Network Assurance · Topic 2 of 7

SNMP and Syslog for Monitoring

Configure and read SNMP v2c and v3 and syslog on IOS XE: community strings, security levels, traps, severity levels, logging hosts and show commands.

5 min

In a nutshell

SNMP uses UDP 161 for polling and UDP 162 for traps. Syslog uses UDP 514.
v1 and v2c use community strings in clear text. v3 adds users, authentication and encryption.
The authPriv level gives both authentication and encryption.

What it is

SNMP and syslog are the two classic ways a device reports its state to a management system.

SNMP lets a manager read values from a device, change some of them and receive alerts. Syslog sends text messages about events, such as an interface going down. SNMP is about structured data and polling, and syslog is about event messages.

How it works

The two protocols use different ports, formats and security models.

SNMP components

Manager: the network management system that polls devices and receives alerts.
Agent: software on the device that answers the manager.
MIB: the Management Information Base, a tree of values that the device exposes.
OID: the object identifier, a dotted number that names one value in the tree.

The agent listens on UDP port 161. Alerts go to the manager on UDP port 162.

SNMP operations

Operation	Purpose
Get	Read one value
GetNext	Read the next value in the tree
GetBulk	Read a large block in one request, in version 2c and later
Set	Change a value
Trap	An unacknowledged alert from the device
Inform	An alert that the manager acknowledges, in version 2c and later

SNMP versions

Version	Security	Notes
v1	Community string, plain text	Oldest, rarely used
v2c	Community string, plain text	Adds GetBulk and inform
v3	User, authentication and optional encryption	The secure choice

A community string works like a shared password that travels in clear text. Read only access is RO, and read and write access is RW.

R1(config)# snmp-server community MONITOR RO 10
R1(config)# access-list 10 permit 10.1.1.100
R1(config)# snmp-server host 10.1.1.100 version 2c MONITOR
R1(config)# snmp-server enable traps

The number 10 at the end of the first command is an access list that limits which managers may poll the device. The snmp-server host line says where traps go, and snmp-server enable traps turns traps on.

SNMPv3

SNMPv3 uses users, and it has three security levels.

Level	Authentication	Encryption
noAuthNoPriv	Username only	No
authNoPriv	Yes	No
authPriv	Yes	Yes

R1(config)# snmp-server group NETOPS v3 priv
R1(config)# snmp-server user ADMIN1 NETOPS v3 auth sha AUTHPASS priv aes 128 PRIVPASS
R1(config)# snmp-server host 10.1.1.100 version 3 priv ADMIN1

The priv keyword in the group means authentication and encryption are both required. The manager must use the same user and keys.

Verifying SNMP

R1# show snmp
R1# show snmp community
R1# show snmp user
R1# show snmp host

show snmp gives counters for requests received and traps sent. If the counters for bad community names rise, a manager is using the wrong string.

Syslog

Syslog messages are sent by UDP port 514 to a server, and they can also be stored on the device. A syslog message looks like this.

*Mar  1 00:10:21.123: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down

The part %LINK-3-UPDOWN has the facility LINK, the severity 3 and the mnemonic UPDOWN.

Severity levels

Level	Name
0	Emergencies
1	Alerts
2	Critical
3	Errors
4	Warnings
5	Notifications
6	Informational
7	Debugging

A lower number is more severe. Setting a level includes that level and all lower numbers. For example, level 4 sends warnings, errors, critical, alerts and emergencies.

Configuring syslog

R1(config)# service timestamps log datetime msec
R1(config)# logging host 10.1.1.50
R1(config)# logging trap informational
R1(config)# logging buffered 16384 informational
R1(config)# logging source-interface Loopback0

The logging trap command sets the level that goes to the server. The logging buffered command keeps messages in memory, and show logging displays them. Timestamps are important, because a message without a time is hard to match to an event.

Using them to diagnose

Syslog tells you what happened and when, such as a neighbour loss or a link flap. SNMP polling shows trends over time, such as interface errors and CPU load. Used together, they let you match an alert in the monitoring system to a log entry on the device.

What to remember for the exam

Eight facts cover most questions on this topic.

SNMP uses UDP 161 for polling and UDP 162 for traps. Syslog uses UDP 514.
v1 and v2c use community strings in clear text. v3 adds users, authentication and encryption.
The authPriv level gives both authentication and encryption.
An inform is acknowledged. A trap is not.
GetBulk and inform came with v2c.
Syslog severity runs from 0 (emergencies) to 7 (debugging).
logging host ADDRESS sends logs to a server, and logging trap LEVEL sets the level.
show logging and show snmp verify the configuration.

Exam tip

For severity, remember that lower numbers are more serious. Level 3 includes levels 0, 1 and 2 as well.

Common mistakes

These four mistakes appear often.

Using v2c where security matters. The community string is sent in clear text.

Reversing the severity scale. Emergencies is 0, and debugging is 7.

Forgetting timestamps. Logs without timestamps are hard to correlate.

Enabling traps without a host. The device has nowhere to send them.

Watch out

A community string of public or private is easy to guess. Choose a hard to guess string and limit managers with an access list.

Check yourself

Work through these three questions.

Which SNMP version offers authentication and encryption?
Version 3 offers both, when the user is set to the authPriv level.
What is the difference between a trap and an inform?
A trap is not acknowledged, and an inform is acknowledged by the manager.
Which syslog severity level is Errors?
Level 3 is Errors.

Topic 2 of 7 in Network Assurance

Test yourself on Network Assurance

The full Cisco CCNP 350-401 ENCOR question bank has 854 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.