topic Re: How to log Success and Failed Login Attempt Details to Route in Network Access Control

How to log Success and Failed Login Attempt Details to Router into Syslog?

jaesposito — Mon, 11 Mar 2019 00:02:25 GMT

All,

How can I configure my Cisco 837 router to log to syslog all successful and failed login attempts to the router via any interface? I'd like to get as much verbose information about the login attempts (success and failed) as possible including source ip address, userid attempted, etc.

Any comments and suggestions would be greatly appreciated!

James

Re: How to log Success and Failed Login Attempt Details to Route

Collin Clark — Tue, 30 Mar 2010 19:45:33 GMT

You will need to send logging to a syslog server with a level of informational.

Here's a link on configuring message logging. It's for a switch, but it should be the same for routers.

http://www.cisco.com/en/US/partner/docs/switches/lan/catalyst3750/software/release/12.2_50_se/configuration/guide/swlog.html

Hope it helps.

Re: How to log Success and Failed Login Attempt Details to Route

jaesposito — Tue, 30 Mar 2010 19:59:09 GMT

I'm receiving an error when trying to visit that link. Can you copy/paste the instructions into your response? Thanks!

James E

Re: How to log Success and Failed Login Attempt Details to Route

Collin Clark — Tue, 30 Mar 2010 21:04:37 GMT

Sorry about that James, I didn't realize I was logged into CCO. Please try this link-

http://www.cisco.com/en/US/docs/switches/lan/catalyst2960/software/release/12.2_50_se/configuration/guide/swlog.html

Re: How to log Success and Failed Login Attempt Details to Route

jaesposito — Wed, 31 Mar 2010 02:53:50 GMT

Any other specific links to routers? I'd like little to squeeze as much information out of syslog as possible for successful and failed login attempts.

Thanks!

James

Re: How to log Success and Failed Login Attempt Details to Route

cciesec2011 — Wed, 31 Mar 2010 10:55:15 GMT

archive
log config
logging enable
notify syslog contenttype plaintext
hidekeys
logging on
logging 192.168.1.1
login block-for 60 attempts 3 within 60
login on-failure log every 1
login on-success log every 1

Re: How to log Success and Failed Login Attempt Details to Route

Collin Clark — Wed, 31 Mar 2010 13:27:01 GMT

Also take a look at SNMP Authentication traps.

RTR(config)#snmp-server trap authentication ...

How to log Success and Failed Login Attempt Details to Router in

zjnbxsspjm — Thu, 12 Dec 2013 09:00:10 GMT

Are there any similar commands on Nexus? i want to log all attempts to establish a management connection for administrative access to nexus.Thanks

Is it possible to filter only

joearmstg — Thu, 09 Jun 2016 11:55:31 GMT

Is it possible to filter only syslog information relative to the list of this events:

User Authentication
IKE and IPSec
VPN Client
VPN Failover

If yes what will be the best process

Re: Is it possible to filter only

cameron rake — Thu, 10 Mar 2022 07:08:20 GMT

@joearmstg @jaesposito, I had this same problem just yesterday. Please rate the potential solution below if helpful.

This is an answer to the question using automation. See also, my other answer to perform Regex matches manually to filter syslog messages.

! Turn on terminal monitoring to display syslog messages to the terminal

term mon

! Turn on system archive logging.

Re: Is it possible to filter only

cameron rake — Fri, 09 Jul 2021 16:53:29 GMT

Maybe someone would still like an answer to this old question. You can use regular expression (Regex) pattern matching.

For instance you can run the following command to include/exclude/count/begin/section any messages with a keyword in them:

INCLUDE:

show log | include CRYPTO

show log | i OSPF

show int status | i notconnect

INCLUDE MULTIPLE:

Combine multiple options using a pipe "|" symbol to separate them:

EXCLUDE:

show log | exclude ADJCHG

show ip int br | ex una

show int status | e notconnect

START OF LINE:

to show a route that begins with a pattern, begin with the caret symbol (^) which means "beginning of line":

show ip route | i ^O

show ip route | i ^O|^S

show ip route | i ^O|^B|^S

COUNT:

or count a matching criteria - this will count the number of static routes in your route table:

show ip route | count ^S

SECTION:

to see all the indented lines following a matched criteria such as bgp, route-maps, or line commands

show run | section route-map

show run | sec bgp

show run | sec line

BEGIN:

the begin operator works well if the section of configuration is not indented, or you're just looking to start at a general area within your config, or syslog output

show run | begin interface

show run | b banner

show log | b May 16

Regular expression (REGEX) is also useful for matching criteria in route-maps. There are good articles on the internet explaining Regex special characters. Here are a few of the basics.

. = any character

* = any number of times

.* = any character any number of times (basically means anything)

| = or

[0-9] = any single digit matching the numbers 0 through 9.

for instance show log | i Vlan[9][0-9][0-9] matches Vlan900 through 999 in your syslog messages

[a-z,A-Z] = any letter upper or lower case

^ = beginning of line

$ = end of line

^$ = an empty line a.k.a. carriage return (a line that starts and ends without any other characters on that line)

_ = a space

\ = escape (removes special meaning from special characters, or applies special meaning to standard characters)

for instance \$ means match the dollar sign instead of the end-of-line

https://www.cisco.com/c/en/us/td/docs/ios/12_2/dial/configuration/guide/dafaapre.html Cisco Doc on Regex

https://www.rexegg.com/regex-quickstart.html Regex Cheat Sheet

https://packetlife.net/blog/2008/may/10/extracting-bgp-info-regex/ Packet Life BGP Regex Cheat Sheet

https://regexlib.com Regex Library and Test pattern matching tools