cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

438
Views
0
Helpful
2
Replies
lachlanpeters
Beginner

Monitor the creation of monitor sessions

Hi All,

I am needing to find away to monitor if a monitor sessions is created/deleted or change.

Is there anyway that you know of to see that detail

2 REPLIES 2
Panos Kampanakis
Cisco Employee

What platform are you using?

You could monitor for syslog id "302013: Built {inbound|outbound} TCP connection_id..." and "302014: Teardown TCP connection id...".

If you are using an ASA then after version 8.2 you can use netflow to collect connection statistics with a neftlow collector.

I hope it helps.

PK

It is on a switch ( 2960, 3560 and 3750. All IOS at most 1 year old)

I am looking basically if anyone enters "monitor session........" a syslog event is triggered

Lachlan

Create
Recognize Your Peers
Content for Community-Ad

ISE Webinars


Miss a previous ISE webinar?
Never miss one again!

CiscoISE on YouTube