Which Logs Can I Take?

[ersin erol]

Hi everyone

  There some layer 2 and layer 3 Cisco Switchs our network,And there is other project,the project about logging.I want to take some Log reports from these switchs,Which logs can ı take? For example : Which switch ports Most Port changed?

[JohnTylerPearce]

Well, I would setup a syslog server. You can download numerous ones for free if you search. Solarwinds has one that's pretty decent, and free that you can use.

You will need to setup logign on each switch, and then configure the appropriate logging level. I usually set a logging level of 4, and never above.

logging host

logging trap

You will need to include the IP address of your syslog server here.

The trap level defines what kind of logging you want to capture.

Here are the levels.

Emergency: 0

Alert: 1

Critical: 2

Error: 3

Warning: 4

Notice: 5

Informational: 6

Debug: 7

Which ever one you choose, it will include all other below it. For example, if you choose 7 it will include, 6,5,4,3,2,1, and 0.

Or if you choose 4, it will include 4,3,2,1,and 0.

Hope this helps.

[garapoglou]

Hi,

Logging depends on the network topology. You don't have to log changes to switchports connected to clients, although sometimes it's needed to troubleshoot certain problems. But you really need to log changes to switchports used to connect the switches with the routers or the other switches.

You mentioned you have layer3 switches, so I suppose these are the core switches of your network. You definitely have to take logs from those switches to prevent possible problems with the network.

As mentioned above, you need to setup a syslog server. I personally use Kiwi Syslog Daemon, which is also free but SolarWinds has a very nice one too. To avoid using a server for a simple task like logging, you could install other monitoring software on that machine as well. After all, logging is not a task that needs all of the available system resources.

Best regards,

Giorgos

[JohnTylerPearce]

That's the one I was actually talking about Girogos, I keep forgetting that solarwinds now owns Kiwi.

[garapoglou]

I'm still using the old version, so it still happens to me as well.

Thanks a lot for taking the time to clarify, John.

Giorgos

[ersin erol]

Thanks to everybody