Showing results for 
Search instead for 
Did you mean: 

How to display the MAC learned by the interface in log and syslog?

New Contributor II
Well, I need the ICX 7150 switches to display the MAC address of the device when it's plugged into the switch. I can visualize this with the "show mac-address .." command, but in our company we use log analyzers, such as graylog and splunk, so we send all the logs for consultation. I have experience with Cisco and HP, and in those manufacturers I did not have to configure anything to display this information in the device log.


I think you'd likely need to poll this via SNMP
Ben Beck, RCNA, RCNI, Principal Technical Support Engineer

So I enabled the trap functionality on the interfaces, but I found it strange something like that does not come by default. I temporarily made this setting:
mac-age 900 *
 ethernet interface 1/1/1 to 1/1/48
snmp-server enable traps mac-notification

* Mac-age is because we do not have a lot of asset changes in the building, so I've left that MAC time-out.
With this, some MACs are passed on, but still not enough because only some MACs are passed on.

This is the output of the log, when it collects the mac, it is not always:
Nov 7 15: 29: 54: N: MAC-Event: MAC: 0021.b753.e19f-VLAN: 234-PORT: 1/1/40-ACT: 1 :: MAC: 0000.0000.0000-VLAN: 0-PORT : 1/1/15-ACT: 4 :: MAC: 0000.0000.0000-VLAN: 0-PORT: 1/1/15-ACT: 4 :: MAC: d43d.7ec2.0aa1-VLAN: 234-PORT: 1 /1/15-ACT:1::MAC:0000.0000.0000-VLAN:0-PORT:1/1/46-ACT:4 ::

What I could use would be a functionality that would pass all MACs to the end of the range, or, simpler, the MACs directly connected to the interface.

Here are the log settings I've done too. Maybe I did something wrong with this:
logging host
logging host
logging facility local7
logging persistence
logging cli-command

A trap is something we send out automatically. I don't think you will get the mac-table that way. What I meant is you likely need to do a manual snmp get, walk, etc. to gather that information. The mib guide (can download on support portal) will give you a rundown of what you can poll for. A quick looks show possibly the dotdTp/dot1dTpFdbTable area might be what you are looking for, but some testing would be needed to confirm. 
Ben Beck, RCNA, RCNI, Principal Technical Support Engineer

I understood, but it's not what I need. We're talking about different situations. What I can not do is, enable in the log of the terminal, in loggin, the functionality of indicates which mac is present on the port when it gets UP. Normally, it would be the log before the STP, after the port gets UP, it registers the MAC and then the STP steps until it becomes operational.