How to log web access

[Marco Albertini]

Hi,

i manage some 2900/2600 switches
and i would like to enable log
of web access attempts to switches.

How can i do that?

[Pieter 't Hart]

I don't think you can select only web access attempts.

the "show logging" command displays the log messages recorded since the last reboot in chronological order.
You can filter on lines containing a string
"show logging "
you may need to set the loging severity as described below.

normally you would setup another system on your network as "syslog server".
syslog daemon originates form unix systems.
so if you got a unix system you allready may have a suitable system.
for windows you can find several (freeware) syslogdaemon software.
next configure the switch to send logging to this server.

logging < syslog-ip-addr >
logging facility < facility-name >
logging severity < major | error l warning | info | debug >

the facility-name must match the setting on the syslog server.
for severity select the level that gives you the information you need.
if severitylevel is too high it gives a big logfile that's difficult to analyze.

some syslog software can store the records in a database where you can search more efficient than in a textfile.
don't forget to clenaup old records.

[Marco Albertini]

Hi Pieter,
thank you for your answer.

I tried both your suggestion (syslog server) and SNMP trap receiver, by enabling :

- logging severity info

- snmp-server host xxx.xxx.xxx.xxx "public" All

but i didn't receive any web access notification (neither "failed" nor "successful")

All other messages are logged correctly and i can also see TELNET or SSH accesses.

The "show logging" command doesn't show anything about web access.
What am i missing ?