AristaConfig312 downloads

Arista EOS SNMP & Syslog Monitoring

SNMPv2c and SNMPv3 configuration with trap hosts, syslog remote logging, and event-monitor settings for Arista EOS.

What is it?

Arista EOS monitoring uses three complementary systems: SNMP for polling and traps (NMS integration with PRTG, LibreNMS, Zabbix), syslog for event logs (SIEM integration), and eAPI/streaming telemetry for modern observability (Prometheus, Grafana, CloudVision). All monitoring commands must specify 'vrf MANAGEMENT' on Arista to route through the management interface. Arista also natively supports gNMI streaming telemetry — more efficient than SNMP polling for high-frequency metrics like interface counters.

When to use

·Integrating Arista switches with any NMS (PRTG, Zabbix, LibreNMS, SolarWinds)
·Forwarding logs to a SIEM (Splunk, ELK, QRadar) for security monitoring
·Setting up SNMP traps for BGP state changes, MLAG issues, or interface flaps
·Before deploying — monitoring should be configured alongside the device, not after an incident

When NOT to use

·SNMPv1/v2c in security-sensitive environments — use SNMPv3 with authentication and encryption instead

How it compares

vs Cisco NX-OS SNMP/SyslogBoth require VRF specification for management traffic. NX-OS uses 'snmp-server community X use-vrf management'; Arista uses 'snmp-server vrf MANAGEMENT'. Arista adds 'logging vrf MANAGEMENT' for syslog.

vs Juniper SNMP/SyslogJuniper uses 'set snmp community X' and 'set system syslog host X'. Arista syntax is Cisco-like. Juniper has more granular syslog facility/severity filtering; Arista's is simpler.

Prerequisites

→Management VRF and interface must be configured before monitoring commands work
→NTP must be synchronized — syslog timestamps are meaningless without accurate time
→SNMPv3 requires coordinating auth/priv algorithms and passwords with the NMS before deployment
→Firewall rules must allow UDP 162 (SNMP traps) and UDP 514 (syslog) from the management interface

Config Generator

Hostname *

Management VRF

SNMPv2c Community RO

SNMP Location

SNMP Contact

SNMPv3 Users

SNMP Trap Hosts

Syslog Servers

NTP Server

Verification commands

show snmp

Show SNMP status and packet counters

ExpectedShows enabled status, community strings, and input/output packet counts. Zero counts may indicate NMS not polling.

show logging

Show logging configuration and recent buffered logs

ExpectedShows syslog servers, log level, and last messages. Verify syslog host IP and VRF are correct.

show ntp status

Verify NTP is synchronized before trusting log timestamps

Expected'synchronized' with reference server IP and stratum. Unsynchronized = wrong timestamps in logs.

Debug commands

bash tcpdump -i eth0 udp port 162

Capture SNMP trap traffic on management interface

Common mistakes & fixes

SymptomSNMP NMS cannot poll the device

CauseSNMP not bound to management VRF, or firewall blocking UDP 161

FixVerify 'snmp-server vrf MANAGEMENT' is configured. Test from NMS: 'snmpwalk -v2c -c <community> <mgmt-ip>'. Check ACL on management interface.

SymptomSyslog messages not arriving at server

CauseSyslog host configured without VRF, or wrong IP

FixVerify 'logging vrf MANAGEMENT host <ip>' — the VRF specification is required. Test reachability: 'ping vrf MANAGEMENT <syslog-server-ip>'.

Further learning

Recommended books to go deeper on this topic.

CCNP Enterprise Core ENCOR 350-401 Official Cert Guide

Brad Edgeworth et al. · Cisco Press · Network management: SNMP v1/v2c/v3, syslog levels, NTP, NetFlow

Kindle ↗Hardcover ↗