M A G N U M 6 K S W I T C H E S , M N S - 6 K U S E R G U I D EOnce port security is setup, it is important to manage the log and review the log often. If thesignals are sent to the trap receiver, the traps should also be reviewed for intrusion and otherinfractions.Syslog and LogsLogs are available on MNS-6K as well as MNS-6K-SECURE. Syslog functionalityis a feature of MNS-6K-SECURE.All events occurring on the Magnum 6K family of switches are logged. These logs are incompliance with the definitions of RFC 3164, though not all the nuances of the syslog areimplemented as specified by the RFC. As to what is done with each individual message, toquote the RFC, it will depend on individual companies policies.“ An administrator may want to have all messages stored locally as wellas to have all messages of a high severity forwarded to anotherdevice. They may find it appropriate to also have messages from aparticular facility sent to some or all of the users of the device anddisplayed on the system console.However the administrator decides to configure the disposition of theevent messages, the process of having them sent to a syslog collectorgenerally consists of deciding which facility messages and whichseverity levels will be forwarded, and then defining the remotereceiver. For example, an administrator may want all messages thatare generated by the mail facility to be forwarded to one particularevent message collector. Then the administrator may want to have allkernel generated messages sent to a different syslog receiver while,at the same time, having the critically severe messages from thekernel also sent to a third receiver. It may also be appropriate tohave those messages displayed on the system console as well as beingmailed to some appropriate people, while at the same time, being sentto a file on the local disk of the device. Conversely, it may beappropriate to have messages from a locally defined process onlydisplayed on the console but not saved or forwarded from the device.In any event, the rules for this will have to be generated on thedevice. Since the administrators will then know which types ofmessages will be received on the collectors, they should then makeappropriate rules on those syslog servers as well.” – RFC 3164The events can be as shown below96
