Cisco IOS SNMP & Syslog Monitoring

Cisco IOS / IOS-XEBeginner

SNMP v2c and v3 configuration with trap hosts, syslog remote logging, and NetFlow/IP SLA stubs for Cisco IOS/IOS-XE.

What is it?

SNMP (Simple Network Management Protocol) lets your NMS (Network Management System) like SolarWinds, PRTG, or Zabbix poll network devices for metrics (CPU, memory, interface stats, errors) and receive trap alerts when events occur. Syslog sends event messages (link up/down, authentication failures, config changes) to a central log server (Splunk, Graylog, ELK). Both are essential for network visibility — without them, you're flying blind when something goes wrong. SNMPv3 is required for production (v2c sends community strings in plaintext).

✓ When to use

·Every production network device should have SNMP and syslog configured — no exceptions
·Before deploying a device to production — monitoring should be configured before, not after, issues occur
·When using a network management platform (SolarWinds NPM, PRTG, Zabbix, LibreNMS)
·For compliance — PCI-DSS, HIPAA, and SOC 2 all require centralized logging of network events

✗ When NOT to use

·SNMPv2c with RW community strings in production — an attacker with the RW community can reconfigure your entire network. Use SNMPv3 or restrict to RO.
·Syslog without NTP — log timestamps are useless for incident correlation if devices have different clocks

How it compares

vs SNMPv2c vs SNMPv3SNMPv2c uses plaintext community strings — anyone on the network can sniff them and poll or write to your devices. SNMPv3 uses authentication (SHA/MD5) and encryption (AES/DES). Always use SNMPv3 in production.

vs Syslog vs SNMP trapsSyslog sends text messages for every event (interface state changes, authentication failures). SNMP traps are structured data messages for specific monitored events. Use both — they complement each other.

vs NetFlow/IPFIXSNMP/syslog tell you WHAT happened and device health. NetFlow tells you WHO is using the network and HOW MUCH bandwidth. Both are needed for full visibility.

Prerequisites

→NTP must be configured and synchronized BEFORE enabling syslog — timestamps are critical for log correlation
→NMS (SolarWinds, PRTG, Zabbix) or syslog server (Splunk, Graylog) must be running and reachable
→SNMPv3 requires pre-configuring the user on the NMS before the router will respond
→Firewall rules allowing: SNMP UDP 161 (polling), UDP 162 (traps), Syslog UDP 514

Config Generator

Hostname *

SNMP Version

SNMPv2c Community RO

SNMPv2c Community RW

SNMP Location

SNMP Contact

SNMPv3 Users

SNMP Trap Hosts

Syslog Servers

Logging source-interface

Log buffer size

Buffer severity

NTP server (optional)

Verification commands

show snmp

Show SNMP statistics and confirm SNMP is active

Expected: Shows input/output packets, traps sent. 'SNMP agent enabled' should appear.

show snmp user

List SNMPv3 users and their auth/priv settings

Expected: Shows username, auth protocol (SHA), priv protocol (AES), and engine ID

show logging

Show current logging configuration and recent syslog messages

Expected: Shows syslog hosts, trap level, and buffered log. Check 'Logging to <IP>' entries.

show ntp status

Verify NTP sync — essential for accurate log timestamps

Expected: Clock is synchronized, stratum should be 2-5. Unsynchronized = your logs will have wrong timestamps.

Debug commands

debug snmp packets

Debug SNMP polling and trap traffic in real time

⚠ Can generate significant output on busy devices. 'undebug all' after troubleshooting.

Common mistakes & fixes

⚡ NMS can't poll the device via SNMPv3

Cause: SNMPv3 user not configured on the device, or auth/priv passwords don't match the NMS config

Fix: Verify the user: 'show snmp user'. Re-create if needed. Match auth algorithm and passwords exactly between router and NMS.

⚡ Syslog messages not appearing on the log server

Cause: Wrong source IP (multi-homed device sending from unexpected interface), or UDP 514 blocked

Fix: Add 'logging source-interface Loopback0' to pin the source IP. Test: 'ping <syslog-server>' from the router. Check firewall rules.

⚡ Log timestamps are wrong or show epoch time

Cause: NTP not synchronized, or 'service timestamps log' not configured

Fix: Verify NTP: 'show ntp status'. Add 'service timestamps log datetime msec localtime show-timezone year' to the config.