however, this would cause aggressive polling which might impact the CPU:Įvent-handler MAC-MON trigger on-counters We could overcome this limitation to some extent by reducing the timer to ensure syslogs are generated more frequently.
#Syslog software for mac mac#
However, if there are multiple MAC address table changes within those 20 secs then the event-handler would only be able to log the last (latest) modified MAC address.
With current configuration, event-handler triggers once in every 20 seconds and logs the last (latest) changed MAC address from even-monitor output. Switch# show logging | grep -i EVENT-HANDLER -B 1 Aug 14 05:58:20 Switch EventMgr: %SYS-6-EVENT_TRIGGERED: Event handler MAC-MON was activated Aug 14 05:58:21 Switch EVENT-HANDLER: detected a MAC table change: 05:57:47.108372|1|7483.ef73.5c59|Ethernet1|learnedDynamicMac| added|21 delay 0 Aug 14 06:00:20 Switch EventMgr: %SYS-6-EVENT_TRIGGERED: Event handler MAC-MON was activated Aug 14 06:00:21 Switch EVENT-HANDLER: detected a MAC table change: 05:59:53.689785|1|7483.ef73.5c59|Ethernet50/1|learnedDynamicMac| added|22 delay 0 Aug 14 06:05:20 Switch EventMgr: %SYS-6-EVENT_TRIGGERED: Event handler MAC-MON was activated Aug 14 06:05:21 Switch EVENT-HANDLER: detected a MAC table change: 06:04:41.568105|1|7483.ef73.5c59|Ethernet50/1|learnedDynamicMac| removed|23 delay 0 Switch# show mac address-table Mac Address Table - Vlan Mac Address Type Ports Moves Last Move - Total Mac Addresses for this criterion: 0 Once MAC 7483.ef73.5c59 expires, system would remove the MAC from the table and log the following message: Switch# show logging | grep -i EVENT-HANDLER -B 1 Aug 14 05:58:20 Switch EventMgr: %SYS-6-EVENT_TRIGGERED: Event handler MAC-MON was activated Aug 14 05:58:21 Switch EVENT-HANDLER: detected a MAC table change: 05:57:47.108372|1|7483.ef73.5c59|Ethernet1|learnedDynamicMac| added|21 delay 0 Aug 14 06:00:20 Switch EventMgr: %SYS-6-EVENT_TRIGGERED: Event handler MAC-MON was activated Aug 14 06:00:21 Switch EVENT-HANDLER: detected a MAC table change: 05:59:53.689785|1|7483.ef73.5c59|Ethernet50/1|learnedDynamicMac| added|22 delay 0 Switch# show mac address-table Mac Address Table - Vlan Mac Address Type Ports Moves Last Move - 1 7483.ef73.5c59 DYNAMIC Et50/1 2 0:00:02 ago Total Mac Addresses for this criterion: 1 Now if this MAC address 7483.ef73.5c59 moves to Ethernet50/1, switch would log the following message: Switch# show logging | grep -i EVENT-HANDLER -B 1 Aug 14 05:58:20 Switch EventMgr: %SYS-6-EVENT_TRIGGERED: Event handler MAC-MON was activatedĪug 14 05:58:21 Switch EVENT-HANDLER: detected a MAC table change: 05:57:47.108372|1|7483.ef73.5c59|Ethernet1|learnedDynamicMac| added|21 delay 0 Once the switch learns a MAC address it would log the following message: Switch# show mac address-table Mac Address Table - Vlan Mac Address Type Ports Moves Last Move - 1 7483.ef73.5c59 DYNAMIC Et1 1 0:00:02 ago Total Mac Addresses for this criterion: 1 Once even-handler is configured and event-monitor is activated, switch would generate a Syslog whenever a MAC address is added, removed or experiences move: MAC LearningĬurrently there are no event-handler logs on the switch: Switch# show logging | grep -i EVENT-HANDLER -B 1 Switch(config)#show run sec event-handler event-handler MAC-MONĪction bash a=$(printf 'show event-monitor mac' | FastCli -p 15 | tail -n 1) logger -p CRIT -t EVENT-HANDLER detected a MAC table change: $ delay 0 Device-health Action: None Action expected to finish in less than 10 seconds Total Polls: 1 Last Trigger Detection Time: 2 seconds ago Total Trigger Detections: 1 Last Trigger Activation Time: 2 seconds ago Total Trigger Activations: 1 Last Action Time: Never Total Actions: 0
The script would poll for ‘ show event-monitor mac’ output and generate a log for the modified MAC address entry (addition, removal or mac moves): Switch(config)# Switch(config)# event-monitor Switch(config)#Ģ) Configure an event handler script to generate syslog for mac-address changes.
#Syslog software for mac how to#
The following shows how to configure the event monitor and event-handler for generating syslog messages for each mac address entry learnt or removed from the eventmon database.ġ) First of all, enable the event monitor on the switch with the help of command event-monitor. This feature is supported on all platforms.
0 kommentar(er)
