Monitoring (SNMP/Syslog/SPAN)
Relevant for:Professional ServicesEnterprise / NetOps
Where to find itCanvas→Select a device→Monitoring tab
SNMP#
v2c communities (with optional ACL), or v3 groups/users with auth+priv, trap/inform receivers, a source interface, and location/contact. Site-inheritable like the rest of the management plane.
Why
Prefer SNMPv3 (auth + priv) anywhere the network crosses trust boundaries — v2c communities travel in cleartext. If v2c must stay, bind an ACL to the community and treat the string as a credential.
Syslog#
Why
Off-box logging is the difference between diagnosing an outage and guessing: when a device dies, its local buffer dies with it. Ship to at least one collector, and keep timestamps trustworthy with the NTP settings from the Management tab.
SPAN / port mirroring#
Where to find itCanvas→Select a switch or router→Monitoring tab→SPAN Sessions
Mirror traffic from a source interface to a destination interface for packet capture. Each session sets an id (auto-numbered, overridable), the source with a direction (rx / tx / both), the destination (where the analyzer plugs in), and an enable toggle — a disabled session is kept in the design and rendered inert. Validation flags duplicate ids, source = destination, a destination reused as a source, per-platform session ceilings (NX-OS 32, ArubaOS-CX 4), and mirroring an uncabled port. Fabric-managed (AVD) devices don't render SPAN.
Why
SPAN is how you see what the wire actually carries — troubleshooting one-way audio, verifying a firewall really drops what policy says, or feeding an IDS. Mirroring
bothdirections of a busy port can exceed the destination's capacity and silently drop mirrored frames; mirror the narrower direction when you only need one side of the conversation.