Catalyst Script to Extract Flow Data

[pandreozzi]

My question is around extracting flow data from some legacy Cisco 3750 and 3550 switches with layer 3 images.

Netflow is not supported on these devices and I don't think you can create an event option that triggers logging to send this data to a syslog server.

So my question is this.

Can a script be created that runs in the background that will collect this info and forward to a syslog server remotely configured.

All responses are greatly appreciated.

Paul

[balaji.bandi]

Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)

config t

!

Logging buffered debug

logging buffered xxxx (deprends the value you need)

!

end

test and advise.

Note : this will have high impact on the device. so keep monitor

[Seb Rupik · Accepted solution]

!
logging buffered debug
logging buffered 16000
!

... don't run it for long at that log level

As for your solution, agreed you are going get some useful info out of it, but these hits are all stateless, you will need some pivot-table-fu to aggregate them back into flows. Even then, you will be missing useful datapoints such as packet sizes and therefore total data transferred.

cheers,

Seb.

[pandreozzi]

Thanks Seb