Mac Address To Log

[sjacksier]

I need to set up several switches where if a new mac address is added to the mac address table, an entry gets added to the log. I would prefer to not have to use snmp traps, as we only have a syslog server running. Ideally there would not be a log if the device has been seen before, and if this cannot be done with the switches alone, is there a 3rd party solution that isnt thousands of dollars that can accomplish this?

[Jon Marshall]

You can do it with SNMP but it would not meet the requirement of only logging it the one time. 

Personally, depending on how quick you need the information, I would script it and connect to the switches,  get the mac address table and then you can parse it and compare to a previous run etc. 

Jon

[sjacksier]

If i remove the requirement of only one time, would it be possible? and i would need it very quick as we are attempting to setup some kind of network security.

[Jon Marshall]

If your switches support EEM then as Balaji mentions that may be the easiest although never used it myself. 

Jon

[balaji.bandi · Accepted solution]

There are couple of ways, But as suggested how quick the MAC stay and go.

i would use EEM script send mac address table to syslog server as file, then on syslog server do your scrpting how you sort this and store it.

other option as mentioned SNMP polling.