Hot answers tagged

17

"logging synchronous" prevents every logging output from immediately interrupting your console session. See command documentation: "This keeps unsolicited messages and debug output from being interspersed with solicited software output and prompts." http://www.cisco.com/c/en/us/td/docs/ios/fundamentals/command/reference/cf_book/cf_l1.html#wp1020534


8

If nothing is before the date, it means that your router clock was set manually or is in sync with a NTP server by the time of the log. If with an asterisk, it means you didn't set the clock or it isn't synced with a NTP server. If there's a period, it means the clock was in sync but the NTP server is not accessible. Source


8

You're partially right in that Syslog and SNMP Traping do serve similar functions, however there are some fundamental differences. (Based on your commands/tags on the quesiton, I assume you're asking specifically about their function on a Cisco Router/Switch.) SNMP serves three main functions as you mentioned: Gathering of information with snmpget, ...


7

Almost every Cisco IOS router 12.x and 15.x supports this command. You can use it in this way to send configuration command logging to syslog server: conf terminal archive log config logging enable logging size 200 notify syslog contenttype plaintext hidekeys logging xx.xx.xx.xx where xx.xx.xx.xx - your syslog-server. Also you can view previous ...


7

If you’re using ‘show log’ to display messages in the logging buffer, then you’re using IOS or IOS-XE. In both of those Cisco operating systems there is a default syslog buffer size (configured in bytes). It happens that you can currently fit 360 messages in that buffer. You can change the log buffer size to be much larger with: “logging buffered 15000000 ...


6

A RST received after a SYN request means the TCP handshake has failed. No user data was transmitted. Whether this happens due to the destination port not listening, a firewall response, or other filtering is up to the the destination host/network. There's no way to be sure from viewing from the outside. The RST can be caused by any decision on the ...


5

What problem are you trying to solve? Most CDN's work off of Anycast/GeoIP to serve the requested content as close to the source of the request as possible. I'm also not sure what you mean or what you're trying to accomplish by "finding out what users are doing" - CDN's are designed to be transparent to users to provide a better user experience when ...


5

The source interface command specifies which interface IP address will be used as the source IP address of the syslog packets. The actual outgoing interface will be determined by the routing table.


5

If you don't see those logs there anymore, they've most likely been rotated to reduce disk space used, but it could be that messages.19.gz contains logs from July, it all depends on when that log was created. So you could use show log messages.19.gz to check that. You can change the number of files stored on disk: set file messages archive files 100 Make ...


4

The serial console connection does not provide network connectivity and syslog requires a network connection. In other words, the switch can't talk to a syslog server running on the same machine as the terminal unless there's an additional network connection. You need to connect and configure both laptop and switch to enable them to talk to each other. In ...


3

Since you do not specify, I will assume you mean Cisco IOS. If you are connected to the console or a VTY line, you can see the messages as they happen with console or terminal commands, respectively. Log messages are sent to a buffer in the device, and you can retrieve the buffer to see past messages, no matter how you connect to the device, with the show ...


3

If we are assuming you want to log every session on your device then the apply-groups statement itself will as you thought only impact the performance of commit's. This is because the system will need to calculate the effect of the applied groups across the rest of the config. The bigger your config gets and the more groups you are applying the longer your ...


3

According to the Cisco TAC representative who handled my case, there is no way to get a list of users that includes their last login date, with the possible exception of looking up each user individually. I'm not sure I believe this answer, as it seems like such a basic query that I'd be very surprised if they didn't include any way to get the answer, but ...


3

You may be running into the fact that some firewalls only allow syslog to be sent from them via their management interface (and not directly out the port facing towards your SaaS/logging provider). Aside from that, syslog will be sent to a remote server via UDP port 514 by default - ensure that this is allowed outbound from your firewall for all your ...


3

Depending on which platform your using you can use NetFlow data to see this. Most Cisco routing platforms support this and even newer switching platforms support this as well. Also simply logging the ACL (Adding log to the end of the ACL statement) will generate a log message that states the source of the packets that were denied.


3

The connection initiated from external networks which hits egress interfàce of firewall and transverse to Lan interfàce of firewall .. considered as incoming traffic or inbound traffic .. The connection initiated from internal network which hits on ingress interface of firewall and transverse to egress interfàce where ISP link is connected .. consider as ...


3

Set the VRF on the host entry. Your VRF should also be defined on the management interface itself. Please issue the commands: no logging host 10.10.10.10 transport udp port 10023 logging host 10.10.10.10 vrf mgmtVrf transport udp port 10023


2

The really first step is to look for Radius support. With Radius support you are able to manage the authentication authorization and accounting (aaa). In this case you are not concerned with authentication and authorization since you are, essentially, asking for accounting. Accounting is the process by which a network device (called NAS - Network Access ...


2

Last clearing of "show interface" counters never That line is a few above what you provided. Interface counters (in the UI) reset (1) at reload, (2) when explicitly cleared (clear counters), or (3) when they roll over -- with 64bit counters, that's unlikely. (#2 doesn't touch SNMP counters) To properly do traffic accounting for billing purposes, you need ...


2

There's a protocol created by Cisco for this very purpose: netflow. You have to check if your version of IOS support it, and you need a netflow collector that will receive and record the information from the switch. Cisco reference some free Netwflow software on this page but there's plenty others. Many software provide both the syslog and the netflow ...


2

You could utilize the Embedded Event Manager with a custom policy for this. There is a good overview and documentation here from Cisco: http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/eem/configuration/xe-3se/3850/eem-xe-3se-3850-book/eem-policy-tcl.html But this is relatively complicated. A much easier approach would be to forward the syslog output from ...


2

The RSP720 in the router has two processing engines. The route processor (RP) and the switch processor (SP). When you log-in to the console/telnet/ssh on a 7600 that's running IOS on both the RP and the SP (Native mode), you log-in to the RP by default. The spanning-tree function is however performed by the SP. After logging into the box try: term mon ...


2

If the platform is Cisco Catalyst as reflected in the tags for the question, that may be the case. Some platforms reflect only punted (soft-switched) packets in the "show ip access-list [...]" output, while others reflect none. For example, for Catalyst 6500 and Sup720 You'd need to use show tcam int x/y acl in|out protocol, while for other Catalyst ...


2

Under normal circumstances, this would be represented by a single flow entry, provided your firewall only logs an entry at the start of a flow and doesn't log periodic updates on the same flow. Now - if the user was idle for 4 hours eg: no traffic passed over the RDP session for that long, then most firewalls would age the session out, and would require the ...


2

The one-way delay problem has a lot of attention over the years. It's especially important for analysing asymmetric routes but can be important for many applications. The basic idea is always the same: establish a reference clock (with for example NTP) and then make measurements. Obviously the first driving factor is what accuracy you need: 10 ms is what ...


2

No, this is not possible in FOS. Even with multiple (ssh) terminal windows, debug info will be printed on ALL windows. Multiple terminals will only faciliate command input.


1

You will want to log over a VPN tunnel to protect your clients' data. What I've done is set up the tunnel between the customer's edge UTM/firewall appliance and a virtual one on my cloud. They could route from their management network to the tunnel, using the firewall policy to lock down access to syslog traffic. Setting up the devices for remote logging ...


1

This is a side effect of route cache and connection tracking. The packet of a new flow will go through the full stack, all subsequent packets match an existing flow (conntrack entry) and are immediately forwarded.


Only top voted, non community-wiki answers of a minimum length are eligible