User logon events for Cisco SG350X switch

[alchemy]

Hi,

On our SG350X switch we would like to log 'user logon' events i.e. who logs on and when. We know we can use these commands on IOS:

• login on-failure log
• login on-success log

But how about the OS of SG350X? The above does not work on our switch. Thanks!

[balaji.bandi]

not that you get near that commands in 350

looks some command level syntax:

https://www.cisco.com/c/dam/en/us/td/docs/switches/lan/csbms/350xg/cli_guide/CLI_Switch_350.pdf

[alchemy]

Is there no other way to log user sign-in attempts for this model?

Thanks!

[marce1000]

 - I don't think so , remember these small business devices do not offer all security levels and audits that IOS has.

 M.

[Georg Pauwen]

Hello,

try and set the syslog level to 'informational' (chapter 5 of the admin guide linked below). Informational is the level these failure and success login attempts are logged under, similar to the level in full IOS devices...

https://dustinimages.azureedge.net/media/d200001001414170/small-business-sg350-28mp.pdf

[alchemy]

Thanks! This may work, but we are unsure whether Flash Memory can retain sufficient log entries after enabling 'informational'.

Do you know how long log entries are kept? (If not long, we would like to increase the no. of entries kept). Or, is it up to the Flash Memory size limit? If so, is there any log rotation? 

[Georg Pauwen]

Hello,

as far as I understand it, the last 5 log entries are saved in RAM, and all entries (including the entries in RAM) are saved to flash. Annoyingly enough, I could not find any setting to set the size of the file that is used to save the log entiries in flash. The admin guide also doesn't say what happens when the limit in flash is reached, whether logging just stops, or whether the oldest entries are just rotated out...