Hot answers tagged

16

"logging synchronous" prevents every logging output from immediately interrupting your console session. See command documentation: "This keeps unsolicited messages and debug output from being interspersed with solicited software output and prompts." http://www.cisco.com/c/en/us/td/docs/ios/fundamentals/command/reference/cf_book/cf_l1.html#wp1020534


8

If nothing is before the date, it means that your router clock was set manually or is in sync with a NTP server by the time of the log. If with an asterisk, it means you didn't set the clock or it isn't synced with a NTP server. If there's a period, it means the clock was in sync but the NTP server is not accessible. Source


8

You're partially right in that Syslog and SNMP Traping do serve similar functions, however there are some fundamental differences. (Based on your commands/tags on the quesiton, I assume you're asking specifically about their function on a Cisco Router/Switch.) SNMP serves three main functions as you mentioned: Gathering of information with snmpget, ...


7

Almost every Cisco IOS router 12.x and 15.x supports this command. You can use it in this way to send configuration command logging to syslog server: conf terminal archive log config logging enable logging size 200 notify syslog contenttype plaintext hidekeys logging xx.xx.xx.xx where xx.xx.xx.xx - your syslog-server. Also you can view previous ...


7

If you’re using ‘show log’ to display messages in the logging buffer, then you’re using IOS or IOS-XE. In both of those Cisco operating systems there is a default syslog buffer size (configured in bytes). It happens that you can currently fit 360 messages in that buffer. You can change the log buffer size to be much larger with: “logging buffered 15000000 ...


6

A RST received after a SYN request means the TCP handshake has failed. No user data was transmitted. Whether this happens due to the destination port not listening, a firewall response, or other filtering is up to the the destination host/network. There's no way to be sure from viewing from the outside. The RST can be caused by any decision on the ...


5

The source interface command specifies which interface IP address will be used as the source IP address of the syslog packets. The actual outgoing interface will be determined by the routing table.


5

What problem are you trying to solve? Most CDN's work off of Anycast/GeoIP to serve the requested content as close to the source of the request as possible. I'm also not sure what you mean or what you're trying to accomplish by "finding out what users are doing" - CDN's are designed to be transparent to users to provide a better user experience when ...


4

If you don't see those logs there anymore, they've most likely been rotated to reduce disk space used, but it could be that messages.19.gz contains logs from July, it all depends on when that log was created. So you could use show log messages.19.gz to check that. You can change the number of files stored on disk: set file messages archive files 100 Make ...


4

The serial console connection does not provide network connectivity and syslog requires a network connection. In other words, the switch can't talk to a syslog server running on the same machine as the terminal unless there's an additional network connection. You need to connect and configure both laptop and switch to enable them to talk to each other. In ...


3

You may be running into the fact that some firewalls only allow syslog to be sent from them via their management interface (and not directly out the port facing towards your SaaS/logging provider). Aside from that, syslog will be sent to a remote server via UDP port 514 by default - ensure that this is allowed outbound from your firewall for all your ...


3

According to the Cisco TAC representative who handled my case, there is no way to get a list of users that includes their last login date, with the possible exception of looking up each user individually. I'm not sure I believe this answer, as it seems like such a basic query that I'd be very surprised if they didn't include any way to get the answer, but ...


3

Since you do not specify, I will assume you mean Cisco IOS. If you are connected to the console or a VTY line, you can see the messages as they happen with console or terminal commands, respectively. Log messages are sent to a buffer in the device, and you can retrieve the buffer to see past messages, no matter how you connect to the device, with the show ...


3

Depending on which platform your using you can use NetFlow data to see this. Most Cisco routing platforms support this and even newer switching platforms support this as well. Also simply logging the ACL (Adding log to the end of the ACL statement) will generate a log message that states the source of the packets that were denied.


3

Packets should be classified regardless of the TCP handshake being watched or not. If there isn't a session defined for that flow (fast path) a new one should be created (first path). Do you have any screen configured?? Maybe it's the screen that's dropping the traffic. More details on Troubleshooting Traffic Flows and Session Establishment Maybe you can ...


3

If we are assuming you want to log every session on your device then the apply-groups statement itself will as you thought only impact the performance of commit's. This is because the system will need to calculate the effect of the applied groups across the rest of the config. The bigger your config gets and the more groups you are applying the longer your ...


2

The really first step is to look for Radius support. With Radius support you are able to manage the authentication authorization and accounting (aaa). In this case you are not concerned with authentication and authorization since you are, essentially, asking for accounting. Accounting is the process by which a network device (called NAS - Network Access ...


2

The RSP720 in the router has two processing engines. The route processor (RP) and the switch processor (SP). When you log-in to the console/telnet/ssh on a 7600 that's running IOS on both the RP and the SP (Native mode), you log-in to the RP by default. The spanning-tree function is however performed by the SP. After logging into the box try: term mon ...


2

You could utilize the Embedded Event Manager with a custom policy for this. There is a good overview and documentation here from Cisco: http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/eem/configuration/xe-3se/3850/eem-xe-3se-3850-book/eem-policy-tcl.html But this is relatively complicated. A much easier approach would be to forward the syslog output from ...


2

There's a protocol created by Cisco for this very purpose: netflow. You have to check if your version of IOS support it, and you need a netflow collector that will receive and record the information from the switch. Cisco reference some free Netwflow software on this page but there's plenty others. Many software provide both the syslog and the netflow ...


2

If the platform is Cisco Catalyst as reflected in the tags for the question, that may be the case. Some platforms reflect only punted (soft-switched) packets in the "show ip access-list [...]" output, while others reflect none. For example, for Catalyst 6500 and Sup720 You'd need to use show tcam int x/y acl in|out protocol, while for other Catalyst ...


2

Last clearing of "show interface" counters never That line is a few above what you provided. Interface counters (in the UI) reset (1) at reload, (2) when explicitly cleared (clear counters), or (3) when they roll over -- with 64bit counters, that's unlikely. (#2 doesn't touch SNMP counters) To properly do traffic accounting for billing purposes, you need ...


2

Under normal circumstances, this would be represented by a single flow entry, provided your firewall only logs an entry at the start of a flow and doesn't log periodic updates on the same flow. Now - if the user was idle for 4 hours eg: no traffic passed over the RDP session for that long, then most firewalls would age the session out, and would require the ...


2

The one-way delay problem has a lot of attention over the years. It's especially important for analysing asymmetric routes but can be important for many applications. The basic idea is always the same: establish a reference clock (with for example NTP) and then make measurements. Obviously the first driving factor is what accuracy you need: 10 ms is what ...


2

No, this is not possible in FOS. Even with multiple (ssh) terminal windows, debug info will be printed on ALL windows. Multiple terminals will only faciliate command input.


1

You will want to log over a VPN tunnel to protect your clients' data. What I've done is set up the tunnel between the customer's edge UTM/firewall appliance and a virtual one on my cloud. They could route from their management network to the tunnel, using the firewall policy to lock down access to syslog traffic. Setting up the devices for remote logging ...


1

Configure the level of syslog's you want for the events you want logged. Then configure the syslog server address - either a static public IP or a FQDN. Then configure the security/firewall on your private/shared cloud system to allow syslog packets to reach the logging server.


1

If you mean the terminal monitor command, that will send debug and system messages to the current terminal session. If you are connected to the device via a VTY line, you need to use this command to see those because it may look like you are connected the the CON line, but you are not. Cisco maintains extensive documentation that is just a search away: ...


Only top voted, non community-wiki answers of a minimum length are eligible