logging host [ip]
Configures the router to send syslog messages to a remote syslog server at the specified IP address for centralized logging and monitoring.
Definition: logging host [ip] is a Cisco IOS global config command. Configures the router to send syslog messages to a remote syslog server at the specified IP address for centralized logging and monitoring.
Overview
The `logging host [ip]` command is a fundamental tool in Cisco IOS for directing syslog messages from a network device to a remote syslog server. This command is critical for centralized logging, which enables network administrators to collect, monitor, and analyze log data from multiple devices in one location. Centralized logging is a cornerstone of network monitoring, security auditing, and troubleshooting because it provides a holistic view of network events, reduces the need to log into individual devices, and ensures logs are preserved even if a device crashes or is rebooted.
The concept behind syslog is a standard protocol (RFC 5424) for message logging, where devices generate messages with severity levels (0-7) and facilities (e.g., local0-local7). The `logging host` command tells the router to send these messages to a specified IP address (typically a Linux server running syslog-ng or rsyslog, or a commercial SIEM). You would reach for this command when you need persistent, off-device logging for compliance, security incident detection, or troubleshooting complex issues that span multiple devices.
Alternatives include local logging (`logging buffered`), which stores messages in RAM but loses them on reboot, or console logging (`logging console`), which is disruptive and not scalable. The `logging host` command fits into the broader workflow of configuring logging: first, you set the logging severity level (e.g., `logging trap debugging`), then specify the host, and optionally configure the source interface (`logging source-interface`). Important IOS behaviors: the command takes effect immediately and is saved to the running configuration; it requires privilege level 15 (enable mode) to configure; the router uses UDP port 514 by default (can be changed with `logging host [ip] transport tcp port [port]`); and if the remote server is unreachable, the router will buffer messages (if `logging buffered` is configured) or drop them.
The command does not impact CPU significantly unless the logging rate is extremely high. For CCNA and CCNP candidates, understanding this command is essential for network monitoring and troubleshooting scenarios in the exam and real-world networks.
logging host [ip]When to Use This Command
- Centralizing logs from multiple network devices to a single syslog server for easier troubleshooting and security auditing.
- Complying with organizational policies that require all network device logs to be stored off-device for forensic analysis.
- Monitoring real-time network events (e.g., interface flaps, routing changes) by forwarding logs to a SIEM system.
- Sending debug output to a remote server to avoid overwhelming the console or buffer during troubleshooting.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| ip | A.B.C.D | The IP address of the remote syslog server. This can be an IPv4 address in dotted decimal notation (e.g., 192.168.1.100). Common mistakes include using a broadcast address or an address that is not reachable from the router. Ensure the server is configured to receive syslog messages and that UDP port 514 (or TCP if configured) is open. |
Command Examples
Basic syslog server configuration
logging host 192.168.1.100No output is generated upon successful configuration. Use 'show logging' to verify the syslog server is listed.
Configuring multiple syslog servers
logging host 10.0.0.1
logging host 10.0.0.2Multiple hosts can be added; logs are sent to all configured servers. Verify with 'show logging'.
Understanding the Output
The 'logging host' command itself produces no output. To verify, use 'show logging'. In the output, look for 'Syslog logging: enabled' and a list of 'Logging to' entries showing the IP addresses of configured syslog servers.
A good state shows the servers listed with no errors. If a server is unreachable, logs may be buffered or dropped; check 'show logging' for 'messages dropped' counters. Also ensure 'logging on' is enabled globally.
Configuration Scenarios
Configure remote syslog logging to a central server
A network administrator wants to collect syslog messages from all routers in the network to a central Linux syslog server at 10.0.0.5 for monitoring and troubleshooting.
Topology
R1(Gi0/0)---192.168.1.0/24---(eth0) Syslog-Server (10.0.0.5)Steps
- 1.Step 1: Enter global configuration mode: Router> enable, Router# configure terminal
- 2.Step 2: Set the logging trap level to send messages of severity 0-6 (informational and above): Router(config)# logging trap informational
- 3.Step 3: Specify the remote syslog server IP: Router(config)# logging host 10.0.0.5
- 4.Step 4: (Optional) Set the source interface for syslog packets to ensure reachability: Router(config)# logging source-interface GigabitEthernet0/0
- 5.Step 5: Exit configuration mode and save: Router(config)# end, Router# write memory
! Router(config)# logging trap informational Router(config)# logging host 10.0.0.5 Router(config)# logging source-interface GigabitEthernet0/0 !
Verify: Use `show logging` to verify the syslog server is configured. Expected output includes: 'Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns) ... Logging to: 10.0.0.5 (udp port 514, audit disabled, link up)'
Watch out: If the syslog server is not reachable, the router will not send messages and may drop them if no local buffer is configured. Always ensure IP connectivity and that the server's firewall allows UDP 514.
Configure logging with TCP transport for reliable delivery
A network engineer needs reliable syslog delivery across a WAN link where packet loss is possible. The syslog server is at 192.168.100.10 and supports TCP syslog on port 514.
Topology
R2(Gi0/0)---10.10.10.0/30---(Gi0/1) R3(Gi0/0)---192.168.100.0/24---(eth0) Syslog-Server (192.168.100.10)Steps
- 1.Step 1: Enter global configuration mode: Router> enable, Router# configure terminal
- 2.Step 2: Set logging trap level to debugging to capture all messages: Router(config)# logging trap debugging
- 3.Step 3: Configure the remote host with TCP transport: Router(config)# logging host 192.168.100.10 transport tcp port 514
- 4.Step 4: (Optional) Configure logging buffered as a fallback: Router(config)# logging buffered 8192 debugging
- 5.Step 5: Exit and save: Router(config)# end, Router# write memory
! Router(config)# logging trap debugging Router(config)# logging host 192.168.100.10 transport tcp port 514 Router(config)# logging buffered 8192 debugging !
Verify: Use `show logging` to confirm TCP transport. Expected output includes: 'Logging to: 192.168.100.10 (tcp port 514, audit disabled, link up)' and 'Logging TCP connections: 1 open'
Watch out: TCP syslog requires the server to support TCP syslog (most do). If the server only listens on UDP, the connection will fail. Also, TCP logging can cause backpressure if the server is slow, potentially filling the router's logging buffer.
Troubleshooting with This Command
The `logging host` command is primarily used for sending logs, but troubleshooting its configuration involves verifying connectivity and message delivery. Healthy output from `show logging` shows the syslog server listed with 'link up' and no significant dropped messages. Problem indicators include 'link down' (server unreachable), '0 messages logged' (if trap level is too restrictive), or 'messages dropped' (buffer overflow).
Key fields to focus on in `show logging` are: 'Logging to:' line showing the server IP and protocol, 'Syslog logging: enabled/disabled', and 'messages dropped' count. Common symptoms this command helps diagnose include: missing logs for critical events (check trap level), no logs at all (check if logging is enabled globally with `logging on`), or intermittent logs (network issues). A step-by-step diagnostic flow: 1) Verify global logging is enabled: `show logging` should say 'Syslog logging: enabled'.
If not, configure `logging on`. 2) Check the trap level: `show logging` displays 'Logging trap level: informational' (or whatever). Ensure it includes the severity of events you want. 3) Verify the server is reachable: ping the syslog server from the router. 4) Check the logging host configuration: `show logging` lists the host. If 'link down', check routing and ACLs. 5) For TCP, check TCP connection state: `show logging` shows 'Logging TCP connections: 1 open' if connected. 6) Monitor real-time: use `debug logging` (caution: can overwhelm the router) to see if messages are being generated.
Correlate with other commands: `show ip route` to verify route to server, `show access-lists` to ensure no ACL blocks UDP 514, and `show interfaces` to check for errors. If using TCP, `show tcp brief` can show the syslog connection. For advanced troubleshooting, use `packet-tracer` or `debug ip packet` (with caution) to see if syslog packets leave the router.
Remember that syslog uses UDP 514 by default, so the router does not expect a response; if the server is down, messages are silently dropped unless buffered locally.
CCNA Exam Tips
CCNA 200-301: Remember that 'logging host' requires 'logging on' to be enabled globally; otherwise, no logs are sent.
CCNA 200-301: You can configure up to 8 syslog servers; the exam may test the maximum number.
CCNA 200-301: Syslog uses UDP port 514 by default; the exam might ask about the protocol and port.
CCNA 200-301: To change severity level sent to a specific host, use 'logging trap <level>' before the host command.
Common Mistakes
Mistake: Forgetting to enable 'logging on' globally — logs are not sent even if hosts are configured.
Mistake: Using 'logging host' without specifying a reachable IP — logs are queued and may be dropped.
Mistake: Not configuring 'logging trap' to filter severity — all messages up to debugging flood the server.
logging host [ip] vs logging trap [level]
Both commands are essential for remote syslog configuration and are often configured together. They serve different purposes: one defines the destination, the other defines the severity filter. Confusion arises because both affect syslog output to a remote server.
| Aspect | logging host [ip] | logging trap [level] |
|---|---|---|
| Function | Specifies remote syslog server IP address | Defines severity threshold for syslog messages |
| Scope | Controls which server receives logs | Controls which messages are forwarded based on severity |
| Configuration Mode | Global configuration | Global configuration |
| Persistence | Saved in running-config and startup-config | Saved in running-config and startup-config |
| Precedence | No precedence; required for remote logging | Applies only if at least one logging host is configured |
| Typical Use | Point logging to a central syslog server | Filter out low-severity messages to reduce log volume |
Use logging host [ip] when you need to forward syslog messages to a specific remote server for centralized log collection.
Use logging trap [level] when you want to filter out lower-severity messages and only send critical logs to conserve bandwidth or focus on high-severity events.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches), the `logging host` command syntax is identical to classic IOS, but the output of `show logging` may include additional fields like 'Logging to: 10.0.0.5 (udp port 514, audit disabled, link up, sequence disabled, filtering disabled)'. IOS-XE also supports `logging host [ip] transport tcp` with the same syntax. In NX-OS (e.g., Nexus switches), the equivalent command is `logging server [ip]` under global config, with optional parameters like `facility` and `severity`.
For example: `logging server 10.0.0.5 facility local7 severity 6`. NX-OS also uses `logging source-interface` similarly. On Cisco ASA firewalls, the command is `logging host [interface_name] [ip] [protocol/port]`, where the interface name is required (e.g., `logging host inside 10.0.0.5 udp 514`).
ASA also requires `logging enable` to turn on logging. In IOS-XR (e.g., ASR 9000), the command is `logging host [ip]` but under the `logging` configuration mode (entered via `configure logging`). IOS-XR also supports `logging host [ip] vrf [vrf-name]` for VRF-aware logging.
Differences between IOS versions: in 12.x, the `logging host` command did not support TCP transport; TCP was added in 15.x. In 16.x (IOS-XE), the command remains stable. Always check the specific platform documentation for exact syntax and capabilities.
Related Commands
logging trap [level]
Configures the severity level for syslog messages sent to a remote syslog server, filtering which messages are forwarded based on their severity.
show logging
Displays the state of system logging (syslog) on the device, including buffer contents, logging configuration, and statistics, used for troubleshooting and monitoring system events.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions