How to display the MAC learned by the interface in log and syslog?

  • 1
  • Question
  • Updated 2 years ago
  • Acknowledged
  • 1
Well, I need the ICX 7150 switches to display the MAC address of the device when it's plugged into the switch. I can visualize this with the "show mac-address .." command, but in our company we use log analyzers, such as graylog and splunk, so we send all the logs for consultation. I have experience with Cisco and HP, and in those manufacturers I did not have to configure anything to display this information in the device log.

Photo of Cesar Antonio Nogarolli

Cesar Antonio Nogarolli

  • 3 Posts
  • 0 Reply Likes

Posted 2 years ago

  • 1
2 years ago
Photo of Ben

Ben, Employee

  • 117 Posts
  • 35 Reply Likes
I think you'd likely need to poll this via SNMP
2018-11-07T19:13:12+00:00
Photo of Cesar Antonio Nogarolli

Cesar Antonio Nogarolli

  • 3 Posts
  • 0 Reply Likes
So I enabled the trap functionality on the interfaces, but I found it strange something like that does not come by default. I temporarily made this setting:
mac-age 900 *
 ethernet interface 1/1/1 to 1/1/48
snmp-server enable traps mac-notification

* Mac-age is because we do not have a lot of asset changes in the building, so I've left that MAC time-out.
With this, some MACs are passed on, but still not enough because only some MACs are passed on.

This is the output of the log, when it collects the mac, it is not always:
Nov 7 15: 29: 54: N: MAC-Event: MAC: 0021.b753.e19f-VLAN: 234-PORT: 1/1/40-ACT: 1 :: MAC: 0000.0000.0000-VLAN: 0-PORT : 1/1/15-ACT: 4 :: MAC: 0000.0000.0000-VLAN: 0-PORT: 1/1/15-ACT: 4 :: MAC: d43d.7ec2.0aa1-VLAN: 234-PORT: 1 /1/15-ACT:1::MAC:0000.0000.0000-VLAN:0-PORT:1/1/46-ACT:4 ::

What I could use would be a functionality that would pass all MACs to the end of the range, or, simpler, the MACs directly connected to the interface.

Here are the log settings I've done too. Maybe I did something wrong with this:
logging host 10.69.234.148
logging host 10.69.235.4
logging facility local7
logging persistence
logging cli-command


2018-11-07T20:01:28+00:00
Photo of Ben

Ben, Employee

  • 117 Posts
  • 35 Reply Likes
A trap is something we send out automatically. I don't think you will get the mac-table that way. What I meant is you likely need to do a manual snmp get, walk, etc. to gather that information. The mib guide (can download on support portal) will give you a rundown of what you can poll for. A quick looks show possibly the dotdTp/dot1dTpFdbTable area might be what you are looking for, but some testing would be needed to confirm. 
2018-11-07T20:48:03+00:00
Photo of Cesar Antonio Nogarolli

Cesar Antonio Nogarolli

  • 3 Posts
  • 0 Reply Likes
I understood, but it's not what I need. We're talking about different situations. What I can not do is, enable in the log of the terminal, in loggin, the functionality of indicates which mac is present on the port when it gets UP. Normally, it would be the log before the STP, after the port gets UP, it registers the MAC and then the STP steps until it becomes operational.
2018-11-11T04:34:10+00:00
Photo of Jijo Panangat

Jijo Panangat, Employee

  • 124 Posts
  • 40 Reply Likes
This needs a bit of testing before we can confirm, Could you please open a tac case for evaluating the feasibility.
  • 1

Powered by Get Satisfaction