Determining switchport usage

[morrisrob]

In an effort to consolidate C3850 switches (ver 16.12.11) , I am looking at log messages to determine ports that have been active in the past two months. I have very little scripting background but is looking for a script to search throught the syslog messaged for up/down stats on all the ports on a switch and compile a report.

[Jonatan Jonasson]

With every environment being a little bit different, you might not find a script that works perfectly for you, but could use some adjustments. 

For example, since you mention a couple of months back in time, can I safely(?) assume that you're sending all the logs to a central syslog server?
If not: we're relying on the syslog buffer that might not cover this time period. (and is cleared at restart).
If yes: how are the logs managed? Is it in a single big file, or separate file per day, or per device, or both, etc?

Keep in mind that any ports that has not changed (either up or down) in the last 2 months, is then not going to be a part of the report.
So you would need manual work on top to identify ports that were either consistently down or up during that timeframe.

But before going down this route, consider other ways:

1. If you don't need the data now, but after two months, you could clear all counters now and periodically see which counters have changed.
2. If your switches are being monitored, for example by Solarwinds/Orion, LibreNMS or something similar, chances are you are already monitoring the bandwidth on the ports, so potentially you could just look at the graphs to see which ports had (or did not have) any traffic in the last two months.
3. If you do a show interface on any of the currently-down ports and look at the "Last input" line, it might include a timestamp that could help you identify when it was last used.
   1. Example:
      1. Last input 1y10w, output 00:00:00, output hang never <- not been in used for a while
      2. Last input 07:55:58, output 07:46:36, output hang never <- was in use this morning

If you're adventurous, this could be a good example for any of the AI LLMs (ChatGPT or similar).
For example, pasting 2-3 lines of LINEPROTO-5-UPDOWN logs into ChatGPT and ask for a python script that would read a log file and create a summary based on when the latest event for a port.
(If you have all the logs in one big single log file)

[Leo Laohoo]

From a high-level overview, use the command "sh interface counters".  Eliminate all the ports with 0 utilization.  

Any port worth taking a look, use the following command:  sh interface PORT | include Last input

We use a 3rd party NMS server which can give us an audit of ports not used for X amount of days.