Logging

Logging provides comprehensive event recording and monitoring capabilities that capture, categorize, and distribute system messages based on configurable severity levels from emergency to debugging. It supports multiple output destinations including console, buffer, file storage, persistent flash storage, and remote syslog servers with flexible transport options including UDP, TCP, and secure TLS connections. Advanced features include message counting with timestamps, rate limiting to prevent log flooding, and persistent logging for long-term retention. Logging configuration enables centralized log collection, real-time monitoring, forensic analysis, and compliance reporting by providing detailed visibility into device operations, security events, and network behavior patterns.

Diagram

Classes

configuration (iosxe.devices)

Name	Type	Constraint	Mandatory	Default Value
logging	Class	`[logging]`	No

logging (iosxe.devices.configuration)

Name	Type	Constraint	Mandatory
monitor_severity	String		No
buffered_size	Integer	min: `4096`, max: `2147483647`	No
buffered_severity	String		No
buffered_size_legacy	Integer	min: `4096`, max: `2147483647`	No
buffered_severity_legacy	String		No
console	Boolean	`true`, `false`	No
console_severity	String		No
facility	Choice	`auth`, `cron`, `daemon`, `kern`, `local0`, `local1`, `local2`, `local3`, `local4`, `local5`, `local6`, `local7`, `lpr`, `mail`, `news`, `sys10`, `sys11`, `sys12`, `sys13`, `sys14`, `sys9`, `syslog`, `user`, `uucp`	No
history_size	Integer	min: `0`, max: `65535`	No
history_severity	String		No
trap	Boolean	`true`, `false`	No
trap_severity	String		No
origin_id_type	Choice	`hostname`, `ip`, `ipv6`	No
origin_id_name	String		No
file_name	String		No
file_max_size	Integer	min: `0`, max: `4294967295`	No
file_min_size	Integer	min: `0`, max: `4294967295`	No
file_severity	String		No
source_interface_type	Choice	`Loopback`, `Vlan`, `GigabitEthernet`, `TwoGigabitEthernet`, `FiveGigabitEthernet`, `TenGigabitEthernet`, `TwentyFiveGigabitEthernet`, `FortyGigabitEthernet`, `FiftyGigabitEthernet`, `HundredGigabitEthernet`	No
source_interface_id	Any	String or Integer[min: `0`]	No
count	Boolean	`true`, `false`	No
persistent_url	String		No
persistent_size	Integer	min: `16384`, max: `2147483647`	No
persistent_filesize	Integer	min: `8192`, max: `2147483647`	No
rate_limit_all	Integer	min: `1`, max: `10000`	No
source_interfaces_vrf	List	`[source_interfaces_vrf]`	No
hosts	List	`[hosts]`	No

source_interfaces_vrf (iosxe.devices.configuration.logging)

Name	Type	Constraint	Mandatory
vrf	String		Yes
interface_type	Choice	`Loopback`, `Vlan`, `GigabitEthernet`, `TwoGigabitEthernet`, `FiveGigabitEthernet`, `TenGigabitEthernet`, `TwentyFiveGigabitEthernet`, `FortyGigabitEthernet`, `FiftyGigabitEthernet`, `HundredGigabitEthernet`	No
interface_id	Any	String or Integer[min: `0`]	No

hosts (iosxe.devices.configuration.logging)

Name	Type	Constraint	Mandatory
ip	IP		Yes
vrf	String		No
transport_udp_ports	List	Integer[min: `1`, max: `65535`]	No
transport_tcp_ports	List	Integer[min: `1`, max: `65535`]	No
transport_tls_ports	List	`[transport_tls_ports]`	No

transport_tls_ports (iosxe.devices.configuration.logging.hosts)

Name	Type	Constraint	Mandatory	Default Value
port	Integer	min: `1025`, max: `65535`	Yes
profile	String		No

By capturing, categorizing, and distributing system messages to various destinations, logging enables real-time analysis, compliance, and operational visibility.

Logging Parameters

Key Components:

Monitor Severity (monitor_severity): Sets the severity level for messages displayed on the terminal.
Buffered Log Size and Severity (buffered_size, buffered_severity): Configures the size and severity level for the internal logging buffer. Use these parameters for IOS-XE 17.15 and later versions.
Buffered Log Size and Severity - Legacy (buffered_size_legacy, buffered_severity_legacy): Configures the size and severity level for the internal logging buffer on IOS-XE 17.12.x and earlier versions. Use these parameters instead of buffered_size and buffered_severity when targeting older IOS-XE releases.
Console Logging (console, console_severity): Enables console logging and sets the severity level for messages sent to the console.
Facility (facility): Specifies the syslog facility for remote logging.
History Size and Severity (history_size, history_severity): Configures the size and severity level for the logging history.
Trap Logging (trap, trap_severity): Enables SNMP trap logging and sets the severity level.
Origin ID Type and Name (origin_id_type, origin_id_name): Sets the origin ID for syslog messages.
Source Interface (source_interface_type, source_interface_id): Specifies the source interface for outgoing syslog messages.
File Logging (file_name, file_max_size, file_severity): Configures file logging with name, maximum size, and severity.
Remote Syslog Hosts (hosts): Defines remote syslog servers with IP, VRF, transport type/ports, and TLS profile.
Source Interfaces VRF (source_interfaces_vrf): Specifies source interfaces for syslog messages within a VRF.
Logging Count (count): Enables message counting and timestamps the last occurrence of each log message for tracking message frequency and patterns.
Persistent Logging (persistent_url, persistent_size, persistent_filesize): Configures persistent logging to flash storage with URL path, total disk space allocation, and individual log file size limits for long-term log retention.
Rate Limiting (rate_limit_all): Sets a global rate limit for log messages in messages per second to prevent log flooding and ensure system stability during high-volume logging scenarios.

Key Parameters Briefly Explained:

monitor_severity: Terminal message severity.
buffered_size, buffered_severity: Buffer size and severity (IOS-XE 17.15+).
buffered_size_legacy, buffered_severity_legacy: Buffer size and severity (IOS-XE 17.12.x and earlier).
console, console_severity: Console logging enable and severity.
facility: Syslog facility.
history_size, history_severity: History log settings.
trap, trap_severity: SNMP trap logging.
origin_id_type, origin_id_name: Syslog origin ID.
source_interface_type, source_interface_id: Source interface for syslog.
file_name, file_max_size, file_severity: File logging settings.
hosts: Remote syslog host configuration.
source_interfaces_vrf: VRF-specific source interfaces.
count: Enable message counting with timestamps.
persistent_url: Flash storage URL for persistent logs (e.g., bootflash:/logs).
persistent_size: Total disk space for persistent logging (bytes).
persistent_filesize: Individual log file size limit (bytes).
rate_limit_all: Global message rate limit (messages/second, 1-10000).

You can use these Logging parameters to control how system messages are recorded, filtered, and distributed. Customize severity levels, output destinations, and transport options to fit your network’s monitoring requirements, security policies, and compliance needs. Adjusting these parameters lets you tailor visibility into device operations and network behavior.

Guidelines and Limitations

Buffered Logging Parameter Version Compatibility

IOS-XE introduced changes to the YANG model for buffered logging configuration between versions 17.12.x and 17.15.x:

IOS-XE 17.15 and later: Use buffered_size and buffered_severity parameters.
IOS-XE 17.12.x and earlier: Use buffered_size_legacy and buffered_severity_legacy parameters.

Important: These parameter sets are mutually exclusive. Configure only the appropriate set based on your target IOS-XE version to ensure proper logging buffer configuration.

Persistent URL Filesystem Path Normalization

When configuring the persistent_url parameter for logging on IOS-XE 17.15 and later versions, be aware of the following platform behavior:

Important: IOS-XE 17.15+ automatically normalizes the flash: filesystem prefix to bootflash: in the persistent logging URL configuration. This normalization occurs at the device level and affects both routers and switches.

Recommendation: Always use bootflash: instead of flash: when specifying the persistent URL path on IOS-XE 17.15 and later versions to prevent configuration drift in Terraform.

Example:

Recommended: persistent_url: bootflash:/device_logs
Not Recommended: persistent_url: flash:/device_logs (will be normalized to bootflash:/device_logs)

Impact: If you configure flash: in your Terraform configuration while running IOS-XE 17.15+, the device will internally store it as bootflash:. This causes Terraform to detect a perpetual difference between the desired state (flash:) and actual state (bootflash:), resulting in idempotency issues where Terraform attempts to “correct” the configuration on every apply.

Note: This behavior does not occur on IOS-XE 17.12 and earlier versions, where the flash: prefix is preserved as configured.

Sample Configuration

The following configuration describes how to set up logging on a Cisco IOS-XE device, including monitor, buffered, console, file, and remote syslog host settings, severity levels, source interfaces, transport protocols, message counting, persistent logging to flash storage, and rate limiting.

logging monitor informational
logging buffered 16000
logging console warnings
logging facility local0
logging history size 100
logging history informational
logging trap informational
logging origin-id hostname
logging source-interface Loopback0
logging file device-logs.txt 1000000 debugging
logging count
logging persistent url bootflash:/device_logs size 500000 filesize 250000
logging rate-limit all 200
!
logging host 2001::1 transport udp port 514
logging host 2001::1 transport udp port 10000
logging host 2001::1 transport tcp port 10001
logging host 2001::1 transport tcp port 10003
logging host 2001::1 transport tls port 6514 profile TLS-PROFILE-1
logging host vrf MGMT 192.168.5.24
logging host vrf MGMT 192.168.5.24 transport udp port 514

Example YAML Code

The following YAML code defines logging configuration on an IOS-XE device, including monitor, buffered, console, history, and file logging settings, message counting, persistent flash storage configuration, rate limiting, along with remote syslog hosts configured with various transport options, VRF associations, and source interface settings.

iosxe:
  devices:
    - name: Device1
      configuration:
        logging:
          monitor_severity: informational
          buffered_size: 16000
          buffered_severity: informational
          console: true
          console_severity: warnings
          facility: local0
          history_size: 100
          history_severity: informational
          trap: true
          trap_severity: informational
          origin_id_type: hostname
          origin_id_name: CORE-SW-01
          source_interface_type: Loopback
          source_interface_id: "0"
          file_name: device-logs.txt
          file_max_size: 1000000
          file_severity: debugging
          count: true
          persistent_url: bootflash:/device_logs
          persistent_size: 500000
          persistent_filesize: 250000
          rate_limit_all: 200
          source_interfaces_vrf:
            - vrf: MGMT
              interface_type: Vlan
              interface_id: "100"
          hosts:
            - ip: 2001::1
              transport_udp_ports:
                - 514
                - 10000
              transport_tcp_ports:
                - 10001
                - 10003
              transport_tls_ports:
                - port: 6514
                  profile: TLS-PROFILE-1
            - ip: 192.168.5.24
              vrf: MGMT
              transport_udp_ports:
                - 514

Logging provides comprehensive event recording and monitoring capabilities that capture, categorize, and distribute system messages based on configurable severity levels from emergency to debugging. It supports multiple output destinations including console, buffer, file storage, and remote syslog servers with flexible transport options including UDP, TCP, and secure TLS connections. Logging configuration enables centralized log collection, real-time monitoring, forensic analysis, and compliance reporting by providing detailed visibility into device operations, security events, and network behavior patterns.