Cisco Catalyst 2000 Configuration Handbook page 216

When the syslog server receives a message, it forwards the message to a log file
or destination based on the originating system facility. In this fashion, syslog
servers can collect and organize messages by using the facility as service area or
type. All syslog messages from switches can be collected together if the facility
is set identically in each switch.
Syslog servers are based around UNIX operating system concepts and have
facility types that are named after various system services. The facility used in
switch syslog messages is defined as facility-type, given as one of local0, local1,
local2, local3, local4, local5, local6, local7 (the default), which all represent
locally defined services. Usually, one or more local facilities are used for mes-
sages from network devices.
The Supervisor IOS also allows these additional facility types: auth (user authen-
tication services), cron (job scheduling services), daemon (system background or
daemon services), kern (system kernel services), lpr (line printer spooler services),
mail (system mail services), news (Usenet newsgroup services), syslog (syslog
services), sys9, sys10, sys11, sys12, sys13, sys14 (all reserved for system servic-
es), user (system user processes), or uucp (UNIX-to-UNIX copy file transfer
services).
c. Limit the severity of the logged messages:
(global) logging trap level
System messages are assigned a severity level based on the type and importance
of the error condition. Only messages that are less than or equal to (at least as
severe as) the severity level are sent to the syslog server. Table 12-1 defines the
level, which is a number (0 to 7, default 6).
Table 12-1 Message Logging Level Keywords
Level Keyword Level
emergencies 0
alerts 1
critical 2
errors 3
warnings 4
notifications 5
informational 6
debugging 7
Description
System unstable
Immediate action needed
Critical conditions
Error conditions
Warning conditions
Normal but significant condition
Informational messages only
Debugging messages
Chapter 12: Switch Management 195
Syslog Definition
LOG_EMERG
LOG_ALERT
LOG_CRIT
LOG_ERR
LOG_WARNING
LOG_NOTICE
LOG_INFO
LOG_DEBUG