06-09-2016 09:01 PM
Hello, on our 2960 and 3560 switches we would like to log 'user logon' events i.e. who logs on and when.
What is the best way to do this without incurring too much load on the device e.g. I was thinking of sys-logging 'informational', but then we would generate too many unnecessary events.
Is there any way just to log user logon events ?
Thanks kindly for any information.
06-09-2016 10:55 PM
Hi, with command "logging userinfo" you can track changes of privilege level.
I don´t know command to track user log on.
06-10-2016 04:13 PM
Hello, we have about 100 different Cisco switches. Would it be a good idea to set up TACACS/RADIUS authentication for log on to these switches ? Then we would have records of user logon events which is what we are trying to achieve.
What do you do for backup i.e. if the TACACS/RADIUS server is unreachable, we would need a backup method of switch logon.
Thanks for any info.
06-13-2016 01:52 AM
If you have so many devices then RADIUS/TACACS will be better solution.
But I don´t know to help you with this.
However if you configure tacacs authentication (AAA), you can specify that in case when tacacs server will be unreachable, then switch should use local database (command: username xyz privilege 15 secret xxx).
If tacacs server is available then login from local database will not be accepted by switch.
06-13-2016 06:21 AM
Hi,
a very simple solution would be to enable the global configuration commands
login on-failure log
login on-success log
The syslog severity levels are
Warning (4): %SEC_LOGIN-4-LOGIN_FAILED
Notice (5): %SEC_LOGIN-5-LOGIN_SUCCESS
There is also an option to send SNMP traps to your NMS:
login on-failure trap
login on-success trap
HTH
Rolf
06-13-2016 10:25 PM
Thank you
02-09-2022 06:26 PM
Hi Guys. How to do this for Cisco SG350X which does not run IOS? Thanks!
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide