I am on a L3 switch C3750 IOS 12.2 and I want to log in the buffer (or just to the syslog server) all severity 5 messages and just the ACL Blocked level 6 messages.
Is there a way to do this ? I've found that we can set the severity of acl log messages in the acl entries, but it's on ASA, not on my platform, even with extended acl.
And I can't permit all 6 messages to be logged.
Thanks in advance,
The logging discriminator might be the feature you are looking for here. http://www.cisco.com/c/en/us/td/docs/ios/12_4t/12_4t11/htnmsylg.html#wp1056391
The format of such a discriminator is as follows : logging discriminator discr-name [[facility | mnemonics | msg-body {drops | includes} string] | severity {drops | includes} sev-num | rate-limit msglimit]
As an example , say the logged message for the ACL is of the kind
"*May 1 22:12:13.243: %SEC-6-IPACCESSLOGP: list ACL-IPv4-E0/0-IN permitted tcp 192.168.1.3(1024) -> 192.168.2.1(22), 1 packet"
Your discriminator would be :
logging discriminator BLOCKACL mnemonics includes %SEC-6-IPACCESSLOGP
You just finish your standard ACL statement with the log keyword. The level of logging is configured per logging destination. Note this may negatively impact performance of your networking device. Use with caution.
Write an EEM script that looks for your syslog message at level 6 and in response emits a syslog message at log 5 or better.
Note: I don't know if this works on your device/IOS version.
The following example "converts" a level 5 syslog (the "%SYS-5-CONFIG_I" log you see when you make config changes and exit the config mode) to a level 2 syslog. Note the regex which grabs certain fields from the original syslog and renders them as is in the new syslog:
Switch#sh run | sec event manager
event manager applet logConfigsAtLevel2
event syslog pattern "^.*%SYS-5-CONFIG_I.*$"
action 10 regexp "^.*%SYS-5-CONFIG_I.*from (.*) by (.*)$" "$_syslog_msg" match who where
action 20 if $_regexp_result eq "1"
action 30 syslog priority critical msg "somebody ($who) from ($where) is up to no good" facility "EEM"
action 40 end
Switch#
This results in:
Switch#sh log
...
...
*Nov 22 11:13:44.409: %SYS-5-CONFIG_I: Configured from console by console
*Nov 22 11:13:44.415: %EEM-2-LOG: logConfigsAtLevel2: somebody (console) from (console) is up to no good
Switch#
You can set the logging level. If you set the logging level to 6, it will log all level 6 messages. See System Message Logging:
logging trap <level>
You need software to read the syslog which can give you only the level 6 messages in which you are interested.
