Cisco "show logging" Command Explained
show logging — displays the device's local log buffer — system messages, errors, and events like interface changes or security violations. Runs in privileged EXEC mode.
Syntax and common variants
| Variant | Purpose |
|---|---|
show logging | View the buffered log messages |
show logging | include %LINK | Filter for specific message types |
clear logging | Clear the local log buffer |
Reading the output
| Output / element | Meaning |
|---|---|
%LINK-3-UPDOWN | An interface changed state (common, informational) |
%SEC-6-IPACCESSLOGP | An ACL logged matching traffic |
Severity levels 0-7 | Emergency through Debugging — see the logging trap level |
When to use it
The device's own memory of what happened — invaluable after an incident to see interface flaps, error messages or security events in sequence. Remember the buffer is limited and clears on reload, which is exactly why production networks also ship logs to an external syslog server. Browse more in the command reference or practise in the free labs.
Frequently asked questions
What is stored in show logging?
The device's local buffered log of system messages — interface changes, errors, security events and other notable occurrences, timestamped.
Why isn't this enough for serious troubleshooting?
The local buffer is limited in size and lost on reload — production networks need centralized logging (syslog) to retain and correlate history across devices.
How do I filter the log output?
Pipe with include or exclude — e.g. show logging | include %LINK to see only interface state changes.
Related articles
Want hands-on training?
Learn this on real Cisco lab devices with placement support at Attila Technologies, Ahmedabad.