Logging on Cisco routers

[Mmiselo]

Good day,

I have configured logging on our Cisco routers as below,

logging on
logging trap 6
logging host *.*.*.*
service timestamps debug datetime localtime show-timezone msec
service timestamps log datetime localtime show-timezone msec

The logs are sent to a Syslog server.

Is there a way that we can make logging more aggressive so we can get more details on the events occurring on the router?

The only information we are getting is when an interface status has changed from up or down.

Regards

Nelson

[Johannes Botha · Accepted solution]

You could try the following config on your router. It will allow you to see what commands have been entered. Another way todo it is to enable tacacs login/accounting on the router.

archive

 log config

  logging enable

  notify syslog contenttype plaintext

  hidekeys

!

*Feb 20 06:30:01.771: %PARSER-5-CFGLOG_LOGGEDCMD: User:console  logged command:notify syslog 

*Feb 20 06:30:45.943: %SYS-5-CONFIG_I: Configured from console by console

*Feb 20 06:35:45.517: %PARSER-5-CFGLOG_LOGGEDCMD: User:console  logged command:ntp server 10.1.1.1

*Feb 20 06:36:10.805: %PARSER-5-CFGLOG_LOGGEDCMD: User:console  logged command:username test secret *

*Feb 20 06:36:10.805: %PARSER-5-CFGLOG_LOGGEDCMD: User:console  logged command:!config: USER TABLE MODIFIED

*Feb 20 06:36:28.856: %PARSER-5-CFGLOG_LOGGEDCMD: User:console  logged command:no username test

*Feb 20 06:36:38.221: %SYS-5-CONFIG_I: Configured from console by console

[Mmiselo]

Thanks Johannes!

Is there a way we can log traffic that is allowed through the router? Sometimes when the router hangs or locks remote sessions, we can't see anything on logs to help us identify the cause of the problem.

On the firewall, logging works like a charm because we can configure specific message id's.

[Johannes Botha]

You can do debug ip traffic but i wouldn't recommend it. its will kill your router if there is alot of traffic passing thru it

[Mmiselo]

That means logging is limited on cisco routers.One should maybe consider other network tools to be able to log allowed traffic to a server.

[Mmiselo]

Thank you very much for your advice!

[Cisco Freak · Accepted solution]

Any traffic which is passing through the router will NOT be shown in the debug commands. Only CPU switched packets will be show in the debug output. Any traffic that is destined towards the router is CPU switched and it will be shown in the debug output. And some other special types of packets are always CPU switched.

Most of traffic passing through the router is CEF switched. If you turn off CEF in the router, it will show the details of the entire packets which is passing through. But its NOT recommended.

CF