System Event Logging Guidelines

Consider the following guidelines when configuring system logging on the switch:

• Buffer SizeConfigure the number of messages stored in the buffer using the logging buffered size command. By default, EOS retains a large, but volatile, buffer and discards messages upon reboot unless you configure persistent logging.
• Severity - When you specify a severity level, EOS only processes messages with that severity and higher. When filtering with a severity level, EOS only displays messages with that severity and lower.
• Real-time Output - To view messages as they occur during your terminal session, enable terminal monitoring with the command, terminal monitor.

Severity Thresholds

Logging Locations

Buffer Logging

Use logging buffered to retain logs in the buffer space on the switch. Set the syslog level as well as the buffer size. Arista Networks recommends a larger buffer size to retain messages for a week or longer.

Displays system notifications directly on the switch console or terminal session to provide real-time visibility into the health and operational status of the switch as events occur.

Persistent Logging

Enable persistent logging to write system logs to non-volatile flash and retain them after a switch reloads. However, utilizing persistent logging may fill up the flash when lots of log events occur on the switch.

To enable persistent logging with a maximum buffer size of 10,000 bytes, use the following command:

switch(config)# logging persistent 10000

Synchronous Logging

Synchronous logging ensures logging messages appear on the console but do not interrupt CLI output from command output. The log messages display after the CLI completes the command output.

The logging synchronous has the following format:

switch(config)# logging synchronous [ level severity | all]

level severity specify log messages of a lower severity level to log synchronously and specifies all log messages to log synchronously

Trap Logging

Enable trap logging to send log messages to a remote server. Specifying a severity level logs only log messages with a severity at or above that level to the remote server. To add a remote server IPv4 address, 192.168.96.147, use the following commands:

switch(config)# logging host 192.168.96.147
switch(config)#

To add a fully qualified domain name (FQDN), mycompany.com, as the remote server, use the following command:

switch(config)# logging host mycompany.com

Use the following command to enable trap logging with severity 6:

switch(config)# logging trap system 4

Enabling System Logging

Use the following command to enable system logging on the switch:

switch(config)# logging on
switch(config)#

The no | defaultversion of the command disables system logging on the switch and removes the configuration from the running-config.

Configuring the Source Interface

After enabling a remote server to receive log messages, specify a local interface to derive the source IP address using the following syntax:

logging vrf vrf_name local-interface interface

Displaying System Logging Information

To display information about the system logging configuration, use the show logging command:

switch# show logging
Syslog logging: enabled
Buffer logging: level notifications
Console logging: level debugging
Persistent logging: level debugging
Monitor logging: level debugging
Synchronous logging: disabled
Trap logging: level informational
    Logging to '192.168.93.147' port 6514 in VRF default via udp
    Logging to '192.168.96.147' port 514 in VRF default via udp
    Logging to '192.168.96.147' port 6514 in VRF default via udp
    Logging to '192.168.96.147' port 514 in VRF purple via udp
Sequence numbers: disabled
Syslog facility: local4
Hostname format: Hostname only
Repeat logging interval: disabled
Repeat messages: disabled
Root login logging: disabled

External configuration:
    active: 
    inactive: 

Facility                   Severity            Effective Severity
--------------------       -------------       ------------------
aaa                        debugging           debugging    
accounting                 debugging           debugging    
acl                        debugging           debugging    
agent                      debugging           debugging    
ale                        debugging           debugging    
arp                        debugging           debugging    
bfd                        debugging           debugging    
bgp                        debugging           debugging
<------>
vrf                        debugging           debugging    
vrrp                       debugging           debugging    
vxlan                      debugging           debugging    
ztp                        debugging           debugging

The output displays the level of logging for each type of logging location and the configuration on the switch. Each feature displays the severity and effective severity of the log messages.