6

Really stupid questions guys so I apologize. When sending Syslog messages to a server we use the command logging x.x.x.x. I get that part.

SNMP is used to gather stats or change configurations on our devices. I get that.

The part where I am drawing a blank is what is the need for the snmp-server host command along with enabling traps.

In this scenario is the SNMP server also operating as a Syslog server?

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 8 '17 at 14:10
8

You're partially right in that Syslog and SNMP Traping do serve similar functions, however there are some fundamental differences. (Based on your commands/tags on the quesiton, I assume you're asking specifically about their function on a Cisco Router/Switch.)

SNMP serves three main functions as you mentioned:

  1. Gathering of information with snmpget, snmpwalk, etc.
  2. Changing configuration on a devices via snmpset.
  3. Alerting via SNMP Traps, which will give you similar information to your Syslog events.

Syslog is only capable of the third option, sending information from the device to a server.


The primary differences between Syslog and SNMP are:

  1. Syslog will only send messages based on your current logging level and debugs in a Cisco device. SNMP Traps can be configured independently of your current logging level.
  2. Syslog is insecure, the messages are in plain text. EDIT: Per @ytti in the comments below, there is an encrypted transport option for Syslog on IOS devices. See this Cisco document on Reliable Transport of Syslog for more information on BEEP transport with TLS encryption. With that said, I would still recommend looking at SNMP v3, as it has built in encryption and authentication for the handling of it's transactions without needing to change the transport protocol/configuration.

For the most part, which logging method you should use really depends on your environment.

I've worked in shops that only used SNMP Traps, shops that only used Syslog events, and shops that used both (sent to two different servers under the control of two different departments).

It will depend greatly on the NMS/Syslog server you are using to gather this information, and what you wish to monitor in each Cisco device.


For more information on SNMP Traps in Cisco IOS devices, see this Cisco Tech Note.

For more information on Syslog in Cisco devices (including PIX/ASA), see this Cisco Press Article.

For more information on Logging in general on Cisco IOS devices see this Cisco Support Forum Doc on logging on IOS devices.

| improve this answer | |
  • 1
    You rock!! Pretty much answered my questions. – Michael Moore Aug 5 '13 at 0:10
  • 3
    Cisco supports BEEP transport for syslog which can be encrypted. I'd say major difference is that SNMP is formal and standardized, you don't need to know device you work with, same standard MIBs will work for all platforms. I think after ICMP ECHO testing of box being up, SNMP trap/inform should be second thing to implement in your monitoring, shame how most open source NMS completely ignore it. – ytti Aug 5 '13 at 7:03
  • @ytti I wasn't aware that BEEP could be encrypted, good to know! And +1 for the standardization of SNMP MIBs. – Brett Lykins Aug 5 '13 at 12:48
5

The 'snmp-server host' command determines the server(s) the traps are sent to. This needn't be the same server that receives syslog messages but it needs to run some trap-handling software to be useful...

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.