Syslog Severity Levels and Filtering Logic

200-301 By islever Editorial Last updated

Describe the use of syslog features including facilities and levels

Short answer

D Setting the syslog level to debug ensures that informational messages are captured because debug (level 7) includes all lower severity levels including informational (level 6).

Question

Which level of severity must be set to get informational syslogs?
  1. alert
  2. critical
  3. notice
  4. debug Correct Answer

Key Takeaways

Syslog levels are inclusive; a higher-level setting (like debug) captures all messages from lower-severity levels (like informational), whereas a lower-level setting (like notice) does not capture higher-numerical levels.

To capture informational syslogs, you must set the logging level to debug, as it is the only option that includes level 6 messages. This question tests knowledge of syslog severity hierarchies and inclusion logic.

Common mistake: Choosing 'notice' because it is the next level up from 'informational'. However, notice (level 5) strictly filters out informational (level 6) messages, making it incorrect.

Expert Analysis

The question asks for the severity level required to receive informational syslogs. Syslog severity levels range from 0 (Emergency) to 7 (Debug). The levels are: 0 Emergency, 1 Alert, 2 Critical, 3 Error, 4 Warning, 5 Notice, 6 Informational, and 7 Debug.

A key principle of syslog filtering is that a configured level includes all messages of that level and all lower numerical values (which represent higher severity). For example, setting the level to warning (4) captures warnings, errors, criticals, alerts, and emergencies.

Therefore, to see informational (6) messages, the configured level must be 6 or lower (numerically higher). Among the options:

  • A. alert (1): Only captures 0 and 1. Misses informational.
  • B. critical (2): Only captures 0, 1, 2. Misses informational.
  • C. notice (5): Captures 0-5. Misses informational (6).
  • D. debug (7): Captures 0-7. Includes informational (6).

Option D is the only choice that encompasses level 6. While 'notice' is closer to 'informational' in hierarchy, it strictly excludes it. 'Debug' is the only option broad enough to include the desired traffic.

Exam Strategy

Memorize the mnemonic for syslog levels (e.g., 'Emma Always Cries Even When Nobody Is Dying' for 0-5) and remember that 6 is Informational and 7 is Debug. When asked what level 'gets' a specific message type, choose the highest available option (lowest number) that is numerically greater than or equal to the target level's number. If the exact level isn't an option, choose the one that is broader (higher debug level).

Frequently Asked Questions

What is the numeric value for informational syslog?

Informational is level 6. The full scale is 0 (Emergency) to 7 (Debug).

Does setting syslog to warning include error messages?

Yes. Level 4 (Warning) includes all levels 0 through 4. It captures warnings, errors, criticals, alerts, and emergencies.

Why is debug not always the best practical choice?

While debug (7) captures everything, it generates excessive logs. In production, use the lowest level necessary to meet monitoring needs (e.g., notice or info) to reduce noise.

More 200-301 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 11 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 11

  1. hp2wx 👍 27
    Every good Cisco engineer will need intercourse daily :0
  2. Vinarino 👍 12
    Syslog uses the User Datagram Protocol (UDP), port 514 SEVERITY LEVEL ** SEVERITY IN EVENT = Default SMS setting for Syslog Security option. This setting will send all events to remote Syslog system 1 ALERT 2 CRITICAL 3 ERROR 4 WARNING 5 NOTICE 6 INFORMATIONAL (7 Debug [lower] will include ALL Informational messages) 7 DEBUG
  3. arenjenkins 👍 10
    fck this questiion
  4. redivivo 👍 9
    Emma Always Cries Even When Nobody Is Dying
  5. Liuka_92 👍 7
    0 EMERGENCY
Show 6 more comments
  1. ptfish 👍 3 Answered D
    The informational level is lower than the notice level. So only debug level can get those information. Answer D is correct.
  2. matass_md 👍 2 Answered D
    The level they are talking about is level6 informational but because we don't have that in our answers it can be only D . Debug- level 7.
  3. Vikramaditya_J 👍 2
    Small correction: Every awesome Cisco Engineer "Will" Need Icecream Daily (Level 0-7). Don't forget "Will" i.e., Warning. :-)
  4. DeeB0 👍 2
    Here's something to remember it by... Emergencies Are Critical Even When Nobody Is Dying Thank me by thanking yourselves
  5. Da_Costa 👍 2
    Every awesome Cisco engineer need icecream daily from 0-7
  6. maximus_007 👍 1 Answered D
    The other thing to remember here is that each higher level includes all lower levels so choosing debug would include information.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Causes of Late Collisions on Ethernet Interfaces

S-grade

Rapid PVST+ Port State That Neither Receives BPDUs nor Learns MAC

S-grade

Computing the EUI-64 Interface ID for a Given MAC Address

S-grade

Electing the Root Bridge in PVST+ by Priority and MAC

S-grade

Practice All 200-301 Questions

Access 220 questions with complete answers and detailed explanations.

View Full 200-301 Practice Test →

← Back to 200-301 Study Guide