Send syslog to a server, decode each message and fix the severity level

Steps

1. Drag each device from the Topology onto the workspace and set its display name (click the device, Config tab, Display Name) to the name in the Devices table. Cable the ports the Links table lists: Packet Tracer's automatic connection type picks the right cable, or use a copper cross-over between two routers or between a router and a PC or server. If a router asks whether to enter the initial configuration dialog, answer no.
2. Address R1 and R2, leaving R2's interface shut for now. Give Server1 its address and gateway (Desktop > IP Configuration). On Server1's Services tab, open SYSLOG and turn it On, then open NTP and turn it On.

Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# interface g0/0/0
R1(config-if)# ip address 10.0.12.1 255.255.255.252
R1(config-if)# no shutdown
R1(config-if)# interface g0/0/1
R1(config-if)# ip address 192.168.50.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# end

Router> enable
Router# configure terminal
Router(config)# hostname R2
R2(config)# interface g0/0/0
R2(config-if)# ip address 10.0.12.2 255.255.255.252
R2(config-if)# end

3. Make your first messages and take them apart. Bring R2's interface up and watch R1's console:

R2# configure terminal
R2(config)# interface g0/0/0
R2(config-if)# no shutdown
R2(config-if)# end

R1 prints a %LINK-3-UPDOWN message and a %LINEPROTO-5-UPDOWN message for GigabitEthernet0/0/0. For each, write down the facility (the field after the %), the severity number and its keyword, and the mnemonic. LINK at 3 is errors; LINEPROTO at 5 is notifications. Leaving configuration mode also logs %SYS-5-CONFIG_I: facility SYS, severity 5, a configuration change. 4. Check the clock before trusting any timestamp:

R1# show clock

The time starts with *: the clock is not authoritative, because nothing has synchronised it. 5. Synchronise R1 to Server1 with NTP, then check again. Use Fast Forward Time if it takes a while:

R1# configure terminal
R1(config)# ntp server 192.168.50.50
R1(config)# end
R1# show ntp status
R1# show clock

show ntp status reads Clock is synchronized, and show clock no longer starts with *. 6. Set the timestamp format and the syslog destination. The starting policy sends only warnings and worse to the server:

R1# configure terminal
R1(config)# service timestamps log datetime msec
R1(config)# logging host 192.168.50.50
R1(config)# logging trap warnings
R1(config)# end

NTP set the accuracy; service timestamps log datetime msec sets the format. Each does nothing for the other. 7. Predict, then test. Using the inclusive rule, warnings (4) sends levels 0 to 4. Of the link-down pair you are about to cause, which reaches Server1? Fail the link from R2's end:

R2# configure terminal
R2(config)# interface g0/0/0
R2(config-if)# shutdown
R2(config-if)# end

R1's console shows both messages, with a date and time now. On Server1, Services > SYSLOG lists the %LINK-3-UPDOWN message and not the %LINEPROTO-5-UPDOWN one, and none of the %SYS-5-CONFIG_I messages. 8. Break and fix: the operations team says the server never shows configuration changes or line-protocol changes. That is the planted fault: the level is too severe for what they need. Lower it to notifications (5), which sends 0 to 5:

R1# configure terminal
R1(config)# logging trap notifications
R1(config)# end

Changing logging console would not have helped: each destination has its own level, and logging trap is the one for servers. Now bring R2's link back up:

R2# configure terminal
R2(config)# interface g0/0/0
R2(config-if)# no shutdown
R2(config-if)# end

Server1 now receives both the %LINK-3-UPDOWN and the %LINEPROTO-5-UPDOWN message for the link coming up, and R1's own %SYS-5-CONFIG_I from the change you just made. 9. Read the router's own summary of where messages go:

R1# show logging

Find the console level, and the trap level with the server it logs to. Debug output (7) and informational messages (6) still reach the console, but not the server.