SNMP and Syslog configuration

A real-life situation

On Monday morning users say the link to the server site was slow all weekend. Nobody noticed, because nobody was logged in to R1. You want two things: a graph of the link's traffic and CPU over time, and an alert the moment an interface goes down. You also want every log message from R1, R2 and SW1 kept in one place, not lost when a router reloads. SNMP gives you the graphs and the alerts. Syslog gives you the central log. In the lab, SRV1 (192.168.20.10) runs both the monitoring software and the Syslog server.

The ideas behind both are in SNMP and Syslog. This lesson configures them on Cisco IOS.

What SNMP is

SNMP (Simple Network Management Protocol) has two sides. The manager (also called the NMS, network management station) is software on a server. The agent runs on each router and switch. The agent keeps values such as interface counters and CPU load in a MIB (Management Information Base). Each value has an OID (object identifier), a numbered path such as 1.3.6.1.2.1.1.5.0 for the device name.

SNMP versions

A community string is a shared password. A read-only (RO) community allows Get only; a read-write (RW) community also allows Set. SNMPv3 has three security levels:

• noAuthNoPriv: username only (keyword noauth).
• authNoPriv: messages are authenticated with a hash such as SHA (keyword auth).
• authPriv: authenticated and encrypted, for example with AES (keyword priv). This is the one to use.

What Syslog is

Every Cisco device writes log messages: an interface went down, someone logged in, OSPF lost a neighbour. By default they go to the console and a memory buffer, and are lost on reload. Syslog sends a copy to a server over UDP 514. Each message looks like this:

*Oct  6 14:22:31.418: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down
*Oct  6 14:22:32.418: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down

Severity runs from 0 (worst) to 7. When you choose a level, you get that level and every lower number.

A memory aid for the order 0 to 7: "Every Awesome Cisco Engineer Will Need Ice cream Daily".

Why it works that way

SNMP polling and traps solve different problems. Polling every few minutes builds history (graphs, trends) but is slow to notice a failure. Traps are instant but say nothing about normal behaviour. Most networks use both. Syslog is plain text and easy for people to read and search, which is why it is used for events, while SNMP is better for numbers.

Both use UDP. A device that is losing a link can still fire off a message without setting up a connection. The price is that a message can be lost, which is why informs exist and why logs are also kept in the local buffer.

How it works step by step

How to configure SNMP on Cisco IOS

⚠️ Based on Cisco IOS / IOS XE documentation, not run on a lab device. Community strings and passwords here are examples; never use "public" or "private".

SNMPv2c

SNMPv3

How to configure Syslog on Cisco IOS

Full example (R1)

How to verify it

R1#show logging
Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)
...
    Console logging: level warnings, 14 messages logged, xml disabled,
                     filtering disabled
    Monitor logging: level informational, 0 messages logged, xml disabled,
                     filtering disabled
    Buffer logging:  level debugging, 52 messages logged, xml disabled,
                    filtering disabled
...
    Trap logging: level informational, 56 message lines logged
        Logging to 192.168.20.10  (udp port 514, audit disabled,
              link up),
              56 message lines logged,
...
Log Buffer (16384 bytes):

000049: Oct  6 14:22:31.418 CET: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down

R1#show snmp user
User name: nmsadmin
Engine ID: 800000090300AABBCC000100
storage-type: nonvolatile        active
Authentication Protocol: SHA
Privacy Protocol: AES128
Group-name: NMS-GROUP

R1#show snmp host
Notification host: 192.168.20.10	udp-port: 162	type: trap
user: nmsadmin	security model: v3 priv

show snmp shows packet counters, such as how many requests arrived with a bad community name, which is a quick way to spot a mismatch.

What goes wrong and how to troubleshoot it

• The manager can't poll the device. The community or v3 password differs, the ACL on the community or group doesn't permit the manager's address, or a firewall blocks UDP 161. show snmp counters for "bad community names" point to the first.
• No traps arrive. snmp-server enable traps or snmp-server host is missing, or UDP 162 is blocked on the way.
• The Syslog server sees nothing. Check show logging for the host line, ping the server from the source interface, and look for ACLs blocking UDP 514.
• Important messages are missing. The trap level is set too low a number. logging trap errors (3) drops the %LINEPROTO-5 messages.
• Timestamps don't line up between devices. NTP is not configured or not synchronised.

Common mistakes

• Thinking a higher severity number means more serious. 0 is the worst; 7 is debug.
• Forgetting that a level includes every lower number: logging trap 4 sends 0 to 4.
• Using an RW community without an ACL, or the defaults "public" and "private".
• Wondering why logs don't appear over SSH: terminal monitor is needed in each session.
• Mixing up the ports: SNMP polls on UDP 161, traps on UDP 162, Syslog on UDP 514.

💡 Exam tip: the CCNA asks you to explain SNMP and to describe the use of Syslog features including facilities and levels. Memorise the eight severity names in order, and that choosing a level includes all lower numbers. Know Get/Set/Trap/Inform, which versions use communities and which use users, and that only v3 encrypts. Ports 161, 162 and 514 come up often.

Key takeaways

• SNMP: the manager polls the agent (UDP 161); the agent sends traps or informs (UDP 162).
• v1 and v2c use clear-text community strings (RO/RW); v3 uses users with auth and priv.
• Syslog sends log messages to a server on UDP 514; format %FACILITY-SEVERITY-MNEMONIC.
• Severities 0 (emergencies) to 7 (debugging); a configured level includes all more serious ones.
• Configure with logging host and logging trap; verify with show logging.

Check yourself