- Logging to the Switch Console
- Logging to the Internal Buffer
- Logging to a Remote Syslog Server
- Adding Timestamps to Syslog Messages
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Adding Timestamps to Syslog Messages
If you are watching system messages appear in real-time, it’s obvious what time those events have occurred. However, if you need to review messages that have been collected and archived in the internal logging buffer or on a syslog server, message timestamps become really important.
By default, Catalyst switches add a simple uptime timestamp to logging messages. This is a cumulative counter that shows the hours, minutes, and seconds since the switch has been booted up. Suppose you find an important event in the logs and you want to know exactly when it occurred. With the uptime timestamp, you would have to backtrack and compute the time of the event based on how long the switch has been operating.
Even worse, as time goes on, the uptime timestamp becomes more coarse and difficult to interpret. In the following output, an interface went down 20 weeks and 2 days after the switch was booted. Someone made a configuration change 21 weeks and 3 days after the switch booted. At exactly what date and time did that occur? Who knows!
20w2d: %LINK-3-UPDOWN: Interface FastEthernet1/0/27, changed state to down 21w3d: %SYS-5-CONFIG_I: Configured from console by vty0 (172.25.15.246)
Instead, you can configure the switch to add accurate clock-like timestamps that are easily interpreted. As well, sometimes you will need to correlate events in the logs of several network devices. In that case, it’s important to synchronize the clocks (and timestamps) across all of those devices.
Don’t assume that a switch already has its internal clock set to the correct date and time. You can use the show clock command to find out, as in the following example:
Switch#show clock *00:54:09.691 UTC Mon Mar 1 1993 Switch#
Here, the clock has been set to its default value, and it’s March 1, 1993! Clearly, that isn’t useful at all.
You can use the following commands as a guideline to define the timezone, summer (daylight savings) time, and set the clock:
Switch(config)# clock timezone name offset-hours [offset-minutes] Switch(config)# clock summer-time name date start-month date year hh:mm end-month day year hh:mm [offset-minutes] –OR- Switch(config)# clock summer-time name recurring [start-week day month hh:mm end-week day month hh:mm [offset-minutes] Switch(config)# exit Switch# clock set hh:mm:ss
In the following example, the switch is configured for the Eastern time zone in the U.S., and the clock is set for 3:23pm. If no other parameters are given with the clock summer-time recurring command, U.S. Daylight Savings Time is assumed.
Switch(config)# clock timezone EST -5 Switch(config)# clock summer-time EDT recurring Switch(config)# exit Switch# clock set 15:23:00
To synchronize the clocks across multiple switches in your network from common trusted time sources, you should use the Network Time Protocol (NTP). As a simple example, the following commands are used to enable NTP and use the NTP server at 192.43.244.18 (time.nist.gov) as an authoritative source.
Switch(config)# ntp server 192.43.244.18
Once NTP is configured and enabled, you can use the show ntp status command to verify that the switch clock is synchronized to the NTP server.
Finally, you can use the following command to begin using the switch clock as an accurate timestamp for syslog messages:
Switch(config)# service timestamps log datetime [localtime] [show-timezone] [msec] [year]
Use the localtime keyword to use the local time zone configured on the switch; otherwise, UTC is assumed. Add the show-timezone keyword if you want the time zone name added to the timestamps. Use the msec keyword to add milliseconds and the year keyword to add the year to the timestamps.
In the following example, the local time zone and milliseconds have been added into the timestamps of the logging messages shown:
Switch(config)# service timestamps log datetime localtime show-timezone msec Switch(config)# exit Switch# show logging *May 2 02:39:23.871 EDT: %DIAG-SP-6-DIAG_OK: Module 1: Passed Online Diagnostics *May 2 02:39:27.827 EDT: %HSRP-5-STATECHANGE: Vlan62 Grp 1 state Standby -> Active *May 2 02:41:40.431 EDT: %OIR-SP-6-INSCARD: Card inserted in slot 9, interfaces are now online *May 3 08:24:13.944 EDT: %IP-4-DUPADDR: Duplicate address 10.1.2.1 on Vlan5, sourced by 0025.64eb.216f *May 13 09:55:57.139 EDT: %SYS-5-CONFIG_I: Configured from console by herring on vty0 (10.1.1.7)