Courseiva
SystemPrivileged EXEC

show logging

Displays the state of system logging (syslog) on the device, including buffer contents, logging configuration, and statistics, used for troubleshooting and monitoring system events.

Syntax·Privileged EXEC
show logging

When to Use This Command

  • Review recent system messages to diagnose a network issue after a crash or unexpected behavior.
  • Verify that logging is enabled and configured correctly (e.g., buffer size, syslog server).
  • Check the timestamp and severity of logged events to correlate with network incidents.
  • Monitor for specific error messages (e.g., interface flapping, authentication failures).

Command Examples

Basic show logging output

show logging
Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns)
    Console logging: disabled
    Monitor logging: disabled
    Buffer logging: level debugging, 100 messages logged
    Trap logging: level informational, 5 message lines logged

Log Buffer (10000 bytes):

*Mar  1 00:00:34.123: %SYS-5-CONFIG_I: Configured from console by console
*Mar  1 00:01:02.456: %LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to up
*Mar  1 00:01:03.789: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up
*Mar  1 00:02:15.321: %SYS-5-RESTART: System restarted --
*Mar  1 00:02:15.321: Cisco IOS Software, C1900 Software (C1900-UNIVERSALK9-M), Version 15.7(3)M, RELEASE SOFTWARE (fc2)
*Mar  1 00:02:15.321: Copyright (c) 1986-2016 by Cisco Systems, Inc.
*Mar  1 00:02:15.321: Compiled Thu 22-Dec-16 15:32 by prod_rel_team

First line shows syslog is enabled with no dropped messages. Console and monitor logging are disabled. Buffer logging is set to debugging level with 100 messages logged. Trap logging (to syslog server) is informational level with 5 messages. The log buffer shows recent messages: configuration change, interface up/down, and system restart with IOS version.

Show logging with syslog server configured

show logging
Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns)
    Console logging: level debugging, 37 messages logged
    Monitor logging: level debugging, 37 messages logged
    Buffer logging: level debugging, 37 messages logged
    Trap logging: level informational, 37 message lines logged
        Logging to 192.168.1.100 (udp port 514, audit disabled, link up),
              2 message lines logged, 0 message lines rate-limited,
              0 message lines dropped by MD, xml disabled, sequence number disabled
              filtering disabled
        Logging to 192.168.1.101 (udp port 514, audit disabled, link up),
              0 message lines logged, 0 message lines rate-limited,
              0 message lines dropped by MD, xml disabled, sequence number disabled
              filtering disabled

Log Buffer (10000 bytes):

*Mar  1 00:05:23.456: %SYS-5-CONFIG_I: Configured from console by console
*Mar  1 00:06:10.789: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down
*Mar  1 00:06:11.012: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down

This output shows logging is enabled with console and monitor logging at debugging level. Trap logging is informational and messages are being sent to two syslog servers: 192.168.1.100 (2 messages logged) and 192.168.1.101 (0 messages). The buffer shows recent events including an interface going down.

Understanding the Output

The 'show logging' command output is divided into two main sections: logging configuration and log buffer contents. The first section shows whether syslog is enabled, any dropped/rate-limited messages, and the logging levels for console, monitor, buffer, and trap (syslog server) destinations. 'Level debugging' means all messages from severity 0-7 are logged; 'level informational' means only messages 0-6. The trap logging section lists configured syslog servers with IP, port, link status, and message counts. The log buffer displays recent syslog messages with timestamps, facility code, severity, mnemonic, and description. Key fields: %FACILITY-SEVERITY-MNEMONIC: description. Severity 0=emergency, 1=alert, 2=critical, 3=error, 4=warning, 5=notice, 6=informational, 7=debug. Watch for high severity messages (0-3) indicating problems. A large number of dropped messages may indicate buffer overflow or rate limiting.

CCNA Exam Tips

1.

Remember that 'show logging' displays both configuration and buffer; the buffer is circular and overwrites oldest messages.

2.

Know that severity levels are 0-7, with 0 being most severe; 'debugging' includes all levels, 'informational' includes 0-6.

3.

The command is useful for verifying syslog server reachability and message delivery; exam may ask how to check if logging to a server is working.

4.

Be aware that 'show logging' output includes timestamps; if timestamps are not visible, check 'service timestamps' configuration.

Common Mistakes

Confusing 'show logging' with 'show log' (which does not exist); the correct command is 'show logging'.

Assuming that enabling logging globally automatically sends messages to a syslog server; you must also configure 'logging <ip>'.

Overlooking that the log buffer size is limited; if not configured, default is 4096 bytes, which may overwrite important messages quickly.

Related Commands

logging host [ip]

Configures the router to send syslog messages to a remote syslog server at the specified IP address for centralized logging and monitoring.

Practice for the CCNA 200-301

Test your knowledge with hundreds of CCNA practice questions covering all exam domains.

Practice CCNA Questions