Syslog Severity Levels Explained: 0 to 7 for the Network+ Exam

Syslog assigns every message a severity level from 0 to 7. The numbering is the part people get wrong, and it is the part exams test.

Lower numbers are more severe. 0 is an emergency; 7 is debug chatter. It runs backwards from how most people expect a severity scale to work.

The Eight Levels

Level	Keyword	Meaning
0	Emergency	The system is unusable. Total failure.
1	Alert	Action must be taken immediately. A critical subsystem has failed.
2	Critical	Critical conditions — a hardware fault, a failing disk.
3	Error	Error conditions. Something failed but the system continues.
4	Warning	Something may become a problem — a threshold approaching, a deprecated call.
5	Notice	Normal but significant. A configuration change, a service restart.
6	Informational	Routine operational messages.
7	Debug	Verbose diagnostic detail, for troubleshooting only.

Remembering the Order

The classic mnemonic reads down the list from 0 to 7: Every Awesome Cisco Engineer Will Need Ice Cream — Emergency, Alert, Critical, Error, Warning, Notice, Informational, Debug. The final C stands for "cream" and maps to Debug, which is imperfect but it is the version most people learn.

The conceptual anchor is more reliable than any mnemonic: 0 is the worst thing that can happen, and the numbers climb as things get less urgent. If you remember only that, you can reason out the rest.

How Filtering Works

This is the practical consequence, and it catches people out. When you configure a device to log at a given level, you get that level and everything more severe — meaning every lower number.

So logging trap 4 on a Cisco device sends levels 0 through 4: emergency, alert, critical, error and warning. It does not send notice, informational or debug.

The common production setting is level 4 or 5 — enough to see real problems without drowning in routine messages.

A Genuine Warning About Debug

Setting a production device to level 7 is a recognized way to cause an outage. Debug logging on a busy router or firewall can generate enough messages to saturate the CPU and the log destination, and the device stops forwarding traffic properly while it writes about forwarding traffic.

Debug is a short, deliberate, supervised diagnostic step, turned off immediately afterwards. This appears in exam scenarios and it is true in practice.

Facilities

Alongside severity, syslog messages carry a facility code indicating which subsystem produced them — 0 for kernel, 1 for user-level, 2 for mail, 3 for system daemons, 4 and 10 for security and authorization, and 16 through 23 as local0 through local7 for locally defined use.

The local facilities matter practically: network devices are commonly configured to send to a specific local facility so the syslog server can route their messages into their own file, separate from the host's own logs.

Severity and facility together are encoded into a single priority value as facility × 8 + severity, which appears at the start of the message in angle brackets. Worth recognizing if you see it in packet output.

The Protocol Itself

• UDP port 514 is the traditional transport. It is connectionless, so messages can be lost silently under congestion — an important limitation.
• TCP port 514 offers reliable delivery.
• TLS on port 6514 encrypts syslog in transit, which matters because plain syslog is cleartext and logs often contain sensitive detail.
• RFC 5424 is the modern standard, replacing the older RFC 3164 BSD format, and adds structured data and proper timestamps.

Two security points that follow. Plain UDP syslog can be spoofed — anyone can send a forged message to a syslog server, so log integrity is not guaranteed without authenticated transport. And centralized logging exists partly so that an attacker who compromises a host cannot erase the evidence, because the logs already left the machine.

Network+ (N10-009) Exam Tips

• Memorize the eight levels in order. Direct recall is likely.
• Lower number equals higher severity. The single most tested fact.
• Configuring a level includes all levels below it numerically.
• UDP 514 by default, with TCP and TLS 6514 as alternatives.
• UDP means messages can be lost, which is a real limitation to state.
• Centralized logging aids correlation and protects evidence from tampering.
• Know the neighbours: SNMP for polling and traps, NetFlow for traffic statistics, and SIEM for correlation.

Security+ and CySA+ Angles

Security+ (SY0-701) covers log aggregation, why centralized logging protects integrity, and syslog as a feed into a SIEM.

CySA+ (CS0-004) expects you to read syslog output in scenarios, use severity to triage, and recognize gaps — a device that stopped logging, or a suspicious absence of messages during a window, is itself a finding. Time synchronization across sources matters here as much as it does for any correlation.

Key Takeaways

• Eight severity levels, 0 to 7, with 0 the most severe.
• Emergency, Alert, Critical, Error, Warning, Notice, Informational, Debug.
• Selecting a level captures it and everything more severe.
• Debug on a production device can cause an outage.
• UDP 514 is default and lossy; TCP and TLS 6514 are the reliable and encrypted options.
• Facilities identify the source subsystem, with local0–local7 reserved for local use.
• Centralized logging preserves evidence a compromised host could otherwise delete.