System Logs

Logging to a remote server

The Cisco Nexus 3550-H Hydra (formerly ExaLINK Hydra) supports remote logging using the syslog protocol. To configure remote logging, use the logging command. The first step is to configure a remote target for log messages. Both TCP and UDP modes of syslog are supported. As an example, to log all error messages using UDP to a host at, use the command:

admin@EXALINK-HYDRA# configure logging host protocol udp
Enabled remote logging to using UDP

To remove all remote logging targets use the no form of the logging command:

admin@EXALINK-HYDRA# configure no logging host protocol udp
Disabled remote logging to using UDP

To change the global remote logging level, users may configure the trap

admin@EXALINK-HYDRA# configure logging trap error
Set remote logging level to 3 (error)

Audit logs

When remote logging is configured, the Nexus 3550-H will also send an audit log of configuration changes to the remote syslog server.

Configuration change logging is done at the API layer. Because commands on the command line are internally implemented using the API, this captures all configuration changes from the command line as well as from the API.

Example configuration change message:

Oct  1 11:27:26 EXALINK-HYDRA AUDIT: { "username": "admin", "method": "set_interface_enable", "params": { "interface": "ethernet1\/1", "enable": true }, "result": true }

Each message contains the details of an API command encoded in JSON format with the following fields:

Field Description
username User that made the change
method Name of API command
params API parameters
result Result of API command
error Error code and message

The error field will not be present if the API command was successful. Similarly, the result field will not be present if the API command failed.

Please see the API documentation for details of the API commands.

Viewing system logs locally

From bash users may view local logs via the standard Unix utility journalctl.

admin@EXALINK-HYDRA# bash
admin@EXALINK-HYDRA~$ journalctl
-- Logs begin at Mon 2019-05-06 23:16:58 UTC, end at Tue 2019-05-07 03:31:29 UTC. --
May 06 23:16:58 localhost kernel: Linux version 4.9.0-9-amd64 ( (gcc version 6.3.0 20170516 (Debian 6.3.0-18+deb9u1) ) #1 SMP Debian 4.9.168-1 (2019-04-12)


Audit log messages cannot be viewed using journalctl. Only system log messages are available.

This page was last updated on Feb-18-2021.