Syslog: Severity Threshold Hides Events
The events you are chasing were never logged, and the log itself looks healthy. Diagnose the severity levels and fix it yourself, live, right below.
Symptom
Interfaces changed and configurations were saved, but no one saw the messages. Interpret the threshold direction and restore event visibility.
Your mission
Prove the cause, then fix it
Format
Guided CLI investigation
Investigate before you configure.
Use the CLI evidence to isolate the fault, make the smallest safe correction, then verify the network state changed.
Observe the symptom and link state.
Diagnose by comparing the protocol evidence.
Verify the expected device state and confirm the original symptom is resolved.
Console access: R1
This workspace stacks for portrait phones. Rotate to landscape for the full split-screen console.
Need a hint?
Reveal the root cause when you're ready.
Try the investigation first, then use this as your escape hatch, not a dead end.
Lab debrief
Turn the session into a repeatable troubleshooting pattern.
Use this reference after your attempt: first explain the symptom, then verify the evidence, then confirm the repair.
The problem
R1 had interface transitions and configuration changes, but neither the local console nor the remote syslog server recorded them. Both destinations are enabled and reachable.
What you'll practice
- Interpret syslog severity numbers from emergencies through debugging
- Explain threshold inclusion direction
- Read console, buffer and trap state from show logging
- Choose thresholds that admit severity 5 notifications
- Verify new events at both destinations
The topology
One router sends operational messages to its local console and a remote syslog server. Connectivity works; only the destination severity policies are wrong.
Commands to run yourself
The real diagnostic commands for this lab, copy-paste ready. Run these in the same order to reproduce the investigation on your own session.
show loggingTopology diagram
Frequently asked
Does logging trap errors include warnings and notifications?
No. A threshold of errors (3) includes only severities 0 through 3. Warnings (4), notifications (5), informational (6), and debugging (7) are excluded.
Why can a higher number mean more messages?
The configured number is the least-severe message admitted. Raising it widens the accepted range downward to include every more-important lower number too.
Ready to run this lab yourself?
No setup, no image sourcing. Book a session or ask for a live demo.