logging trap [level]
Configures the severity level for syslog messages sent to a remote syslog server, filtering which messages are forwarded based on their severity.
logging trap [level]When to Use This Command
- Reduce syslog server load by sending only warnings and above (levels 0-4) during normal operations.
- Enable debugging messages (level 7) temporarily to a syslog server for troubleshooting a specific issue.
- Comply with security policies by ensuring all critical (level 2) and higher messages are logged externally.
- Filter out informational messages (level 6) to avoid cluttering the syslog server with routine notifications.
Command Examples
Set trap level to warnings and above
logging trap warningsNo output is generated; the command configures the trap level to 4 (warnings). Only syslog messages with severity 0-4 are sent to the configured syslog server.
Set trap level to debugging for troubleshooting
logging trap debuggingSets the trap level to 7 (debugging), allowing all syslog messages including debug output to be sent to the syslog server. Use with caution as it can generate high traffic.
Understanding the Output
This command does not produce output. To verify the configured trap level, use 'show logging'. In the output, look for 'Logging to: <server>' and the line 'Trap logging: level <severity>'. The severity level is shown as a number (0-7) or name. Ensure the level matches your intended filtering. A common mistake is setting the level too low (e.g., debugging) causing excessive traffic, or too high (e.g., emergencies) missing important warnings.
CCNA Exam Tips
CCNA exam may ask which severity levels are included when you set 'logging trap warnings' (levels 0-4).
Remember that 'logging trap' only affects messages sent to syslog servers, not console or buffer logging.
The default trap level is 'informational' (level 6) if not configured.
Know the severity level numbers: emergencies (0), alerts (1), critical (2), errors (3), warnings (4), notifications (5), informational (6), debugging (7).
Common Mistakes
Setting trap level to 'debugging' and forgetting to disable it, causing high CPU and bandwidth usage.
Confusing 'logging trap' with 'logging console' or 'logging buffered' — they control different destinations.
Using a level name incorrectly (e.g., 'warning' instead of 'warnings') — the command accepts both singular and plural but 'warnings' is standard.
Related Commands
logging host [ip]
Configures the router to send syslog messages to a remote syslog server at the specified IP address for centralized logging and monitoring.
show logging
Displays the state of system logging (syslog) on the device, including buffer contents, logging configuration, and statistics, used for troubleshooting and monitoring system events.
Practice for the CCNA 200-301
Test your knowledge with hundreds of CCNA practice questions covering all exam domains.
Practice CCNA Questions