Logging to a Remote Syslog Server
Syslog servers provide the most robust method of logging message collection. Messages are sent from a switch to a syslog server over the network using UDP port 514. This means that a syslog server can be located anywhere, as long as it is reachable by the switch. A syslog server can collect logs from many different devices simultaneously, and can archive the logging information for a long period of time.
To identify a syslog server and begin sending logging messages to it, you can use the following commands:
Switch(config)# logging host Switch(config)# logging trap severity
The syslog server is located at hostname or IP address host. You can enter the logging host command more than once if you have more than one syslog server collecting logging information. The syslog server severity level can be either a severity level keyword, such as informational, or the corresponding numeric value (0 to 7).