logging host [ip]
Configures the router to send syslog messages to a remote syslog server at the specified IP address for centralized logging and monitoring.
logging host [ip]When to Use This Command
- Centralizing logs from multiple network devices to a single syslog server for easier troubleshooting and security auditing.
- Complying with organizational policies that require all network device logs to be stored off-device for forensic analysis.
- Monitoring real-time network events (e.g., interface flaps, routing changes) by forwarding logs to a SIEM system.
- Sending debug output to a remote server to avoid overwhelming the console or buffer during troubleshooting.
Command Examples
Basic syslog server configuration
logging host 192.168.1.100No output is generated upon successful configuration. Use 'show logging' to verify the syslog server is listed.
Configuring multiple syslog servers
logging host 10.0.0.1
logging host 10.0.0.2Multiple hosts can be added; logs are sent to all configured servers. Verify with 'show logging'.
Understanding the Output
The 'logging host' command itself produces no output. To verify, use 'show logging'. In the output, look for 'Syslog logging: enabled' and a list of 'Logging to' entries showing the IP addresses of configured syslog servers. A good state shows the servers listed with no errors. If a server is unreachable, logs may be buffered or dropped; check 'show logging' for 'messages dropped' counters. Also ensure 'logging on' is enabled globally.
CCNA Exam Tips
CCNA 200-301: Remember that 'logging host' requires 'logging on' to be enabled globally; otherwise, no logs are sent.
CCNA 200-301: You can configure up to 8 syslog servers; the exam may test the maximum number.
CCNA 200-301: Syslog uses UDP port 514 by default; the exam might ask about the protocol and port.
CCNA 200-301: To change severity level sent to a specific host, use 'logging trap <level>' before the host command.
Common Mistakes
Mistake: Forgetting to enable 'logging on' globally — logs are not sent even if hosts are configured.
Mistake: Using 'logging host' without specifying a reachable IP — logs are queued and may be dropped.
Mistake: Not configuring 'logging trap' to filter severity — all messages up to debugging flood the server.
Related Commands
logging trap [level]
Configures the severity level for syslog messages sent to a remote syslog server, filtering which messages are forwarded based on their severity.
show logging
Displays the state of system logging (syslog) on the device, including buffer contents, logging configuration, and statistics, used for troubleshooting and monitoring system events.
Practice for the CCNA 200-301
Test your knowledge with hundreds of CCNA practice questions covering all exam domains.
Practice CCNA Questions