Cisco Core Switches - Identifying unused ports

Question

I've started at a new site, and the server room is an absolute state - I want to get in and start removing unused patch leads, so that I can start to see what is available & to tidy up.

There is zero documentation to top it off!

I know that the 'Clear counters' command is useful here, but is there an efficient way to see the results? I've been told 'Show interfaces' by a colleague, but it outputs a lot of information that I find hard to read through, and with 13 switches to get through across the site its going to take a long time.

I want to see whether the ports are being used over the period of ~1 month, as we have a lot of laptop users, the ports won't always show active if a user is out of the business etc.

Switches are mostly Cisco 2960S

Thanks in advanced

Answer 1

Responding to the comment:

I want to see whether the ports are being used over the period of ~1 month

your best way for this specific question is to use the logs. They will show when a port goes UP / Down.

Example of shuch logs:

Jun 14 13:32:23.841: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/29, changed state to down
Jun 14 13:32:24.841: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/29, changed state to down
Jun 14 13:32:27.714: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/29, changed state to up

For a period this long, since you have to set the logging to "notifications" at a minimum (see below) the internal logs are probably not enough. To collect the information efficiently you should configure your switch to send its logs to a syslog server.

If you don't have one you can, for example, download a docker image of syslogng, then on the switch enter:

(config)#logging host x.x.x.x  (IP address of your syslog server)
(config)#logging traps (i.e 0 1 2 3 4 5 .. according to your requirement)

You can see what the trap value with the "?" contextual help:

config)#logging trap ?
  <0-7>          Logging severity level
  alerts         Immediate action needed           (severity=1)
  critical       Critical conditions               (severity=2)
  debugging      Debugging messages                (severity=7)
  emergencies    System is unusable                (severity=0)
  errors         Error conditions                  (severity=3)
  informational  Informational messages            (severity=6)
  notifications  Normal but significant conditions (severity=5)
  warnings       Warning conditions                (severity=4)
  <cr>

In your case interfaces going up / down is severity 5, but you may want to configure it higher to see other things going on on the switches.

Answer 2

The way I've done it in the past is use the commands "show version" to get the total uptime of the switch in question.

Switch#sh ver
Cisco IOS Software, s72033_rp Software (s72033_rp-ADVENTERPRISE_WAN-M), Version 12.2(33)SXJ3, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2012 by Cisco Systems, Inc.
Compiled Mon 16-Apr-12 16:12 by prod_rel_team

ROM: System Bootstrap, Version 12.2(17r)SX5, RELEASE SOFTWARE (fc1)

 Switch uptime is 1 year, 7 weeks, 5 days, 10 hours, 5 minutes

and then use the command "show interfaces stats". The second command shows you if packets/data has traversed the port since the switchport has been active. It can be a lot of info to sift through though. Looking below, you can see that switchports Gi1/4 & Gi1/5 haven't had any data across it since the switch has been UP. (1 year, 7 weeks, 5 days, 10 hours, 5 minutes; gotten from the "show version" output)

Switch#sh int stats
Interface GigabitEthernet1/1 is disabled

GigabitEthernet1/2
          Switching path    Pkts In   Chars In   Pkts Out  Chars Out
               Processor        134      47736     565540  338268321
             Route cache          0          0          0          0
       Distributed cache          0          0          0          0
                   Total        134      47736     565540  338268321
GigabitEthernet1/3
          Switching path    Pkts In   Chars In   Pkts Out  Chars Out
               Processor      30773   12432464      30737   18318785
             Route cache          0          0          0          0
       Distributed cache          0          0          0          0
                   Total      30773   12432464      30737   18318785
GigabitEthernet1/4
          Switching path    Pkts In   Chars In   Pkts Out  Chars Out
               Processor          0          0          0          0
             Route cache          0          0          0          0
       Distributed cache          0          0          0          0
                   Total          0          0          0          0
GigabitEthernet1/5
          Switching path    Pkts In   Chars In   Pkts Out  Chars Out
               Processor          0          0          0          0
             Route cache          0          0          0          0
       Distributed cache          0          0          0          0
                   Total          0          0          0          0

Granted, this only works if the "clear counters" command hasn't been used on a specific interface.

Answer 3

From the Cisco Community:

Sh int | inc Fast|Last input

If you have gig ports, change fast to Gig.

Sh int | inc Gig|Last input

This would show you all ports. You could narrow it down by specifying the port you want:

Sh int fa0/1 | inc Last input

Note: It may be that they want every single data walljack to be operational. If you start unplugging a subset of the switch ports from the patch panel you end up with some walljacks that are not going to work.

Answer 4

If you have some Python skills, you can use the Network to Code templates to read in the output from show interface and format it as structured data. Then you can simply look at the "Last Input" column