3

I am on a L3 switch C3750 IOS 12.2 and I want to log in the buffer (or just to the syslog server) all severity 5 messages and just the ACL Blocked level 6 messages.

Is there a way to do this ? I've found that we can set the severity of acl log messages in the acl entries, but it's on ASA, not on my platform, even with extended acl.

And I can't permit all 6 messages to be logged.

Thanks in advance,

6
  • All you can do is to set the logging level. You should have a syslog server and software to read the logs that can give you only the level 6 messages in which you are interested. ACLs don't work with logging. – Ron Maupin Oct 27 '16 at 14:26
  • I have the syslog server and all is in place. I just asked if it was possible to do with 3750 like ASA where you can adjust the severity of ACL logged messages (when the log option is enabled) – Jey10 Oct 27 '16 at 14:35
  • See my answer for this. – Ron Maupin Oct 27 '16 at 14:44
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 15 '17 at 4:47
1

The logging discriminator might be the feature you are looking for here. http://www.cisco.com/c/en/us/td/docs/ios/12_4t/12_4t11/htnmsylg.html#wp1056391

The format of such a discriminator is as follows : logging discriminator discr-name [[facility | mnemonics | msg-body {drops | includes} string] | severity {drops | includes} sev-num | rate-limit msglimit]

As an example , say the logged message for the ACL is of the kind

"*May 1 22:12:13.243: %SEC-6-IPACCESSLOGP: list ACL-IPv4-E0/0-IN permitted tcp 192.168.1.3(1024) -> 192.168.2.1(22), 1 packet"

Your discriminator would be :

logging discriminator BLOCKACL mnemonics includes %SEC-6-IPACCESSLOGP

1

Cisco IOS Configuration Fundamentals Configuration Guide, Release 12.2 Troubleshooting, Fault Management, and Logging

You just finish your standard ACL statement with the log keyword. The level of logging is configured per logging destination. Note this may negatively impact performance of your networking device. Use with caution.

enter image description here

1

Write an EEM script that looks for your syslog message at level 6 and in response emits a syslog message at log 5 or better.

Note: I don't know if this works on your device/IOS version.

The following example "converts" a level 5 syslog (the "%SYS-5-CONFIG_I" log you see when you make config changes and exit the config mode) to a level 2 syslog. Note the regex which grabs certain fields from the original syslog and renders them as is in the new syslog:

Switch#sh run | sec event manager
 event manager applet logConfigsAtLevel2
  event syslog pattern "^.*%SYS-5-CONFIG_I.*$"
  action 10 regexp "^.*%SYS-5-CONFIG_I.*from (.*) by (.*)$" "$_syslog_msg" match who where
  action 20 if $_regexp_result eq "1"
  action 30  syslog priority critical msg "somebody ($who) from ($where) is up to no good" facility "EEM"
  action 40 end
Switch#

This results in:

Switch#sh log
...
...
*Nov 22 11:13:44.409: %SYS-5-CONFIG_I: Configured from console by console
*Nov 22 11:13:44.415: %EEM-2-LOG: logConfigsAtLevel2: somebody (console) from (console) is up to no good
Switch#
0

You can set the logging level. If you set the logging level to 6, it will log all level 6 messages. See System Message Logging:

logging trap <level>

You need software to read the syslog which can give you only the level 6 messages in which you are interested.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.