Which event generates a router syslog message at notice severity?

An interface line changing status, such as going up or down, is a significant event that network administrators need to be aware of promptly. This event is typically logged at the "notice" (severity level 5) syslog level. This level indicates normal but significant conditions that should be noted. A certificate expiring is a critical event, usually logged at "warning" (level 4) or "error" (level 3) severity, as it can impact secure communications. A TCP connection being torn down is a routine event and is generally logged at "informational" (level 6) or "debugging" (level 7) severity, as it's part of normal network operation. An ICMP connection being built is also a routine, low-impact event, typically logged at "informational" or "debugging" severity.