I'd like to configure out 4500s to send the following to a syslog server:
1. Severity 4 and under syslogs
2. Link status events for trunks/L3 links (but not access ports)

Number 1 is not a problem. Number 2 is a bit tricky. I can do this by either doing the 'no logging event link-status global' globally and then 'logging event link-status' on the trunk/L3 links or I can do 'no logging event link-status global' on all ports and leave the trunk/L3 links untouched. But either way, when I do this it also caues the link status events for the access ports to not be syslogged to the monitor (term mon) or to the buffer (show log). Not that it's a big deal, but it's nice to have those port link status messages syslogged somewhere else in case we need it for troubleshooting.

Can this be configured some other way? I have a feeling this can't be done, or at least it can't be done with the IOSs we're running (mostly 12.2). I'm using a syslog receiver sensor on PRTG to receive the syslogs. It only allows me to filter by severity level or by syslog message content (but not both). Given that this isn't that big of a deal, using another syslog server isn't really an option.

Thanks

Maybe I'm missing something... But why does it stop logging to buffer or console? It shouldn't unless you also configure "no logging buffered" or "no logging console". Maybe you need to add "logging buffered" or "logging console" although in a prod network I would not use logging console...

_________________
blog.brokennetwork.ca

Yup, 'logging buffered' is on as it shows me that syslog severity 5 message about me configuring the switch from console (i.e.: the one that shows up anytime you leave global config mode to go back to enable mode). Once I put 'logging event link-status' on an interface and shut it down, I'll see it in the log buffer