Logging

Logging configuration controls the system message logging behavior on NX-OS devices, enabling centralized collection and severity-based filtering of operational and diagnostic messages. It supports global log level settings, per-facility severity overrides, remote syslog servers, local logfile management, console and terminal monitor output, source interface selection, timestamp formatting, and origin ID tagging for multi-device environments. ACL logging (acllog match-log-level and the logging ip access-list cache), the IP and PoE daemon logging levels are configured under system.

Logging configuration controls the system message logging behavior on NX-OS devices, enabling centralized collection and severity-based filtering of operational and diagnostic messages. It supports global log level settings, per-facility severity overrides, remote syslog servers, local logfile management, console and terminal monitor output, source interface selection, timestamp formatting, and origin ID tagging for multi-device environments.

Diagram

Diagram

Classes

nxos

Name	Type	Constraint	Mandatory	Default Value
devices	List	devices	No
device_groups	List	device_groups	No
global	Class	global	No
templates	List	templates	No

devices (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

device_groups (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

global (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

templates (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

configuration (nxos.devices)

Name	Type	Constraint	Mandatory	Default Value
system	Class	system	No
logging	Class	logging	No

configuration (nxos.devices)

Name	Type	Constraint	Mandatory	Default Value
logging	Class	logging	No

system (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
acllog_match_log_level	Integer	min: 0, max: 7	No
logging_ip_access_list	Class	logging_ip_access_list	No
logging_level_ip	Choice	emergency, alert, critical, error, warning, notification, informational, debug	No
logging_level_poed	Integer	min: 0, max: 7	No

logging (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
level	Choice	emergencies, alerts, critical, errors, warnings, notifications, information, debugging	No
facilities	List	facilities	No
logfile_name	String		No
logfile_severity	Choice	emergencies, alerts, critical, errors, warnings, notifications, information, debugging	No
logfile_size	Integer	min: 4096, max: 4194304	No
logfile_persistent_threshold	Integer	min: 0, max: 99	No
source_interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	No
source_interface_id	Any	String or Integer[min: 0]	No
timestamp	Choice	microseconds, milliseconds, seconds	No
monitor	Boolean	true, false	No
monitor_severity	Choice	emergencies, alerts, critical, errors, warnings, notifications, information, debugging	No
console	Boolean	true, false	No
console_severity	Choice	emergencies, alerts, critical, errors, warnings, notifications, information, debugging	No
origin_id_type	Choice	hostname, ip, string	No
origin_id_value	String		No
rate_limit	Boolean	true, false	No
servers	List	servers	No

logging (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
level	Choice	emergencies, alerts, critical, errors, warnings, notifications, information, debugging	No
facilities	List	facilities	No
logfile_name	String		No
logfile_severity	Choice	emergencies, alerts, critical, errors, warnings, notifications, information, debugging	No
logfile_size	Integer	min: 4096, max: 4194304	No
logfile_persistent_threshold	Integer	min: 0, max: 99	No
source_interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	No
source_interface_id	Any	String or Integer[min: 0]	No
timestamp	Choice	microseconds, milliseconds, seconds	No
monitor	Boolean	true, false	No
monitor_severity	Choice	emergencies, alerts, critical, errors, warnings, notifications, information, debugging	No
console	Boolean	true, false	No
console_severity	Choice	emergencies, alerts, critical, errors, warnings, notifications, information, debugging	No
origin_id_type	Choice	hostname, ip, string	No
origin_id_value	String		No
servers	List	servers	No

logging_ip_access_list (nxos.devices.configuration.system)

Name	Type	Constraint	Mandatory	Default Value
cache_entries	Integer	min: 0, max: 1048576	No
cache_interval	Integer	min: 5, max: 86400	No
cache_threshold	Integer	min: 0, max: 1000000	No
detailed	Boolean	true, false	No
include_mac	Boolean	true, false	No
include_sgt	Boolean	true, false	No

facilities (nxos.devices.configuration.logging)

Name	Type	Constraint	Mandatory	Default Value
name	Any	Choice[spanning-tree, session-mgr, radius, security, plugin, cdp, bootvar, aaa, interface-vlan, vshd, cfs, monitor, ntp, acllog, track, pltfm-config, lacp, otm] or String	Yes
level	Choice	emergencies, alerts, critical, errors, warnings, notifications, information, debugging	No

facilities (nxos.devices.configuration.logging)

Name	Type	Constraint	Mandatory	Default Value
name	Choice	spanning-tree, session-mgr, radius, security, plugin, cdp, bootvar, aaa, interface-vlan, vshd, cfs, monitor, ntp, acllog, track, pltfm-config, lacp, otm	Yes
level	Choice	emergencies, alerts, critical, errors, warnings, notifications, information, debugging	No

servers (nxos.devices.configuration.logging)

Name	Type	Constraint	Mandatory	Default Value
host	String		Yes
severity	Choice	emergencies, alerts, critical, errors, warnings, notifications, information, debugging	No
port	Integer	min: 1, max: 65535	No
use_vrf	String		No
facility	Choice	kern, user, mail, daemon, auth, syslog, lpr, news, uucp, cron, authpriv, ftp, local0, local1, local2, local3, local4, local5, local6, local7	No
transport	Choice	udp, tcp, tls	No
trustpoint_client_identity	String		No

Examples

Example 1: Basic logging with global severity level

nxos:
  devices:
    - name: LEAF1
      configuration:
        logging:
          level: warnings

Example 2: Granular logging with per-facility severity overrides

nxos:
  devices:
    - name: LEAF1
      configuration:
        logging:
          level: notifications
          facilities:
            - name: aaa
              level: information
            - name: spanning-tree
              level: warnings
            - name: lacp
              level: information
            - name: ntp
              level: warnings

Example 3: Remote syslog servers with VRF and transport options

nxos:
  devices:
    - name: SPINE1
      configuration:
        logging:
          level: notifications
          source_interface_type: loopback
          source_interface_id: "0"
          timestamp: milliseconds
          servers:
            - host: 10.0.0.1
              severity: warnings
              port: 514
              use_vrf: management
              facility: local7
              transport: udp
            - host: 10.0.0.2
              severity: information
              port: 6514
              use_vrf: management
              transport: tls
              trustpoint_client_identity: syslog-cert

Example 4: Local logfile and console/monitor configuration

nxos:
  devices:
    - name: LEAF1
      configuration:
        logging:
          level: notifications
          logfile_name: messages
          logfile_severity: notifications
          logfile_size: 4194304
          logfile_persistent_threshold: 90
          console_severity: errors
          monitor_severity: warnings

Example 5: Disable console and monitor logging and syslog rate limiting (no logging rate-limit)

nxos:
  devices:
    - name: LEAF1
      configuration:
        logging:
          level: notifications
          console: false
          monitor: false
          rate_limit: false

Example 6: Comprehensive logging for production fabric switch

nxos:
  devices:
    - name: BORDER-LEAF1
      configuration:
        logging:
          level: notifications
          source_interface_type: loopback
          source_interface_id: "0"
          timestamp: milliseconds
          origin_id_type: hostname
          logfile_name: messages
          logfile_severity: notifications
          logfile_size: 4194304
          console_severity: errors
          monitor_severity: warnings
          facilities:
            - name: aaa
              level: information
            - name: security
              level: information
            - name: spanning-tree
              level: notifications
            - name: lacp
              level: information
          servers:
            - host: 10.1.100.10
              severity: warnings
              use_vrf: management
              facility: local7
            - host: 10.1.100.11
              severity: information
              use_vrf: management
              facility: local6
              transport: tcp

Example 7: ACL logging (acllog match-log-level, logging ip access-list ...) and IP logging level

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          acllog_match_log_level: 3
          logging_level_ip: warning
          logging_ip_access_list:
            detailed: true
            cache_interval: 600
            cache_entries: 4096
            include_mac: true
            include_sgt: false
            cache_threshold: 100

Example 8: PoE daemon logging level (feature poe, logging level poed <0-7>)

nxos:
  devices:
    - name: LEAF1
      configuration:
        feature:
          poe: true
        system:
          logging_level_poed: 3

Examples

Example 1: Basic logging with global severity level

nxos:
  devices:
    - name: LEAF1
      configuration:
        logging:
          level: warnings

Example 2: Granular logging with per-facility severity overrides

nxos:
  devices:
    - name: LEAF1
      configuration:
        logging:
          level: notifications
          facilities:
            - name: aaa
              level: information
            - name: spanning-tree
              level: warnings
            - name: lacp
              level: information
            - name: ntp
              level: warnings

Example 3: Remote syslog servers with VRF and transport options

nxos:
  devices:
    - name: SPINE1
      configuration:
        logging:
          level: notifications
          source_interface_type: loopback
          source_interface_id: "0"
          timestamp: milliseconds
          servers:
            - host: 10.0.0.1
              severity: warnings
              port: 514
              use_vrf: management
              facility: local7
              transport: udp
            - host: 10.0.0.2
              severity: information
              port: 6514
              use_vrf: management
              transport: tls
              trustpoint_client_identity: syslog-cert

Example 4: Local logfile and console/monitor configuration

nxos:
  devices:
    - name: LEAF1
      configuration:
        logging:
          level: notifications
          logfile_name: messages
          logfile_severity: notifications
          logfile_size: 4194304
          logfile_persistent_threshold: 90
          console_severity: errors
          monitor_severity: warnings

Example 5: Disable console and monitor logging

nxos:
  devices:
    - name: LEAF1
      configuration:
        logging:
          level: notifications
          console: false
          monitor: false

Example 6: Comprehensive logging for production fabric switch

nxos:
  devices:
    - name: BORDER-LEAF1
      configuration:
        logging:
          level: notifications
          source_interface_type: loopback
          source_interface_id: "0"
          timestamp: milliseconds
          origin_id_type: hostname
          logfile_name: messages
          logfile_severity: notifications
          logfile_size: 4194304
          console_severity: errors
          monitor_severity: warnings
          facilities:
            - name: aaa
              level: information
            - name: security
              level: information
            - name: spanning-tree
              level: notifications
            - name: lacp
              level: information
          servers:
            - host: 10.1.100.10
              severity: warnings
              use_vrf: management
              facility: local7
            - host: 10.1.100.11
              severity: information
              use_vrf: management
              facility: local6
              transport: tcp