How to monitor certain logs from switch and send mail notification

[thewinner]

Hello all,

After checking the logs from our Cisco switches we found that a lot of them have errors that shouldn't exist.

Namely the most significant of them is "5275471: Jan 23 13:01:56: %IP-4-DUPADDR: Duplicate address 10.x.x.x on VlanXXX, sourced by 5xxx.XXx0.2x3x". 

Could you please tell me if there is a way to monitor similar logs and if they appear to send me a mail notification(twice a day for example)?

The switches are over 100 so is needed the solution to work with multiple devices.

We have Syslog server where all logs are stored.

I was leaning toward using a Linux or PowerShell script but not sure if it will work.

Will be very glad if you help me in any way.

I spent a low of hours without any clear idea of how to deploy it

Probably there is a tool that can achieve my goals...  Looking forward to hearing from you!

[M02@rt37]

Hello @thewinner 

One possible solution is to use a combination of a log monitoring tool like Logwatch or Logcheck, and a scripting language like Python or PowerShell to parse the logs, filter out the relevant events, and send email notifications.

Also, note that some network management tools like Nagios or PRTG also have built-in capabilities to monitor syslog messages and send email notifications. It may be worth investigating these tools to see if they meet your needs.

[Jan Rolny]

Hi thewinner,

you can also use EEM script directly on the routers/switches

I will not make exactly that eem scritp you need right now but You can check some examples here https://www.ciscopress.com/articles/article.asp?p=3100057&seqNum=4

Script will look for that syslog pattern "%IP-4-DUPADDR" and if that will match then action will be triggered and email will be sent to email address you want. There is maybe one drawback this solution has and it is that EEM does not support smtp authentication. So you will need to alow those routers IPs on smtp server.

Best regards,

Jan