cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
623
Views
0
Helpful
2
Replies

Cisco SG log not capturing source IP of device that fails SNMP Auth

Moxnoc
Level 1
Level 1

We have several Cisco SG series switches and I was wondering if there is any way to capture the source IP of a device that fails SNMP authentication? I see log messages like what I have pasted below. I have the Originator Identifier set to IPv4 Address which I thought would probably capture the source IP for these logs, but it has not. Is there something I am missing or are the logs not capable of capturing the source IP on SNMPAUTHFAIL?

 

Warning %SNMP-W-SNMPAUTHFAIL: Access attempted by unauthorized NMS

2 Replies 2

Hi

  If you failed to see on switch, another option I can see is send switch logs to a syslog server.  The problem is that you need a syslog server to see this log.

 

all-log.JPG

 

syslog-server.JPG

I failed to mention that I do have the remote log server setup and the logs I receive on the remote syslog server are exactly the same as what I see on the device itself. I am getting SNMPAUTHFAIL messages but no source IP address for the device that is causing these.

Review Cisco Networking for a $25 gift card