Content

| 7.2 |  | Gathering Information on Application Layer Problems |
| 7.2.7 |  | Deciphering syslog messages |

All messages begin with a percent sign, and are displayed in the following format:

> %FACILITY-SEVERITY-MNEMONIC: Message-text

FACILITY is a code, consisting of two to five uppercase letters, indicating the facility to which the message refers. A facility may be a hardware device, a protocol, or a module of the system software. The IOS has over 500 service identifiers.

SEVERITY is a single-digit code from 0 to 7 that reflects the severity of the condition. The lower the number, the more serious the situation. MNEMONIC is a code, consisting of uppercase letters that uniquely identify the message.

Message-text is a text string describing the condition. This portion of the message sometimes contains detailed information about the event being reported, including terminal port numbers, network addresses, or addresses that correspond to locations in the system memory address space. Because the information in these variable fields changes from message to message (see below), it is represented here by short strings enclosed in square brackets ([ ]). For example, a decimal number is represented as [dec].

Some example error messages could be as follows:

> Error message: %HELLO-2-NORDB: Redistributed IGRP without rdb

In this message, HELLO is the facility, 2 is the severity, and NORDB is the MNEMONIC. This message indicates that an internal software error has occurred and technical support should be contacted for assistance.

> Error message: %IP-4-DUPADDR Duplicate address [inet] on [chars], sourced by [enet]

This error message indicates that another system on the network segment is using this IP address and that the IP address on one of the two systems should be changed.

If one or more error messages reoccur after the recommended action has been taken, contact Cisco or a local field service organization.