clear logging
Clears the logging buffer on a Cisco IOS device, removing all syslog messages stored in memory, typically used to reset the log for troubleshooting or to free up buffer space.
Definition: clear logging is a Cisco IOS privileged exec command. Clears the logging buffer on a Cisco IOS device, removing all syslog messages stored in memory, typically used to reset the log for troubleshooting or to free up buffer space.
Overview
The 'clear logging' command in Cisco IOS privileged EXEC mode is used to erase all syslog messages stored in the router's logging buffer. This buffer is a memory-resident area that holds log messages generated by the device, such as interface state changes, security alerts, and system errors. Clearing the buffer is a common practice during troubleshooting to remove old messages that may clutter the log, allowing the engineer to focus on new events.
It is also useful when the buffer is full and the device is dropping new messages, as clearing frees up space. The command does not affect the running configuration or any other stored logs (e.g., external syslog servers). It only impacts the local buffer.
The privilege level required is 15 (privileged EXEC), and the command is immediate with no confirmation prompt. Alternatives include using 'logging buffered <size>' to adjust buffer size, or 'terminal monitor' to view logs in real-time. In a broader workflow, 'clear logging' is often followed by reproducing the issue and then using 'show logging' to capture fresh output.
Understanding this command is essential for CCNA/CCNP candidates as it is a fundamental tool for log management and troubleshooting.
clear loggingWhen to Use This Command
- After troubleshooting a network issue, clear the logging buffer to start fresh for monitoring new events.
- When the logging buffer is full and you need to free memory for new log entries.
- Before performing a critical configuration change to ensure only new logs are captured for analysis.
- To remove sensitive or outdated log entries before sharing the device output with a colleague.
Command Examples
Clear the logging buffer
clear loggingClear logging buffer [confirm] Router#
The command prompts for confirmation. Press Enter to confirm. After clearing, the buffer is empty and no output is shown.
Clear logging buffer with no confirmation (using 'yes')
clear loggingClear logging buffer [confirm] y Router#
Typing 'y' and pressing Enter bypasses the default confirmation. The buffer is cleared immediately.
Understanding the Output
The 'clear logging' command does not produce a detailed output; it simply prompts for confirmation. After execution, the logging buffer is emptied. To verify, use 'show logging' to see that the buffer is empty (e.g., 'Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns)').
In a real network, clearing the buffer is useful when you want to isolate new events without old messages cluttering the view.
Configuration Scenarios
Clearing the logging buffer before troubleshooting a routing issue
A network engineer suspects a routing problem between two branch routers and wants to capture only fresh log messages related to the issue. The logging buffer currently contains days of old messages.
Topology
R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2Steps
- 1.Step 1: Connect to R1 via console or SSH and enter privileged EXEC mode: R1> enable
- 2.Step 2: Clear the logging buffer: R1# clear logging
- 3.Step 3: Verify the buffer is empty: R1# show logging | include Log Buffer
- 4.Step 4: Reproduce the routing issue (e.g., ping failure, route flapping).
- 5.Step 5: Display the new log messages: R1# show logging
! No configuration changes needed; command is executed in privileged EXEC mode. R1# clear logging Clear logging buffer [confirm] R1#
Verify: Use 'show logging' to confirm the buffer is empty. Expected output includes 'Log Buffer (0 bytes)' or similar indicating zero messages.
Watch out: The command clears the buffer immediately without a confirmation prompt in some IOS versions; ensure you have captured any important logs before clearing.
Clearing the logging buffer to free up space when buffer is full
A router's logging buffer is full and new syslog messages are being dropped. The engineer needs to clear the buffer to restore logging capability.
Topology
Single router R1 with no specific topology required.Steps
- 1.Step 1: Enter privileged EXEC mode: R1> enable
- 2.Step 2: Check current buffer usage: R1# show logging | include Log Buffer
- 3.Step 3: Clear the buffer: R1# clear logging
- 4.Step 4: Verify buffer is cleared: R1# show logging | include Log Buffer
- 5.Step 5: Optionally, increase buffer size to prevent future overflow: R1(config)# logging buffered 32768
! Clearing the buffer R1# clear logging Clear logging buffer [confirm] R1# ! Optional: Increase buffer size R1# configure terminal R1(config)# logging buffered 32768 R1(config)# end
Verify: After clearing, 'show logging' should show 'Log Buffer (0 bytes)' or similar. If buffer size was changed, 'show logging' will reflect the new size.
Watch out: Clearing the buffer does not change the buffer size; if the buffer is frequently full, consider increasing its size with 'logging buffered <size>'.
Troubleshooting with This Command
The 'clear logging' command is primarily used to reset the logging buffer for troubleshooting. Healthy output after clearing is an empty buffer, indicated by 'Log Buffer (0 bytes)' in 'show logging'. Problem indicators include a full buffer (e.g., 'Log Buffer (32768 bytes) - 100% used') or messages being dropped.
When diagnosing issues, first clear the buffer, then reproduce the problem, and finally examine the fresh logs. Focus on severity levels (0-7), with levels 0-3 indicating critical errors. Common symptoms that warrant clearing include: interface flapping (look for 'line protocol' messages), routing adjacency changes (OSPF/ EIGRP neighbor state changes), or security violations (authentication failures).
A step-by-step diagnostic flow: 1) Clear the buffer. 2) Trigger the issue (e.g., ping, traffic generation). 3) Run 'show logging' and look for messages with timestamps. 4) Correlate with other commands like 'show interfaces', 'show ip route', or 'debug ip ospf events'. For example, if OSPF neighbor is dropping, clear logging, then check 'show ip ospf neighbor' and compare with log messages. The command is also useful before enabling debugs to avoid capturing pre-existing messages.
Remember that 'clear logging' does not affect logs sent to a syslog server; those remain. Always document the time of clearing for accurate correlation.
CCNA Exam Tips
CCNA exam tip: 'clear logging' only clears the buffer in RAM, not the syslog server logs if configured.
CCNA exam tip: The command requires Privileged EXEC mode (enable).
CCNA exam tip: After clearing, use 'show logging' to confirm the buffer is empty; exam may test the sequence.
CCNA exam tip: 'clear logging' does not affect logging configuration; it only clears stored messages.
Common Mistakes
Mistake 1: Assuming 'clear logging' clears logs on a remote syslog server — it only clears the local buffer.
Mistake 2: Forgetting to confirm the prompt, leaving the command incomplete.
Mistake 3: Using 'clear logging' in User EXEC mode (>) instead of Privileged EXEC mode (#).
clear logging vs show logging
Clear logging and show logging are often paired in troubleshooting workflows: show logging reveals the current buffer contents and configuration, while clear logging resets the buffer to start fresh. They are commonly confused because both relate to the logging buffer, but one is a destructive action and the other is purely informational.
| Aspect | clear logging | show logging |
|---|---|---|
| Scope | Logging buffer | Entire logging system (buffer, config, stats) |
| Effect | Destructive (deletes buffer) | Read-only (displays data) |
| Persistence | Lasts until next reboot or new messages fill buffer | Temporary output; no state change |
| Typical use | Reset log for troubleshooting; free buffer space | Monitor events; verify logging configuration |
| Output | None (command executes silently) | Detailed list of messages and settings |
Use clear logging when you need to empty the logging buffer to isolate new messages during troubleshooting or to reclaim memory.
Use show logging when you need to review current buffer contents, verify logging configuration, or check syslog statistics.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches), the 'clear logging' command behaves identically to classic IOS. The syntax and output are the same. In NX-OS (e.g., Nexus switches), the equivalent command is 'clear log' (without 'ging'), which clears the log buffer.
For example: 'switch# clear log'. On ASA firewalls, the command is 'clear logging' as well, but note that ASA uses a different logging architecture; the buffer is cleared similarly. In IOS-XR, the command is 'clear logging' but the output format differs; use 'show logging' to verify.
Differences between IOS versions: In older IOS 12.x, the command may prompt for confirmation ('Clear logging buffer [confirm]'), while in 15.x and later, it may execute without prompt. Always check the specific version. On some platforms, 'clear logging' also clears the console logging buffer if configured.
There is no impact on the running configuration; the command is not saved. For CCNA/CCNP, focus on IOS and IOS-XE as they are most common in exams.
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions