Questions tagged [logging]

For questions about logging in relation to network devices. For instance, you are configuring logging on your switch or you are troubleshooting a log issue on a router.

Filter by
Sorted by
Tagged with
-2
votes
1answer
29 views

The network monitoring paradox: The watchman watching theirself watch theirself watching theirself [closed]

Suppose we set up a public server, and we want to know exactly what happens with it. We set up a monitoring policy such that every incoming and outgoing packet is logged and saved to disk with a tool ...
3
votes
2answers
966 views

Direction incoming vs outgoing in logs

I'm trying to understand some Fortinet firewall logs but I'm not sure I fully understand what is being logged by the firewall when it comes to direction (Incoming vs Outgoing) For example: srcip=7.7....
14
votes
3answers
51k views

What does logging synchronous command do?

Can somebody describe me what does logging synchronous command do ?
2
votes
1answer
9k views

What does Cisco's logging source-interface command do?

According to Cisco documentation for logging, the logging source-interface command is optional. But if set up it specifies that syslog packets contain the IPv4 or IPv6 address of a specific ...
4
votes
1answer
556 views

Config logging on which cisco IOS?

I want to configure configuration logging on network devices by running following commands. archive log config logging enable I want to know which Cisco IOS and device support it? I used cisco ...
2
votes
1answer
38 views

Stopping logging info from interrupting CLI session?

With cisco devices the logging synchronous command will stop logging output from interrupting the the CLI session. Is there an equivalent command for the fortigate firewalls? i.e. When running a debug ...
6
votes
2answers
1k views

Cisco show log number of messages

When I run the "show log" command, it displays the latest 360 messages. Why 360? Can this value by changed? If yes, what is the command for that? Thanks.
2
votes
2answers
2k views

Cisco 3560 interface counters, are the counters reset automatically?

I have a Cisco 3560G switch. Are the interface counters reset automatically, recalculated in a specific interval (5 minutes?), or not at all? I want to get (hourly, daily, monthly, etc) interface ...
1
vote
1answer
2k views

ASA-6-106015, too many error messages on ASA

I've checked large amount of given below error messages on ASA. i know that some people tunes error messages like 106015 not logging for performance on device and cisco also no recommend about this ...
1
vote
2answers
296 views

How to measure time a request takes between two machines?

I need to calculate the time it takes between: a request sent from a machine the request is received at another machine I can do it by logging, but the clocks at these 2 machines are possible have a ...
1
vote
1answer
93 views

syslog port for serial comm port

I have Cisco 3750 switch which is connected via console comm5 port to my laptop and in the same laptop I have installed a kiwi Sys log server. I have done all the configurations to log all my messages ...
0
votes
1answer
117 views

Strange ip address in the log entry on my router [closed]

I have an TP-Link N750/WDR4300 wireless router. I look into my logs to day an found a couple of entries that looked like this: Aug 30 06:19:29 DHCP INFO DHCPC Send REQUEST to server ...
4
votes
1answer
85 views

Can TCP session be closed by the server depending on the packet content?

I am analyzing a pcap of command-and-control traffic caught during execution of a malicious file. First, a DNS request for a malicious domain was sent and after response is received and TCP connection ...
1
vote
1answer
51 views

How will a long RDP session be represented in firewall logs?

Example situation: a user connected to a server through RDP, port 3389, and works in the server for 4 hours. She does not disconnect and from her point of view, the connection is uninterrupted for the ...
2
votes
2answers
13k views

What does Monitor Logging do in Cisco IOS?

When doing sh log, I can see there is a monitor logging configured. I know that console logging is send to the physical console port, and that buffer logging is sent to the memory of the Switch/...
4
votes
4answers
200 views

Is it possible to disaggregate traffic to CDNs to find out what users are doing?

If I am looking at traffic from my network and I see (e.g., using SmartWhois) that a lot of user traffic is going to certain CDNs. e.g., in one network 87% of my traffic goes to Amazon. Is there a way ...
3
votes
4answers
794 views

Syslog severity level to 5 + ACL BLOCKED log

I am on a L3 switch C3750 IOS 12.2 and I want to log in the buffer (or just to the syslog server) all severity 5 messages and just the ACL Blocked level 6 messages. Is there a way to do this ? I've ...
1
vote
3answers
95 views

How do I send syslogs from a UTM/switch to a cloud-hosted log server?

I'm a small MSP trying to start a logging solution for my clients via a cloud-based log server SaaS provider. I'm not understanding, however, based on any of the instructions I've read from the ...
1
vote
1answer
236 views

How to capture the details of the network traffic by Cisco?

I want to save the details of the network traffic by my Cisco Switch [source IP, dest, protocol...]. Is it possible to enable logging to capture the details of the network traffic by my Cisco in a ...
2
votes
1answer
2k views

Console, Monitor and Buffer Logging

Could someone please explain the difference between the console, monitor and buffer logging in Cisco IOS. Console logging: level debugging, 32 messages logged, xml disabled, ...
1
vote
1answer
4k views

Access-list won't show all hit matches

I have access-lists in place. When i use the show ip access-list command, some of access-lists show counters (hit counts), and some don't. If I change the rule from permit to deny, interesting traffic ...
1
vote
2answers
6k views

How to view old Log messages on Junos

I am currently trying to trace the syslogs on Junos I ran the "show log" command and the resulting messages I see don't contain that for the date I wish to check. I even ran the command "show log ...
2
votes
2answers
12k views

debug crypto ipsec via ssh

How to debug IP Sec VPN on ASA using SSH? I try debug crypto ipsec terminal monitor logging monitor it asks for completion if i choose debug, all debug info are flooded. How do i view just IPSEC ...
1
vote
2answers
4k views

How can I get a list of users and last login dates from a Cisco ACS running v5.2?

I'm trying to get a list of the users that have logged into a Cisco ACS, and the date of their last login. Ideally, I'd like it to include the identity store that was the source of the authentication ...
6
votes
1answer
548 views

Spanning-Tree debug logs C7600

I am trying to debug STP on a C7613 but I have logging issues. IOS version 15.2(4)S2 The Route Switch Processor is RSP720-3CXL-GE I'm running every debug commands for Spanning-Tree but nothing gets ...
1
vote
1answer
378 views

Packets seem to bypass netfilter prerouting hook

In order to debug a networking problem, I introduced logging with iptables: for chain in INPUT FORWARD OUTPUT; do iptables -A $chain -j LOG --log-level info --log-prefix filter_$chain done for ...
1
vote
1answer
307 views

cisco catalyst 3850: configuration to send email when any interface down

I read the Cisco documentation of Cisco 3850 and have not found configuration to send email when interface is down. ASA can do this. I really appreciate if anyone know how to share the configuration.
1
vote
1answer
53 views

Actively host ip and port accessed in Cisco IOS

Is there a way to set up logging on a Cisco router to keep a log of all the host IP's and the ports successfully accessed the network and the last time port was accessed, and automatically garbage ...
1
vote
2answers
917 views

Configure Log format Cisco ASA firewall

The logs from CISCO ASA fierwall is currently in the following format. %ASA-message_class-severity-messageID e.g. "%ASA-session-6-....." I want to remove messsage class from logs %ASA-...
4
votes
2answers
6k views

Fortigate logging: how to prevent ping to firewall interface to be logged while still getting logs for implicitly denied traffic

Is there a way to configure a fortinet firewall (e.g, fortigate600 running FortiOS 5 or FortiOS 4) so it do not generate log entries for pings that are directed to the firewall's own interfaces but ...
3
votes
1answer
990 views

Performance differences of logging session-init and session-close invididually compared to through apply-groups

Assumption: Your interest lies in logging each and every session Approach 1 You configure the session logging within each and every policy, for example: set security policies from-zone trust to-...
4
votes
1answer
730 views

Interpreting Cisco logging symbols

When I issue a "show logging" command to see the locally buffered logs, the log statements are displayed sometimes with an asterisk in front of the date and sometimes with a period in front ...
1
vote
1answer
80 views

Choosing components of a wifi customer tracking system [closed]

We are installing customer WiFi for our retail locations and want to run analytics on customer usage. Information we would like to know: How often a customer visits a location? What locations a ...
6
votes
2answers
4k views

SNMP and Syslog in configuration

Really stupid questions guys so I apologize. When sending Syslog messages to a server we use the command logging x.x.x.x. I get that part. SNMP is used to gather stats or change configurations on ...
6
votes
3answers
2k views

How to log out of state sessions on Juniper SRX platform?

I am really having trouble to get our SRXes to log sessions that are not in the state table and get dropped because of that. For example, if you reboot the firewall and some old NFS implementation ...
3
votes
1answer
333 views

Source of Cisco NBAR dropped traffic

I recently implemented Cisco NBAR at a remote sites, edge router. to filter and drop P2P traffic. I see the dropped traffic by typing "show policy-map interface XXX" how can i find the source of the ...