What's changed: Initial version
4.3SNMP and Syslog
Covers the difference between SNMPv2c (community) and SNMPv3 (authentication and encryption) for monitoring and managing devices, the fire-and-forget trap versus the acknowledged inform, and the severity levels 0-7 (0 emergency to 7 debug) and facility of Syslog—learning to judge, from operational requirements, that a logging trap level captures "that value and everything more severe."
You cannot inspect dozens to hundreds of devices by hand, so in practice you collect status via SNMP and aggregate events onto one log server via Syslog for monitoring. CCNA tests the security difference between SNMP versions and the trap vs. inform distinction, plus the ordering of Syslog severity levels and the meaning of a logging level setting—not as rote memory but as operational judgment about "how far down the severity to send logs."
4.3.1SNMP versions and traps vs. informs
- SNMP is a monitoring protocol by which an NMS (manager) gets/sets a device agent's MIB (management information) and receives notifications from the device. v1/v2c authenticate only with a community string (effectively a plaintext password) and have no encryption, making them weak to eavesdropping. v3 adds authentication (auth) and encryption (priv) (with three levels: noAuthNoPriv/authNoPriv/authPriv), so v3 is recommended where confidentiality is needed.
- Devices notify the NMS of events in two ways: a trap is fire-and-forget and waits for no acknowledgment (lightweight, but not retransmitted if lost in transit). An inform waits for an ack from the NMS and retransmits if it does not arrive (more reliable but generates more traffic; v2c and later). Use inform for important notifications that must be delivered reliably, and trap when lightness matters.
4.3.2Syslog severity levels and facility
- Syslog records and sends device events with a severity. The severity level has eight steps where 0 is most severe and 7 is least: 0 Emergency / 1 Alert / 2 Critical / 3 Error / 4 Warning / 5 Notification / 6 Informational / 7 Debugging (mnemonic: Every Awesome Cisco Engineer Will Need Icecream Daily). Do not reverse the direction: a smaller number is more serious.
- When you set a level with
logging trap <level>(and similar), it captures that value and everything more severe (a smaller number). For example,logging trap 4(warnings) sends 0-4 (emergency through warning) and not 5-7;logging trap 7(debugging) sends every level, which is prone to information overload for everyday use. Destinations can be the console, VTY (monitor), the internal buffer (buffered), or an external Syslog server (logging host <IP>). - The message format is
%FACILITY-SEVERITY-MNEMONIC: description(e.g.,%LINK-3-UPDOWN). The facility classifies the feature or subsystem that emitted the message (LINK/OSPF/SYS, etc.), and the middle number is its severity level.
Most-tested: Syslog severity runs from 0 emergency (most severe) to 7 debugging (least), with a smaller number more serious; logging trap N captures 0-N; SNMP v2c uses a plaintext community while v3 adds authentication + encryption; and trap = no acknowledgment while inform = acknowledged (retransmitted). Practice choosing a level from the requirement: "want debug detail = level 7," "only serious faults = a lower level."
Suppose you are the operations designer for network monitoring, aggregating logs from all routers/switches onto one Syslog server. You first set the destination with logging host 10.10.1.20, but the next decision is down to which severity level to send to the server. Choosing logging trap 7 (debugging) sends every level—down to minute link-state changes and debug detail—so even in normal operation the Syslog server overflows with messages and the truly actionable serious events get buried. Conversely, if the requirement is "reliably capture faults and warnings first, and suppress the noise of informational/debug," then logging trap 4 (warnings) is appropriate: it sends 0 (emergency) through 4 (warning) and not 5-7. The key is not to misread "I specified level 4, so only level 4 is sent"—a Syslog level setting is a threshold that includes that value and everything more severe, so logging trap 4 covers all five of emergency/alert/critical/error/warning. If you later need to trace a specific feature's detailed behavior temporarily, raise it to logging trap 7 to capture debug for just that investigation, then return to the original level—raising and lowering the level per requirement is the practical judgment. Additionally, if Syslog timestamps are inconsistent, correlation is impossible, so synchronizing all devices with ntp server is a prerequisite.
| Level | Name | Meaning | Included when set as logging trap |
|---|---|---|---|
| 0 | Emergency | System unusable | Most severe; always included at any level setting |
| 1 | Alert | Immediate action needed | Included when set to level 1 or higher |
| 2 | Critical | Critical condition | Included at level 2+ |
| 3 | Error | Error condition | Included at level 3+ |
| 4 | Warning | Warning condition | Set to 4 = send 0-4 |
| 5 | Notification | Normal but notable event | Included at level 5+ |
| 6 | Informational | Informational message | Included at level 6+ |
| 7 | Debugging | Debug-level detail | Set to 7 = every level (most verbose) |
Trap: "In Syslog, a larger severity number means a more serious fault" is wrong—0 (Emergency) is most severe and 7 (Debugging) is least. Also wrong: "setting logging trap 4 sends only severity-4 messages"—a level setting is a threshold, so logging trap 4 sends all of 0-4 (emergency through warning). And wrong: "SNMP v2c is encrypted, so it is safe even in confidential environments"—v2c is plaintext via a community string; encryption comes with v3.
4.3.3Section summary
- SNMP v1/v2c use plaintext community authentication with no encryption; v3 adds authentication + encryption. Notifications: trap = unacknowledged / inform = acknowledged (retransmitted)
- Syslog severity runs 0 Emergency (most severe) to 7 Debugging (least); a smaller number is more serious (mnemonic: Every Awesome Cisco Engineer Will Need Icecream Daily)
logging trap Nis a threshold capturing 0-N (N=4 means 0-4). Raise or lower the level per requirement (debug detail = 7, only serious = lower)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. When aggregating all router/switch logs to a Syslog server, the requirement is "reliably collect fault and warning levels, but avoid sending the flood of informational and debug messages during normal operation." Which `logging trap` level is most appropriate?
Q2. You receive the Syslog message `%LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down`. Which statement about this message's severity is most appropriate?
Q3. On a financial institution's network, you want to reduce the risk of monitoring information being eavesdropped in transit, and to deliver important fault notifications to the monitoring server reliably without loss. Which SNMP configuration is most appropriate?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.