mediumMultiple Choice
300-410 Practice Question: According to RFC 3164, which facility code is…
According to RFC 3164, which facility code is used by default for Cisco IOS syslog messages?
⚠ Common exam trap
300-410 often tests the default syslog facility for Cisco IOS, and candidates frequently confuse it with local0 or user because those are common in other systems or are configurable options, but the default is local7.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Local7
RFC 3164 defines syslog facility codes, and Cisco IOS devices use facility local7 (code 23) by default for logging messages. This means when a Cisco router or switch sends syslog messages to a server, they are tagged with the local7 facility unless explicitly changed. The default is set in the logging configuration and can be verified with the show logging command, which displays 'Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns)' and includes the facility. Local7 is chosen to allow administrators to separate Cisco device logs from other system logs on a syslog server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Local0
Why it's wrong here
Local0 is a configurable facility, not the IOS default; IOS uses local7 for syslog messages. Local0 is tempting because it is a valid local-use facility often chosen when administrators want to separate Cisco logs from other sources, but it requires explicit configuration via the logging facility command.
- ✓
Local7
Why this is correct
RFC 3164 defines facility codes where local7 corresponds to decimal 23. Cisco IOS uses this facility by default when generating syslog messages, so messages are tagged with local7 unless the administrator overrides it with the logging facility command.
- ✗
User
Why it's wrong here
Cisco IOS defaults to facility local7, not user; user (facility 1) is reserved for user-level processes on hosts, not IOS syslog output. It is tempting because RFC 3164 lists user as a common facility, but IOS explicitly emits local7 unless the logging facility command overrides it.
- ✗
Syslog
Why it's wrong here
Syslog is not a facility code in RFC 3164; facilities are numeric categories such as local7, user or mail. It is tempting because the protocol itself is called syslog, but the default IOS facility is local7, and syslog is the message format and transport, not a facility value.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,401-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.