All MIBs › CISCO-SYSLOG-MIB
Organization: Cisco Systems, Inc.
Last Updated: 2005-12-03
Category: Alarm and Event Management, Cisco Devices, Device Management
Description:
Covers syslog message history, severity-based filtering, and remote syslog server destinations on Cisco devices.
Imported Objects
From CISCO-SMI
| ciscoMgmt | OBJECT-IDENTITY |
From INET-ADDRESS-MIB
| InetAddress | |
| InetAddressType |
From SNMP-FRAMEWORK-MIB
| SnmpAdminString |
From SNMPv2-CONF
| MODULE-COMPLIANCE | |
| NOTIFICATION-GROUP | |
| OBJECT-GROUP |
From SNMPv2-SMI
| Counter32 | |
| Integer32 | |
| MODULE-IDENTITY | |
| NOTIFICATION-TYPE | |
| OBJECT-TYPE | |
| Unsigned32 |
From SNMPv2-TC
| DisplayString | |
| RowStatus | |
| TEXTUAL-CONVENTION | |
| TimeStamp | |
| TruthValue |
What Is CISCO-SYSLOG-MIB?
CISCO-SYSLOG-MIB is a Cisco enterprise MIB that manages and exposes system log (syslog) message history, severity filtering, and notification behavior on Cisco IOS and other Cisco OS devices. It provides objects for configuring maximum logged severity, history table size, counts of ignored/dropped messages, and a history table of recent syslog entries with sequence indices. It is used to monitor software/system status indirectly by tracking log message volume and integrity — dropped/ignored message counts reveal if the device is overwhelmed and discarding log messages, and the history table lets an admin review recent system events, which often report hardware faults, interface flaps, or configuration changes, without needing external syslog infrastructure. It complements Cisco's standard notification/trap infrastructure for sending syslog-triggered SNMP traps. It is deployed across Cisco routers and switches in enterprise and service-provider networks for centralized event/fault visibility via SNMP. Engineers searching vendor documentation for cisco-syslog-mib object definitions will find clogHistoryTable and its associated severity/drop counters are the primary objects of interest for SNMP-based log monitoring.
IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-SYSLOG-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
What Can Be Monitored
- syslog history messages
- max severity threshold
- dropped/ignored message counts
- notifications sent count
- history table size and flush count
- origin ID configuration
Supported Devices
- Cisco Catalyst 9300 Series — current flagship stackable access switch running IOS-XE, still receiving active software support into 2026
Monitoring Examples
An admin polls clogHistoryTable/clogHistoryEntry (indexed by clogHistIndex) to review recent syslog messages captured by the device, and checks clogMsgDrops/clogMsgIgnores to detect if messages are being lost due to rate limiting. clogMaxSeverity controls which severities are forwarded via SNMP notifications, and clogNotificationsSent/clogNotificationsEnabled confirm whether syslog-triggered SNMP traps are actively being generated, useful for validating alerting pipelines.
OIDs
| OID symbolic | OID numeric | Type | Access | Description |
|---|---|---|---|---|
| ciscoSyslogMIB | 1.3.6.1.4.1.9.9.41 | The MIB module to describe and store the system messages generated by the IOS and any other OS which supports syslogs. | ||
| ciscoSyslogMIBObjects | 1.3.6.1.4.1.9.9.41.1 | |||
| clogBasic | 1.3.6.1.4.1.9.9.41.1.1 | |||
| C32 clogNotificationsSent | 1.3.6.1.4.1.9.9.41.1.1.1 | Counter32 | read-only | The number of clogMessageGenerated notifications that have been sent. This number may include notifications that were prevented from being transmitted due to reasons such as resource limitations and/or non-connectivity. If one is receiving notifications, one can periodically poll this object to determine if any notifications were missed. If so, a poll of the clogHistoryTable might be appropriate. |
| T/F clogNotificationsEnabled | 1.3.6.1.4.1.9.9.41.1.1.2 | TruthValue | read-write | Indicates whether clogMessageGenerated notifications will or will not be sent when a syslog message is generated by the device. Disabling notifications does not prevent syslog messages from being added to the clogHistoryTable. |
| SYS clogMaxSeverity | 1.3.6.1.4.1.9.9.41.1.1.3 | SyslogSeverity | read-write | Indicates which syslog severity levels will be processed. Any syslog message with a severity value greater than this value will be ignored by the agent. note: severity numeric values increase as their severity decreases, e.g. 'error' is more severe than 'debug'. |
| C32 clogMsgIgnores | 1.3.6.1.4.1.9.9.41.1.1.4 | Counter32 | read-only | The number of syslog messages which were ignored. A message will be ignored if it has a severity value greater than clogMaxSeverity. |
| C32 clogMsgDrops | 1.3.6.1.4.1.9.9.41.1.1.5 | Counter32 | read-only | The number of syslog messages which could not be processed due to lack of system resources. Most likely this will occur at the same time that syslog messages are generated to indicate this lack of resources. Increases in this object's value may serve as an indication that system resource levels should be examined via other mib objects. A message that is dropped will not appear in the history table and no notification will be sent for this message. |
| INT clogOriginIDType | 1.3.6.1.4.1.9.9.41.1.1.6 | INTEGER | read-write | This object identifies the type of value that will be contained in clogOriginID object. The possible value(s) are: 'none' : do not send origin identifier in syslog messages. 'other' : type that is not identified by other values specified in this object. 'hostName' : Send hostname of the system in syslog messages. 'ipv4Address': Send IP address of the sending interface. 'contextName': Send context name of the security device. 'userDefined': Send user configured string in syslog message. The value 'other' and 'none' can not be set but can only be read. |
| STR clogOriginID | 1.3.6.1.4.1.9.9.41.1.1.7 | SnmpAdminString | read-write | This object is used for configuring the origin identifier for the syslog messages. The origin identifier is useful for identifying the source of system logging messages in cases syslog messages from multiple devices are sent to a single syslog host. The origin identifier is added to the beginning of all system logging (syslog) messages sent to remote hosts. The type of the identifier is specified by clogOriginIDType object. This object can be written by the SNMP manager only when clogOriginIDType is set to 'userDefined'. For following value(s) of clogOriginIDType, this object can not be set; the value of this object is derived by the system in these cases: 'contextName' 'ipv4Address' 'hostName' 'other' 'none' This object contains the context name of the device, when clogOriginIDType is set to 'contextName'. This object contains IPv4 address (in dotted decimal notation) of the sending interface when clogOriginIDType is set to 'ipv4Address'. This object contains hostname of the system when clogOriginIDType is set to 'hostName'. This object will contain zero length octet string when clogOriginIDType is either 'none' or 'other'. |
| clogHistory | 1.3.6.1.4.1.9.9.41.1.2 | |||
| I32 clogHistTableMaxLength | 1.3.6.1.4.1.9.9.41.1.2.1 | Integer32 | read-write | The upper limit on the number of entries that the clogHistoryTable may contain. A value of 0 will prevent any history from being retained. When this table is full, the oldest entry will be deleted and a new one will be created. |
| C32 clogHistMsgsFlushed | 1.3.6.1.4.1.9.9.41.1.2.2 | Counter32 | read-only | The number of entries that have been removed from the clogHistoryTable in order to make room for new entries. This object can be utilized to determine whether your polling frequency on the history table is fast enough and/or the size of your history table is large enough such that you are not missing messages. |
| clogHistoryTable | 1.3.6.1.4.1.9.9.41.1.2.3 | not-accessible | A table of syslog messages generated by this device. All 'interesting' syslog messages (i.e. severity <= clogMaxSeverity) are entered into this table. | |
| clogHistoryEntry | 1.3.6.1.4.1.9.9.41.1.2.3.1 | not-accessible | A syslog message that was previously generated by this device. Each entry is indexed by a message index. | |
| I32 clogHistIndex | 1.3.6.1.4.1.9.9.41.1.2.3.1.1 | Integer32 | not-accessible | A monotonically increasing integer for the sole purpose of indexing messages. When it reaches the maximum value the agent flushes the table and wraps the value back to 1. |
| STR clogHistFacility | 1.3.6.1.4.1.9.9.41.1.2.3.1.2 | DisplayString | read-only | Name of the facility that generated this message. For example: 'SYS'. |
| SYS clogHistSeverity | 1.3.6.1.4.1.9.9.41.1.2.3.1.3 | SyslogSeverity | read-only | The severity of the message. |
| STR clogHistMsgName | 1.3.6.1.4.1.9.9.41.1.2.3.1.4 | DisplayString | read-only | A textual identification for the message type. A facility name in conjunction with a message name uniquely identifies a message type. |
| STR clogHistMsgText | 1.3.6.1.4.1.9.9.41.1.2.3.1.5 | DisplayString | read-only | The text of the message. If the text of the message exceeds 255 bytes, the message will be truncated to 254 bytes and a '*' character will be appended - indicating that the message has been truncated. |
| TIM clogHistTimestamp | 1.3.6.1.4.1.9.9.41.1.2.3.1.6 | TimeStamp | read-only | The value of sysUpTime when this message was generated. |
| clogServer | 1.3.6.1.4.1.9.9.41.1.3 | |||
| U32 clogMaxServers | 1.3.6.1.4.1.9.9.41.1.3.1 | Unsigned32 | read-only | The maximum number of syslog servers that can be configured for the system in clogServerConfigTable. A value of zero for this object indicates there is no specified limit for the system and is only dictated by system resources. |
| clogServerConfigTable | 1.3.6.1.4.1.9.9.41.1.3.2 | not-accessible | This table contains entries that allow application to configure syslog servers for the system. The maximum number of entries that can be created for this table is limited by the object clogMaxServers. | |
| clogServerConfigEntry | 1.3.6.1.4.1.9.9.41.1.3.2.1 | not-accessible | An entry containing information about syslog servers configured for the system. | |
| IPt clogServerAddrType | 1.3.6.1.4.1.9.9.41.1.3.2.1.1 | InetAddressType | not-accessible | The type of Internet address of this syslog server. |
| IP clogServerAddr | 1.3.6.1.4.1.9.9.41.1.3.2.1.2 | InetAddress | not-accessible | The Internet address of this syslog server. The type of this address is determined by the value of the clogServerAddrType object. |
| ROW clogServerStatus | 1.3.6.1.4.1.9.9.41.1.3.2.1.3 | RowStatus | read-create | The status object used to manage rows in this table. A row may only be created by setting this object to 'createAndGo'. A row may only be deleted by setting this object to 'destroy'. |
| ciscoSyslogMIBNotificationPrefix | 1.3.6.1.4.1.9.9.41.2 | |||
| ciscoSyslogMIBNotifications | 1.3.6.1.4.1.9.9.41.2.0 | |||
| NTF clogMessageGenerated | 1.3.6.1.4.1.9.9.41.2.0.1 | When a syslog message is generated by the device a clogMessageGenerated notification is sent. The sending of these notifications can be enabled/disabled via the clogNotificationsEnabled object. | ||
| ciscoSyslogMIBConformance | 1.3.6.1.4.1.9.9.41.3 | |||
| ciscoSyslogMIBCompliances | 1.3.6.1.4.1.9.9.41.3.1 | |||
| ciscoSyslogMIBCompliance | 1.3.6.1.4.1.9.9.41.3.1.1 | The compliance statement for entities which implement the Cisco syslog MIB. | ||
| ciscoSyslogMIBComplianceRev1 | 1.3.6.1.4.1.9.9.41.3.1.2 | The compliance statement for entities which implement the Cisco syslog MIB. | ||
| ciscoSyslogMIBGroups | 1.3.6.1.4.1.9.9.41.3.2 | |||
| ciscoSyslogMIBGroup | 1.3.6.1.4.1.9.9.41.3.2.1 | A collection of objects providing the syslog MIB capability. | ||
| clogNotificationsGroup | 1.3.6.1.4.1.9.9.41.3.2.2 | A collection of notification(s) for syslog feature. | ||
| clogServerGroup | 1.3.6.1.4.1.9.9.41.3.2.3 | A collection of objects providing syslog server information for the system. | ||
| clogOriginIDGroup | 1.3.6.1.4.1.9.9.41.3.2.4 | A collection of objects providing information on origin of syslog messages. |
RFC description
Manages syslog message history, severity filtering, and remote syslog server destinations on Cisco devices.
Start monitoring Cisco Catalyst 9300 series switch (syslog) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.