Cisco Systems CL-28826-01 Defining Syslog Servers

62-3

User Guide for Cisco Security Manager 4.4

OL-28826-01

Chapter62 Configuring Logging Policies

Logging on Cisco IOS Routers

Note Make sure not to make buffers so large that the router runs out of memory for other tasks. If

this happens, deployment may fail.

Step 6 (Optional) Define a rate limit to prevent a flood of output messages:

a. Select Enable Rate Limit. This option is selected by default.

b. Enter the maximum number of messages that can be sent per second.

c. Select the severity levels to exclude from the rate limit. For example, if you select 2 (critical), all

syslog messages of severity levels 0-2 are sent to the syslog server regardless of the defined rate

limit.

d. Select All Messages to apply the rate limit to all syslog messages except console messages (and

excepting those severity levels specifically excluded above).

e. Select Console Messages to apply the rate limit to console messages only.

Note If you enable rate limiting without specifying any options, the default settings (10 messages

per second, applied to console messages only) are applied.

Step 7 (Optional) To add an origin identifier to the beginning of each syslog message:

a. Select the type of origin ID to send—the IP address of the router, its host name, or a text string that

you provide.

b. If you select String, enter the desired text in the field provided. Spaces are permitted.

The origin identifier is useful for identifying the source of syslog messages in cases where you send

output from multiple devices to a single syslog server.

Note The origin identifier is not added to messages sent to local destinations, such as the buffer,

the console, and the monitor.

Defining Syslog Servers

This procedure describes how to define the servers to which the router should send syslog messages.

When you define a syslog server, you can choose whether the logging messages it receives should be

forwarded as plain text or in XML format.

If you define multiple syslog servers, logging messages are sent to all of them.

Before You Begin

•Enable syslog logging and define basic logging parameters on the Syslog Logging Setup page. For

more information, see Defining Syslog Logging Setup Parameters, page 62-1.