mediumMultiple ChoiceObjective-mapped
Syslog Message Delivery Failure Troubleshooting — Common Causes and Solutions
An engineer is troubleshooting why syslog messages from a router are not being received by the syslog server at 192.168.1.10. The router configuration includes 'logging host 192.168.1.10' and 'logging trap 6'. The engineer runs 'debug ip packet' and sees packets destined for 192.168.1.10 being sent but no response. What should the engineer check first?
Quick Answer
The answer is to verify that the syslog server is running and listening on UDP port 514. This is correct because syslog uses UDP, a connectionless protocol, meaning the router sends messages without expecting an acknowledgment; the debug output showing packets leaving the router confirms the transmission path is functional, so the failure likely lies at the server end—either the service is down, or a firewall is blocking inbound UDP 514 traffic. On the Cisco CCNP ENARSI 300-410 exam, this question tests your understanding of syslog delivery mechanics and the common pitfall of assuming a sent packet equals a received message, especially when troubleshooting logging issues. A key trap is forgetting that UDP lacks handshakes, so you must check the server first, not the network. Memory tip: “UDP sends, but does it land? Check the server’s listening hand.”
⚠ Common exam trap
Cisco often tests the misconception that increasing the logging severity level (trap level) will force messages through, but the real issue is always a missing or unreachable syslog server or a blocked UDP port 514.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that the syslog server is running and listening on UDP port 514.
The debug output confirms packets are leaving the router for 192.168.1.10, but no response is received. Syslog uses UDP port 514 by default, and the server must be actively listening on that port to receive and process the messages. Since the router is sending correctly, the most likely issue is that the syslog server is not running or its UDP 514 listener is blocked or unavailable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Verify that the syslog server is running and listening on UDP port 514.
Why this is correct
Correct because if the server is not listening or a firewall drops the packets, the messages will never be received despite the router sending them.
- ✗
Change the logging trap level to 7 (debugging) to ensure all messages are sent.
Why it's wrong here
Incorrect because the current trap level 6 (informational) already includes most messages; the issue is not severity level.
- ✗
Add the 'logging source-interface' command to use a loopback interface.
Why it's wrong here
Incorrect because the debug shows packets are being sent, so source interface is not the problem.
- ✗
Configure 'logging on' if it is not already enabled.
Why it's wrong here
Incorrect because if 'logging on' were disabled, the router would not send any packets; the debug confirms packets are being sent.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 300-410
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO symptoms indicate that syslog messages are not being sent to the remote syslog server? (Choose TWO.)
medium- A.The 'show logging' command shows messages in the local buffer.
- ✓ B.The syslog server receives messages from other devices but not from this router.
- C.The 'show log' command returns no output.
- ✓ D.The 'show logging' output does not list the syslog server IP address under 'Logging to'.
- E.Debug output appears on the console but not on the syslog server.
Why B: If syslog messages are not reaching the server, the 'show logging' output will not show the server address as active, and the server will not receive any messages. The 'show logging' command may still show messages in the local buffer. The 'show log' command does not exist. Debug output on the router does not confirm remote delivery.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.