Cisco Ios Configuration

LogZilla documentation for Cisco Ios Configuration

Cisco IOS configuration

Minimal, safe Cisco IOS/IOS-XE configuration for sending syslog to LogZilla.

For default listener ports and how to change them, see Network Communications. For an overview of syslog formats and transports, see Syslog Basics. For troubleshooting, see Syslog Troubleshooting.

Event timestamping in LogZilla

For syslog inputs, LogZilla stores the event time as the server receive time. The syslog-ng ingestion template sets the timestamp, which avoids issues from devices with incorrect clocks.

Minimal IOS configuration

text
service timestamps log datetime localtime show-timezone
service timestamps debug datetime localtime show-timezone
logging source-interface Loopback0
logging buffered 65536
logging trap informational
logging host <LOGZILLA_IP>
ntp server <NTP_IP_1>
ntp server <NTP_IP_2>

Timestamps

  • Use service timestamps log datetime localtime show-timezone and service timestamps debug datetime localtime show-timezone to include date/time and a timezone label in messages.
  • Avoid uptime timestamping; include actual date/time for auditability.

Logging

  • logging source-interface <IFACE> ensures a stable source IP/hostname (use a Loopback or management interface) so events attribute consistently.
  • logging buffered 65536 configures a local buffer. This does not affect sending to remote receivers.
  • logging host <LOGZILLA_IP> sets the receiver. Devices commonly support multiple destinations; configure conservatively.
  • logging trap informational (severity 0-6) is recommended for normal operation. Use 0-7 only for device-local troubleshooting.
Cisco Ios Configuration | LogZilla Documentation