FirstTry

Objective 4.5

200-301

Describe the use of syslog features, including facilities and severity levels.

Objective 4.5 sits in IP Services, which carries 10% of the CCNA exam. The questions below are original, written from the official objective title above, and each explanation cites the Cisco page it rests on.

Objective title verbatim from the official objectives. Cisco exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

4-5IP Services

A switch console shows these two messages during a link event.

00:00:47: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/1, changed state to up00:00:48: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to down

Which part of the second message names the facility?

The timestamp, which prefixes the percent signTime stamps come from the service timestamps setting, are optional, and sit ahead of the percent sign, outside the three hyphenated fields.
The digit 5, which precedes the final stringThat digit is the severity, a single-digit code from 0 to 7 ranking how serious the event is. It says nothing about where the message came from.
UPDOWN, the string following the severity digitUPDOWN is the mnemonic, the text string that uniquely describes what happened. It answers which event occurred, not which subsystem reported it.
LINEPROTO, the string preceding the severity digitCorrect · your answerCorrect. The facility sits between the percent sign and the first hyphen.

Correct.

Checked against cisco.com, August 2026

Concept

An IOS system message is a fixed run of fields: optional stamps, a percent sign, then three items separated by hyphens, then the descriptive text. Reading one is a matter of knowing which position holds which field rather than recognizing the wording.

Why D

After the percent sign the order is facility, then severity, then mnemonic. In %LINEPROTO-5-UPDOWN the first of the three is LINEPROTO, the subsystem the message refers to, in the same slot that SYS or SNMP would occupy on a message from those subsystems.

Source

Depending on the switch, messages appear in one of these formats: seq no:timestamp: %facility-severity-MNEMONIC:description (hostname-n) seq no:timestamp: %facility-severity-MNEMONIC:description…

Cisco: Configuring System Message Logs, checked August 2026
#syslog#message-format#facility

Now you: objective 4.5 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 2

4-5IP Services

A collector receives this message from an edge switch.

<187>1 2026-07-30T18:22:41.117Z edge1.example.net sshd 4021 ID47 - authentication failure for admin

Which facility and severity does the PRI carry?

Sample question 2 of 2

4-5IP Services

A syslog message carries a code describing which subsystem produced it and how serious it is. What are those categories?

That’s 2 of the full CCNA bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in IP Services