Is it possible to query Cisco switches using a report to show what users log in to them?

We'd like to generate a SolarWinds report to show user accounts on each Cisco switch in our network, and use it to confirm which switches have individual user accounts on them and identify any ‘rogue’ accounts.

Find more posts tagged with

username

cisco

switches

Accepted answers

All comments

dodo123

You don’t ask for much

dodo123

I would look down the universal device poller and get the info into the database then you would be able to report on it.

dodo123

this looks useful www.cisco.com/.../45281-ttyusers2.html

if not used UNDP before some instructions below

https://support.solarwinds.com/SuccessCenter/s/article/Create-a-Universal-Device-Poller-UnDP?language=en_US

simonhan

Thanks Dodo - I'll take a look at the suggestion below. As with alot of things in IT, it was "someone else" who asked for this!

KMSigma.SWI

If you have syslogs enabled and are sending them to Log Analyzer, you can always just look at a report from there. (Just an option)

Seashore

Isn't this something for the "User Device Tracker" module?!? There you can see what device is connected to what port, and if you connect to your domain controller also you see what used logged in on what device - port- switch..

simonhan

That's possible. Unfortunately at the minute we don't have the UDT module. Maybe something to consider.

m_roberts

The Orion NCM module performs a configuration backup of network devices such as Cisco switches. Within this backup is the definition of the local user accounts configured on the device.

Therefore, with this data available in the Orion database, you can then create a report from that data. The report query will be a bit more complex, as the config backup is stored as unstructured data, but would be very achievable.

You will see from the following link, the config backup includes on lines 34 - 36 local user account definitions. The first thing I would do is use the NCM Config Search widget and search for 'username'. This in itself 'may' be all you need.

Therefore, if you have the NCM module in your Orion platform, this will be the easiest way.

KMSigma.SWI

I guess this depends on what you mean for "user accounts."

For the accounts that exist in the configuration on the Cisco Switches themselves (used to log onto the switches to change configuration), then you should be using Network Configuration Manager (NCM). (as @m_roberts indicated)
If you are interested in users connected to the switch (their desktop is plugged into a port on this switch), then User Device Tracker (UDT) is your solution. (as @Seashore stated)
If you are interested in seeing who is connecting to said switch (via Telnet/SSH) to make changes (including failed logons), then your best bet is Log Analyzer which can tag successful and failed login attempts. ( as I stated)
You can also poll the OID to get a list of the accounts with either Network Performance Monitor (NPM) or Server & Application Monitor (SAM) on the devices. (as @dodo123 mentioned)

Long story short, there's an option for you available - you just need to pick the right tool from the toolbox.