Configuring Log Filters

Many event categories contain filters so you can further refine the type of information that the system logs. For example, when logging BGP connections, you can limit the information logged to a specific access class, peer, route map, or virtual router.

You define filters when you set the log severity for an event category. The online Help shows the options you can set for each filter.

Note: You can use the packet flow monitoring feature to create user-defined classification parameters that specify the packet data that is logged. See Packet Tagging Overview.

The following example creates a filter that logs BGP connection information at the debug severity level on traffic that matches access list ListOne, and is incoming traffic to virtual router default.

host1(config)# log severity debug bgpevents ? 
  access-class  Select an access list for the filter
  in            Select import/in direction for the filter
  out           Select export/out direction for the filter
  peer          Select a peer IP address for the filter
  route-map     Select a route map for the filter
  router        Identify an instance of a virtual router
  <cr> 
host1(config)# log severity debug bgpevents access-class ?
  WORD  The access list
host1(config)# log severity debug bgpevents access-class ListOne ?
  filtering-router  Identify virtual router where access-class/route-map are defined
  in                Select import/in direction for the filter
  out               Select export/out direction for the filter
  route-map         Select a route map for the filter
  <cr> 
host1(config)# log severity debug bgpevents access-class ListOne route-map ?
  WORD  The route map
host1(config)# log severity debug bgpevents access-class ListOne route-map default ?
  filtering-router  Identify virtual router where access-class/route-map are defined
  in                Select import/in direction for the filter
  out               Select export/out direction for the filter
  <cr>
host1(config)# log severity debug bgpevents access-class ListOne route-map default in

The next example limits the logging of PPP debug events to traffic to or from the POS interface in slot 2/0.

host1(config)#log severity debug ppp ?
  atm              Specify an ATM PPP interface
  fastEthernet     Specify a fastEthernet interface
  gigabitEthernet  Specify a gigabitEthernet interface
  mlppp            Specify an MLPPP network interface
  pos              Specify a POS PPP interface
  serial           Specify a serial PPP interface
  <cr> 
host1(config)#log severity debug ppp pos 2/0

To obtain a list of the filters available in each event category, see Event Categories.