Quantcast
Channel: THWACK: Message List
Viewing all articles
Browse latest Browse all 20490

Re: ROUTER LOGS

$
0
0

At a bare minimum, you should have your Cisco routers sending syslog data to either Splunk directly or a Syslog server that has Splunk monitoring its logfiles.  This will give you immediate access to various events such as interface up/down.  And, IIRC, Cisco does include some syslog events around things like OSPF adjacency.

 

As joshd suggested, SNMP via a scripted input is a viable path to some of these measurements.  Cisco exposes lots of data via the hundreds of SNMP MIBS supported by IOS.  However, some data is a little more difficult to get at.  Two good examples are latency and "traffic".

 

Concerning latency, typically a router like Cisco 2901 does not know end-to-end latency of a specific path.  This is just not in its area-of-knowledge, and could be difficult for a single router to know given asymmetric routing and other complications.  To accurately measure latency requires something at each site that is actively measuring latency to its peer sites.  Open source projects like SmokePing provide agents to accurately measure latency over a distributed network.  It would take some effort to integrate SmokePing's measuring agents into Splunk, but it is possible.

 

For "traffic" -- I assume you mean you'd like to be able to get a reasonable accounting of the various sources and destinations of packets and the protocols/ports they are communicating on.  Cisco's best tool for this job is usually Netflow.  When configured properly, Cisco routers will send "flow event" records to a Netflow receiver, which can then be plugged in to Splunk.  There is already a Splunk for Netflow app that has been developed to provide the necessary Splunk configs and dashboards for  visualizing Netflow data.


Viewing all articles
Browse latest Browse all 20490

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>