Syslog severity level to 5 + ACL BLOCKED log

aclcisco-3750cisco-ios-12loggingsyslog

I am on a L3 switch C3750 IOS 12.2 and I want to log in the buffer (or just to the syslog server) all severity 5 messages and just the ACL Blocked level 6 messages.

Is there a way to do this ? I've found that we can set the severity of acl log messages in the acl entries, but it's on ASA, not on my platform, even with extended acl.

And I can't permit all 6 messages to be logged.

Thanks in advance,

Best Answer

The logging discriminator might be the feature you are looking for here. http://www.cisco.com/c/en/us/td/docs/ios/12_4t/12_4t11/htnmsylg.html#wp1056391

The format of such a discriminator is as follows : logging discriminator discr-name [[facility | mnemonics | msg-body {drops | includes} string] | severity {drops | includes} sev-num | rate-limit msglimit]

As an example , say the logged message for the ACL is of the kind

"*May 1 22:12:13.243: %SEC-6-IPACCESSLOGP: list ACL-IPv4-E0/0-IN permitted tcp 192.168.1.3(1024) -> 192.168.2.1(22), 1 packet"

Your discriminator would be :

logging discriminator BLOCKACL mnemonics includes %SEC-6-IPACCESSLOGP

Related Topic