hardMultiple ChoiceObjective-mapped
Troubleshooting Syslog Connectivity Failures on Cisco Routers
An engineer configures syslog logging to a remote server using the 'logging host' command. The engineer notices that syslog messages are not being received on the server, but the router can ping the server successfully. The engineer verifies that the logging level is set to debugging and that the server is configured to receive syslog messages. Which is the most likely explanation?
Quick Answer
The answer is that an ACL on the router blocking UDP port 514 outbound is the most likely explanation. Syslog messages are transmitted over UDP port 514 by default, and even when the router can ping the server successfully—confirming IP-level reachability—a configured access control list can silently drop the outbound syslog traffic without any error message. This scenario tests your understanding of how Cisco IOS handles syslog generation and the critical distinction between ICMP reachability and UDP port-level filtering, a common trap on the CCNP ENARSI 300-410 exam. Many candidates overlook that a successful ping only verifies Layer 3 connectivity, not that the specific UDP syslog port is permitted. A useful memory tip is to think of syslog as a “UDP-only messenger” that needs a clear path on port 514, so always check both the router’s outbound ACL and any firewall rules on the server side when troubleshooting syslog not received router issues.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An ACL on the router is blocking UDP port 514 outbound
A common edge case is that the syslog messages are sent via UDP port 514, but the router may have a firewall or ACL that blocks UDP traffic. Additionally, the 'logging source-interface' command might be configured, but if the source interface is not reachable from the server (e.g., due to routing issues), the server may drop the messages. Another possibility is that the server is listening on a different port or the router is using a different port due to configuration. However, a less obvious issue is that the 'logging monitor' or 'logging buffered' commands can interfere if the logging process is overwhelmed, but the most likely is that the syslog messages are being sent but the server's firewall or the router's own ACL is blocking them.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
An ACL on the router is blocking UDP port 514 outbound
Why this is correct
Correct. If an ACL is applied to the interface that blocks UDP 514, syslog messages will not reach the server.
- ✗
The logging host command requires the 'transport tcp' option to work
Why it's wrong here
Syslog uses UDP by default, and TCP is optional.
- ✗
The syslog server is not configured to accept messages from the router's IP
Why it's wrong here
This is possible but less common; the question states the server is configured.
- ✗
The logging level is set to emergencies only
Why it's wrong here
The engineer set the level to debugging, so this is not the issue.
Visual reference
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 300-410
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Drag and drop the steps to troubleshoot syslog connectivity failures into the correct order, from first to last.
hard- ✓ A.Ping syslog server from router
- ✓ B.Check syslog server port accessibility
- ✓ C.Review logging configuration on router
- ✓ D.Examine ACLs blocking syslog traffic
- ✓ E.Enable debug ip udp for syslog monitoring
Why A: First, verify reachability to the syslog server using ping. Then, check if the syslog server port (UDP 514) is open. Next, review the logging configuration on the router. After that, examine ACLs that may block syslog traffic. Finally, enable debug ip udp to monitor syslog packet flow.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.