GUIDE — 2026-09-13

Cisco IOS syslog to a server: complete setup

A Cisco switch keeps its log in RAM. show logging holds a few hundred lines, and a reload throws all of it away — including whatever happened in the minute before the reload, which is usually the part you wanted. Forwarding syslog to a machine you control keeps that history and makes it searchable.

Which machine receives the logs? SyslogWatch is the same application on macOS, Windows 10/11, Windows Server 2016 or newer, and 64-bit Linux, and it listens on the same port everywhere. Most people run it on a server; on a Linux server without a desktop it runs in headless mode, with the screen in your browser. Where a command below differs by platform, all three are given.

What this covers

Classic IOS (Catalyst 2960, 3560, 3750) and IOS-XE (Catalyst 9000, ISR 4000). The commands are the same on both. NX-OS differs and is not covered here.

Before you start — the receiver's address

The device needs somewhere to send to, and that address must not change:

Give that machine a static address or a DHCP reservation. If it moves, the device keeps sending to the old address and never tells you. Silence looks the same as "nothing happened".

Step 1 — Make the timestamps useful

Do this first. The default timestamp is uptime, not time of day, which makes correlating with anything else painful:

conf t
service timestamps log datetime msec localtime show-timezone
service timestamps debug datetime msec localtime show-timezone

If the switch has no NTP server, set one now — a log with the wrong time is worse than no log, because you will trust it:

ntp server 192.0.2.1
clock timezone SGT 8 0

Step 2 — Point it at the receiver

conf t
logging host 192.0.2.10 transport udp port 1514
logging trap informational
logging origin-id hostname
end
write memory

What each line does:

On older IOS the transport udp port keyword is not available and the device always sends to 514. Two ways out: run SyslogWatch on port 514 (it needs administrator rights to bind it, and only one program on the machine can have it), or redirect on the receiver — on Linux, sudo iptables -t nat -A PREROUTING -p udp --dport 514 -j REDIRECT --to-port 1514.

Step 3 — Choose a source interface

By default the switch sources syslog from whichever interface the route happens to use, so the address in your log changes when routing changes. Pin it:

conf t
logging source-interface Vlan10
end

Use the management VLAN or loopback — whatever you already use for SNMP and SSH, so one device is one address everywhere.

Open the port on the receiver

Most systems drop incoming UDP by default. SyslogWatch listens on 1514 rather than the privileged port 514, so it starts without administrator rights — but the firewall still has to let the traffic in.

Step 4 — Check it

On the switch:

show logging

The top of the output names the host and the port, and counts messages sent. If the count stays at zero, the switch is not even trying — the address or the source interface is wrong.

Then cause something harmless and watch for it. Shut and unshut an unused port:

conf t
interface GigabitEthernet1/0/24
shutdown
no shutdown
end

Two messages should arrive within a second or so: %LINK-3-UPDOWN and %LINEPROTO-5-UPDOWN.

If nothing arrives

Work out which side is at fault before changing anything on the device. Send a syslog line to the receiver from the receiver itself:

logger -n 127.0.0.1 -P 1514 -d -p local0.err "test from the receiver"

If that line appears in SyslogWatch, the application and the port are fine and the problem is on the device or in the path — a firewall rule, a wrong address, or a VLAN that cannot reach the receiver. If it does not appear, the problem is on the receiving machine.

To see whether packets are arriving at all:

What is worth alerting on

Once messages are arriving, most of them are noise. These are the ones that usually matter:

Two things that catch people

Console logging slows the switch. If the console is attached and busy, logging console makes the CPU wait on the serial port. Once syslog is going somewhere useful, turn it down: no logging console. Keep a local copy in RAM with logging buffered 64000 informational.

UDP syslog has no delivery guarantee. Nothing tells the switch a message was lost. If the receiver is down for an hour, that hour is gone. That is a property of syslog, not of any particular receiver — which is why it is worth having the receiver on something that stays up.

Getting SyslogWatch

Download SyslogWatch — free tier, no sign-up, no account, no card. macOS, Windows and Linux. Everything it receives is written to disk on that machine; nothing is sent anywhere else.