Which three statements about Syslog utilization are true? (Choose three.)
A. Utilizing Syslog improves network performance. B. The Syslog server automatically notifies the network administrator of network problems. C. A Syslog server provides the storage space necessary to store log files without using router disk space. D. There are more Syslog messages available within Cisco IOS than there are comparable SNMP trap messages. E. Enabling Syslog on a router automatically enables NTP for accurate time stamping. F. A Syslog server helps in aggregation of logs and alerts.
Correct Answers: C, D, F
Explanation:
The Syslog sender sends a small (less than 1KB) text message to the Syslog receiver. The Syslog receiver is commonly called “syslogd,” “Syslog daemon,” or “Syslog server.”
Syslog messages can be sent via UDP (port 514) and/or TCP (typically, port 5000). While there are some exceptions, such as SSL wrappers, this data is typically sent in clear text over the network. A Syslog server provides the storage space necessary to store log files without using router disk space.
In general, there are significantly more Syslog messages available within IOS as compared to SNMP Trap messages. For example, a Cisco Catalyst 6500 switch running Cisco IOS Software Release 12.2(18)SXF contains about 90 SNMP trap notification messages, but has more than 6000 Syslog event messages.
System logging is a method of collecting messages from devices to a server running a syslog daemon. Logging to a central syslog server helps in aggregation of logs and alerts.