Cisco

Overview

Cisco IOS (Internetwork Operating System) is the operating system used on most Cisco routers and switches. IOS devices generate syslog messages for routing protocol events, interface state changes, configuration modifications, hardware alerts, and security violations. The base Cisco parser handles all IOS-based products including routers, switches, and wireless controllers.

App Function

• Parse Cisco IOS syslog messages and extract the cisco_mnemonic field
• Remove embedded timestamps to enable proper event deduplication
• Extract network metadata (IP addresses, interfaces, VLANs, users)
• Categorize events by Event Class for cross-vendor analysis
• Provide triggers for high-impact network and system events

Vendor Documentation

• Cisco IOS and NX-OS Software

Device Configuration

Configure the Cisco device to send syslog messages to LogZilla:

1. Access the device CLI via SSH or console

2. Enter configuration mode:

   text
   Wrap: OnCopyFullscreen
   configure terminal
   

3. Configure the syslog destination:

   text
   Wrap: OnCopyFullscreen
   logging host <logzilla-ip>
   logging trap informational
   service timestamps log datetime msec
   

4. Save the configuration:

   text
   Wrap: OnCopyFullscreen
   write memory
   

Verification

Generate a configuration change or wait for a routing event, then verify events appear in LogZilla by selecting the User Tags menu for Vendor -> Cisco.

Incoming Log Format

Cisco IOS syslog messages follow this format:

text
Wrap: OnCopyFullscreen
<timestamp>: %<facility>-<severity>-<mnemonic>: <message>

• timestamp - Date and time of the event
• facility - Cisco subsystem generating the message (e.g., LINK, BGP, OSPF)
• severity - Numeric severity level (0-7)
• mnemonic - Event identifier (e.g., UPDOWN, ADJCHANGE)
• message - Event description with variable data

Parsed Metadata Fields

Log Examples

BGP Neighbor Down

text
Wrap: OnCopyFullscreen
%BGP-5-ADJCHANGE: neighbor 10.0.0.1 Down BGP Notification sent

Interface State Change

text
Wrap: OnCopyFullscreen
%LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down

Configuration Change

text
Wrap: OnCopyFullscreen
%PARSER-5-CFGLOG_LOGGEDCMD: User:admin logged command:interface vlan 100

OSPF Adjacency

text
Wrap: OnCopyFullscreen
%OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.2 on Vlan100 from FULL to DOWN

Port Security Violation

text
Wrap: OnCopyFullscreen
%PORT_SECURITY-2-PSECURE_VIOLATION: Security violation on port Gi0/1

Triggers

Routing Protocols

High Availability

Interface/Link

Spanning Tree

Security

VPN/Crypto

Hardware

System