Do Cisco Nexus 9000 switches produce traffic logs, and how do we monitor them to index in Splunk?

[BenTan]

Hi,

Pardon me if this sounds like a stupid question, as I have very minimal experiences in switches or networking in general, but currently I am involved in a project trying to collect logs from Cisco Nexus 9000 series switches and so far we can only see configurations logs being sent to the syslog-ng server set up. As configuration changes are rarely done so 95% of the time the syslog-ng server does not receive any logs at all.

We were hoping to see some traffics logs from it and use the Cisco Networks App for Splunk Enterprise for monitoring, but the engineer in charge of the switches told our team that it only logs configuration logs.

I surfed through a couple of posts here and there and found out that people are actually able to monitor traffic logs through switches, so I am a little confused.

Any help would really be appreciated!

[mikaelbje]

Using syslog you'll only be able to monitor the state of the switches. None of the switches allow you to actually output traffic logs, but the Nexus 9k App and Add-on for Splunk will let you show interface statistics. I'm not sure how well this app works as I haven't used it, but give it a shot.

• https://splunkbase.splunk.com/app/1916
• https://splunkbase.splunk.com/app/1897

Regards,
Mikael
Author of the Cisco Networks app

[BenTan]

Hi Mikael,

Thank you so much for your swift reply! How about the ACL? Is it part of the switches configuration?

Regards,
Benjamin

[mikaelbje]

Oh, yeah, if you logs ACLs you will actually get that as traffic data. It's even CIM compliant if you use the Cisco Networks App/Add-On.

Check the Help page in the app for instructions on how to set up your logging correctly.

Please rate/accept helpful answers 🙂

[BenTan]

Alright, I will check it out and see if I can have any breakthrough from there!

Thank you so much! 🙂