04-04-2022 11:19 AM
I need to set up several switches where if a new mac address is added to the mac address table, an entry gets added to the log. I would prefer to not have to use snmp traps, as we only have a syslog server running. Ideally there would not be a log if the device has been seen before, and if this cannot be done with the switches alone, is there a 3rd party solution that isnt thousands of dollars that can accomplish this?
Solved! Go to Solution.
04-04-2022 11:36 AM
There are couple of ways, But as suggested how quick the MAC stay and go.
i would use EEM script send mac address table to syslog server as file, then on syslog server do your scrpting how you sort this and store it.
other option as mentioned SNMP polling.
04-04-2022 11:28 AM
You can do it with SNMP but it would not meet the requirement of only logging it the one time.
Personally, depending on how quick you need the information, I would script it and connect to the switches, get the mac address table and then you can parse it and compare to a previous run etc.
Jon
04-04-2022 11:34 AM
If i remove the requirement of only one time, would it be possible? and i would need it very quick as we are attempting to setup some kind of network security.
04-04-2022 11:42 AM
If your switches support EEM then as Balaji mentions that may be the easiest although never used it myself.
Jon
04-04-2022 11:36 AM
There are couple of ways, But as suggested how quick the MAC stay and go.
i would use EEM script send mac address table to syslog server as file, then on syslog server do your scrpting how you sort this and store it.
other option as mentioned SNMP polling.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide