL, Loading Done
*Mar  1 00:06:20.456: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from FULL to DOWN, Neighbor Down: Dead timer expired
*Mar  1 00:07:30.789: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from DOWN to INIT, Received Hello
*Mar  1 00:08:40.012: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from INIT to EXSTART, Event: start
*Mar  1 00:09:50.345: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from EXSTART to EXCHANGE, Event: Negotiation Done
*Mar  1 00:10:00.678: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from EXCHANGE to LOADING, Event: Exchange Done
*Mar  1 00:11:10.901: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from LOADING to FULL, Loading Done
*Mar  1 00:12:20.234: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from FULL to DOWN, Neighbor Down: Dead timer expired

Based on this output, what is the most likely problem?

Accepted Answer

There is a Layer 1 or Layer 2 issue causing intermittent connectivity on GigabitEthernet0/0.. The output shows repeated OSPF adjacency changes between R3 and neighbor 10.0.0.1, with the neighbor going from FULL to DOWN due to dead timer expiration, then re-establishing. This pattern indicates an unstable OSPF neighbor relationship, likely due to a flapping interface, mismatched timers, or Layer 1 issues. The dead timer expiration suggests that hello packets are not being received consistently.

Answer

The OSPF process is misconfigured with mismatched area IDs.

Answer

The OSPF dead timer is set too high, causing slow convergence.

Answer

The router is running out of memory, causing OSPF process restarts.

Question 13

A network engineer runs the following command on Router R4:

R4# show logging | include %BGP-3-NOTIFICATION

*Mar  1 00:01:05.123: %BGP-3-NOTIFICATION: sent to neighbor 10.0.0.2 4/0 (Hold Timer Expired) 0 bytes
*Mar  1 00:02:10.456: %BGP-3-NOTIFICATION: received from neighbor 10.0.0.2 4/0 (Hold Timer Expired) 0 bytes
*Mar  1 00:03:15.789: %BGP-3-NOTIFICATION: sent to neighbor 10.0.0.2 4/0 (Hold Timer Expired) 0 bytes

Based on this output, what is the most likely problem?

Accepted Answer

There is a connectivity issue causing keepalive packets to be lost.. The output shows BGP notifications for hold timer expiration between R4 and neighbor 10.0.0.2. This indicates that keepalive messages are not being exchanged in time, causing the BGP session to reset repeatedly. This is typically due to a flapping link, high CPU load, or mismatched hold timers.

Answer

The BGP neighbor has a mismatched autonomous system number.

Answer

The BGP update interval is too short, causing excessive updates.

Answer

The router is configured with soft-reconfiguration inbound, causing memory issues.

Question 14

A network engineer runs the following command on Router R5:

R5# show logging | include %LINEPROTO-5-UPDOWN

*Mar  1 00:00:10.123: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up
*Mar  1 00:00:20.456: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to down
*Mar  1 00:00:30.789: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up
*Mar  1 00:00:40.012: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to down
*Mar  1 00:00:50.345: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up
*Mar  1 00:01:00.678: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to down

Based on this output, what is the most likely problem?

Accepted Answer

There is a physical layer issue causing the interface to flap.. The output shows the line protocol on GigabitEthernet0/0 flapping every 10 seconds. This is a classic symptom of a flapping interface, often due to a physical issue (bad cable, faulty transceiver) or a Layer 2 problem (e.g., spanning tree topology changes, keepalive mismatch).

Answer

The interface is administratively down.

Answer

The interface is configured with a high bandwidth delay product.

Answer

The router is experiencing a high CPU load due to routing updates.

Question 15

A network engineer runs the following command on Router R6:

R6# show logging | include %SEC-6-IPACCESSLOGP

*Mar  1 00:01:15.123: %SEC-6-IPACCESSLOGP: list ACL_INBOUND denied tcp 10.0.0.100(12345) -> 192.168.1.1(80), 1 packet
*Mar  1 00:01:20.456: %SEC-6-IPACCESSLOGP: list ACL_INBOUND denied tcp 10.0.0.100(12346) -> 192.168.1.1(80), 1 packet
*Mar  1 00:01:25.789: %SEC-6-IPACCESSLOGP: list ACL_INBOUND denied tcp 10.0.0.100(12347) -> 192.168.1.1(80), 1 packet
*Mar  1 00:01:30.012: %SEC-6-IPACCESSLOGP: list ACL_INBOUND denied tcp 10.0.0.100(12348) -> 192.168.1.1(80), 1 packet

Based on this output, what is the most likely problem?

Accepted Answer

A host at 10.0.0.100 is attempting to access a web server at 192.168.1.1 and is being blocked by the ACL.. The output shows repeated denied packets from source 10.0.0.100 to destination 192.168.1.1 on port 80 (HTTP). This indicates that a host at 10.0.0.100 is trying to access a web server at 192.168.1.1 but is being blocked by ACL ACL_INBOUND. The pattern suggests a possible scan or attack, or a legitimate access that is being denied due to misconfiguration.

Answer

The ACL ACL_INBOUND is permitting traffic from 10.0.0.100 to 192.168.1.1 on port 80.

Answer

The router is experiencing a DoS attack from 192.168.1.1.

Answer

The ACL ACL_INBOUND is not configured on any interface.

Question 16

A network engineer runs the following command on Router R7:

R7# show logging | include %SYS-2-MALLOCFAIL

*Mar  1 00:05:10.123: %SYS-2-MALLOCFAIL: Memory allocation failed for size 1024, from process 0x12345678, pool Processor
*Mar  1 00:06:20.456: %SYS-2-MALLOCFAIL: Memory allocation failed for size 2048, from process 0x12345678, pool Processor
*Mar  1 00:07:30.789: %SYS-2-MALLOCFAIL: Memory allocation failed for size 512, from process 0x12345678, pool Processor

Based on this output, what is the most likely problem?

Accepted Answer

The router has a memory leak or is running out of memory in the Processor pool.. The output shows memory allocation failures in the Processor pool. This indicates that the router is running low on memory, which can cause various issues including process crashes, inability to allocate buffers, and overall instability. The process ID 0x12345678 is likely a specific process that is consuming memory or failing to allocate.

Answer

The router is experiencing high CPU utilization due to routing protocol updates.

Answer

The router's logging buffer is full and cannot store new messages.

Answer

The router has a hardware failure in the memory module.

Question 17

A network engineer runs the following command on Router R8:

R8# show logging | include %LDP-5-NBRCHG

*Mar  1 00:01:10.123: %LDP-5-NBRCHG: LDP Neighbor 10.0.0.2:0 (1) is UP
*Mar  1 00:02:20.456: %LDP-5-NBRCHG: LDP Neighbor 10.0.0.2:0 (1) is DOWN
*Mar  1 00:03:30.789: %LDP-5-NBRCHG: LDP Neighbor 10.0.0.2:0 (1) is UP
*Mar  1 00:04:40.012: %LDP-5-NBRCHG: LDP Neighbor 10.0.0.2:0 (1) is DOWN

Based on this output, what is the most likely problem?

Accepted Answer

The LDP session is flapping due to an unstable IGP route to 10.0.0.2.. The output shows LDP neighbor 10.0.0.2 flapping between UP and DOWN. This indicates instability in the LDP session, often due to a flapping IGP route (since LDP depends on IGP reachability), or a misconfiguration of LDP parameters such as hello interval or hold time.

Answer

The MPLS label space is exhausted.

Answer

The router has a mismatched LDP router ID.

Answer

The LDP hello interval is set too high, causing slow detection.

Question 18

A network engineer runs the following command on Router R9:

R9# show logging | include %DMVPN-5-ADJCHG

*Mar  1 00:01:05.123: %DMVPN-5-ADJCHG: NHRP: Peer 10.0.0.1 on Tunnel0 is UP
*Mar  1 00:02:10.456: %DMVPN-5-ADJCHG: NHRP: Peer 10.0.0.1 on Tunnel0 is DOWN
*Mar  1 00:03:15.789: %DMVPN-5-ADJCHG: NHRP: Peer 10.0.0.1 on Tunnel0 is UP
*Mar  1 00:04:20.012: %DMVPN-5-ADJCHG: NHRP: Peer 10.0.0.1 on Tunnel0 is DOWN

Based on this output, what is the most likely problem?

Accepted Answer

The DMVPN tunnel is flapping due to an unstable IPsec SA.. The output shows NHRP peer flapping on Tunnel0, indicating that the DMVPN tunnel is unstable. This is often due to a flaking physical interface, IPsec SA expiration, or routing issues. The peer 10.0.0.1 is going up and down repeatedly.

Answer

The NHRP hold time is set too high.

Answer

The router has a mismatched DMVPN phase configuration.

Answer

The tunnel interface is administratively down.

Question 19

Examine the following partial router configuration:

logging buffered 16384
logging console warnings
logging monitor notifications
logging trap debugging
logging source-interface Loopback0
logging 192.168.1.100

What is the effect of this configuration?

Accepted Answer

Syslog messages of severity 0 through 7 are sent to the server 192.168.1.100.. This configuration sets up logging with different severity levels for different destinations. The 'logging trap debugging' sends all messages (severity 0-7) to the syslog server at 192.168.1.100, while console gets only warnings (severity 4) and monitor gets notifications (severity 5). The buffer is set to 16384 bytes.

Answer

Only syslog messages of severity 0 through 4 are sent to the server 192.168.1.100.

Answer

The syslog server receives messages with the IP address of the outgoing interface as the source.

Answer

The logging buffer stores up to 16384 syslog messages.

Question 20

Given the following partial configuration on a Cisco IOS-XE router:

logging host 10.1.1.1 transport tcp port 514
logging source-interface GigabitEthernet0/1
logging on

What is missing or incorrect in this configuration?

Accepted Answer

The syslog server must support TCP syslog, which is not defined in RFC 3164.. By default, syslog uses UDP port 514. When using TCP transport, the syslog server must be configured to accept TCP connections, and this is not a common configuration. The configuration itself is syntactically correct, but the question tests knowledge that TCP transport for syslog is non-standard and may not work with typical syslog servers.

Answer

The configuration is correct; no changes are needed.

Answer

The 'logging on' command is redundant because logging is enabled by default.

Answer

The port number should be 5140 for TCP syslog.