Refer to the official Cisco documentation below to configure log forwarding from Cisco IOS.
The Scope application supports ingestion of Cisco IOS logs in the Syslog format.
Feb 8 04:00:48 192.168.100.2 585917: Feb 8 04:00:47.272: %SEC-6-IPACCESSLOGRP: list 177 denied igmp 192.168.100.197 -> 224.0.0.22, 1 packet
<190>2361044: sw01: Jan 6 2022 22:11:43.398 AEST: %FOO-6-BAR: Test date format.
<165>7433: ASR920: 007439: 2y10w: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: username] [Source: 192.168.0.1] [localport: 22] at 07:57:58 VIENNA Thu Jan 27 2022
<190>3132517: Jul 13 08:23:43 192.168.100.2 sw01: 3132779: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format
<190>2476281: Aug 26 00:30:01: %SEC-6-IPACCESSLOGRP: list INPUT-ACL denied ospf 10.254.68.71 -> 224.0.0.5, 68 packets
<140>67399: Nov 18 2025 01:25:34.952 REDACT: %SW_MATM-4-MACFLAP_NOTIF: Host 28de.65a7.91b8 in vlan 8 is flapping between port Po13 and port Te1/1/0/5
<188>10069: redacted-sw: 010073: Feb 22 11:52:40 CST: %SW_MATM-4-MACFLAP_NOTIF: Host 9210.0369.5ce0 in vlan 20 is flapping between port Te1/0/5 and port Te1/0/6
<189>24056546: .Apr 7 17:12:19.965: %ADJ-5-RESOLVE_REQ_FAIL: Adj resolve request failed for 10.10.50.163 on Vlan50
<186>15859: *Jul 11 16:48:26: %IOSXE_QFP-2-LOAD_RECOVER: Slot: 0, QFP:0, Load 27% recovered.
<186>: 2026 Mar 16 09:16:39 EDT: %CALLHOME-2-EVENT: PERIODIC_CONFIGURATION
<13> 10.135.0.111 2026-01-09T01:54:33-05:00 10.135.0.111 10139895: Jan 9 2026 07:54:32.032 IST: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/3, changed state to down
<190>96709: 838531: Dec 9 06:59:23: %SPA_OIR-6-OFFLINECARD: SPA (NIM-4FXO) offline in subslot 0/1