The logging Commands

At least a dozen logging commands exist and some have various options. This section looks at the main commands, but a search of the Cisco web site for PIX Firewall logging and looking for the latest command reference will include any others.

The logging on Command

The Configuration Mode logging on command enables or disables sending informational messages to the console, to a Syslog server, or to a SNMP management station. Use the no form of the command to turn off the feature. The syntax is

pix(config)#logging onpix(config)#no logging on

The logging host Command

Use the logging host command to specify a Syslog server that will receive the messages sent from the PIX Firewall. Multiple logging host commands can be used to specify additional servers that would each receive the Syslog messages. Each server can only be specified to receive either UDP or TCP, but not both. PIX Firewall only sends TCP Syslog messages to the PIX Firewall Syslog Server (PFSS). Use the no form of the command to turn off the feature. The syntax is

pix(config)#logging host [in_if_name] ip_address [protocol/port]
pix(config)#no logging host [in_if_name] ip_address

For normal Syslog operations to any Syslog server (non-PFSS) on the network, use the default message protocol—UDP—as shown in the following example:

pix(config)#logging host dmz1 192.168.1.5

The logging trap Command

Set the Syslog message level with the logging trap command. The level specified includes all levels up to that level. If Level 3 is specified, Syslog displays 0, 1, 2, and 3 messages. Possible number and string level values are as follows:

Severity Level	Message Type	Description and Examples
0	emergencies	System unusable messages.
1	alerts	Take immediate action. Hardware and failover errors.
2	critical	Critical condition. Connection attempts.
3	errors	Error message. No free IP addresses.
4	warnings	Warning message. PPP errors.
5	notifications	Normal but significant condition. URL/Java blocked.
6	informational	Information message. Authentication denied.
7	debugging	Debug messages and log FTP commands and WWW URLs.

Use the no form of the command to turn off the feature. The syntax is

pix(config)#logging trap level
pix(config)#no logging trap level

An example of setting the logging level with the logging trap command is shown in the next line.

pix(config)#logging trap debugging

The logging history Command

Set the SNMP message level with the logging history command. Use the no form of the command to turn off the feature. The syntax is

pix(config)#logging history level
pix(config)#no logging history level

An example of setting the SNMP message level with the logging history command is shown in the next line:

pix(config)#logging history notifications

The logging queue Command

Use the logging queue command to define the size of the Syslog message queue for the messages waiting to be processed. When traffic or congestion gets heavy, messages might be discarded.

pix(config)#logging queue queue_size

queue queue_size

Sets the size of the queue for storing Syslog messages. The queue size defaults to 512 messages. Setting it to 0 (zero) specifies unlimited space (subject to available block memory). The minimum is one message. Use this parameter before the Syslog messages are processed.

The following partial configuration shows some of the logging commands used together and demonstrates a few of the commands not addressed earlier.

pix(config)#logging on 
pix(config)#logging timestamp     Time stamp system messages
pix(config)#no logging standby     Failover device isn't logging
pix(config)#no logging console     Turns off messages to PIX console
pix(config)#no logging monitor     Turns off Telnet session messages 
pix(config)#logging buffered errors  Sets message level sent to buffer
pix(config)#logging trap notifications Sets message level sent to syslog
pix(config)#no logging history 
pix(config)#logging queue 2048     Sets queue size to 2048 messages
pix(config)#logging host inside 192.168.1.220  syslog server address

The logging Commands