As an example if you want to log ICMP (ping) on your switch then you can send the log directly to the local buffered log on the switch and you can setup a syslog destination to receive the log from the switch.
First of an access-list and this is all based on Cisco.
ip access-list extended test
permit icmp any any log-input
permit ip any any
Add the access list to an interface. I will add it to a local test interface Vlan 1.
ip address 192.168.1.2 255.255.255.0
ip access-group test in
Now when i ping the device on my test network, the switch will log:
Jan 26 15:09:55.310: %SEC-6-IPACCESSLOGDP: list test permitted icmp 192.168.1.22 (Vlan1 107b.4459.5c6e) -> 192.168.1.2 (
0/0), 8 packets
If you want to setup logging for your switch, assuming you have a syslog server of some sort, you can use this configuration on the switch:
logging origin-id hostname
I like when i can see the device name as typically my devices have
The Syslog server IP
logging trap notifications
What level you should send to your syslog server
logging history notifications
This is the switch local log and SNMP setting for logging level
logging buffered 96000
Local switch log buffer in bytes.