Cisco IOS XRConfig438 downloads

Cisco IOS XR SNMP & Syslog Configuration

SNMP v2c and v3 with traps, syslog forwarding, and NetFlow export configuration for Cisco IOS XR routers. Covers NMS integration and operational visibility.

↓ example.txt

What is it?

SNMP and Syslog are the primary operational visibility mechanisms on IOS XR routers. SNMP allows NMS platforms (SolarWinds, PRTG, LibreNMS, Zabbix) to poll router statistics (CPU, memory, interface counters, BGP/OSPF state) and receive asynchronous traps when events occur. IOS XR supports SNMPv2c (community-based) and SNMPv3 (authenticated and encrypted) — SNMPv3 with authPriv is strongly recommended for production. Syslog sends structured log messages to a central SIEM or log aggregator. IOS XR syslog uses the logging command without the ip prefix (unlike IOS), and the source interface should always be Loopback0 for consistent log source identification. Model-driven telemetry (gNMI/gRPC) is the modern complement to SNMP on IOS XR for streaming metrics.

When to use

·Any production router that needs to be monitored by an NMS or SIEM platform
·Service provider environments where BGP, OSPF, and MPLS state changes must be centrally tracked
·Compliance environments (PCI-DSS, SOC2, ISO 27001) requiring centralized logging and change tracking
·NetFlow export to traffic analysis platforms (Scrutinizer, ntopng, Elastic) for capacity planning
·Any deployment where operational teams need real-time alerting on link failures or routing events

When NOT to use

·Isolated lab routers with no NMS — SNMP adds complexity without operational benefit in a lab
·When SNMPv2c is the only option and security policy requires encrypted management — implement SNMPv3 or gNMI instead

How it compares

vs Cisco IOS SNMPIOS XR SNMP syntax drops the ip prefix: use snmp-server host, not ip snmp-server. SNMPv3 user creation syntax differs slightly. OIDs and MIBs are compatible between IOS and IOS XR for standard MIBS.

vs gNMI/gRPC Model-Driven TelemetryModel-driven telemetry (MDT) via gNMI is the modern replacement for SNMP polling on IOS XR. MDT pushes metrics with higher granularity and lower latency. Both can coexist — use SNMP for legacy NMS and MDT for modern observability stacks (Prometheus, Grafana).

vs NetFlow vs IPFIXIOS XR supports NetFlow v9 and IPFIX. IPFIX is the IETF standard (RFC 7011) based on NetFlow v9. Most collectors support both. Use IPFIX for new deployments; NetFlow v9 for legacy collectors.

Prerequisites

→Syslog and SNMP trap receivers must be reachable from the router, either in-band or via the management VRF
→For SNMPv3, the NMS must be configured with matching auth (SHA) and priv (AES128) parameters and the same username
→NetFlow requires sufficient route processor memory — verify with show processes memory on the RP
→Logging source interface (Loopback0) must be up and reachable from the syslog server

Config Generator

Hostname *

SNMP v2c Read-Only Community

SNMP Trap Receivers

SNMPv3 Username

SNMPv3 Auth Password (SHA)

SNMPv3 Privacy Password (AES128)

Syslog Servers

Logging Source Interface

NetFlow Collector IP (optional)

NetFlow Collector UDP Port

Verification commands

show snmp

Verify SNMP is running and show packet counters

ExpectedInput/output packet counters incrementing. No authentication failures shown.

show snmp users

Verify SNMPv3 user is configured with correct auth/priv settings

ExpectedUser listed with authProtocol SHA and privProtocol AES

show logging

View buffered logs and verify syslog configuration

ExpectedRecent log messages visible, syslog destinations listed at top

show flow monitor MONITOR-1 statistics

Verify NetFlow monitor is collecting flows

ExpectedActive and inactive flow counts incrementing

Debug commands

show snmp trap

Show recent SNMP traps generated and sent to receivers

WarningUse to verify trap delivery. If no traps shown, check SNMP trap configuration and receiver reachability.

show flow exporter EXPORTER-1 statistics

Verify NetFlow export packets are being sent to the collector

WarningCheck for export errors — destination unreachable or UDP port mismatch on collector

Common mistakes & fixes

SymptomSNMP polls timing out from NMS

CauseCommunity string mismatch, ACL blocking UDP 161, or source interface not reachable

FixVerify community string matches on NMS. Check ACL permits NMS source IP. Test from Linux: snmpwalk -v2c -c COMMUNITY ROUTER-IP

SymptomSNMPv3 authentication failures in logs

CauseAuth/priv password mismatch or wrong protocol selected on NMS (MD5 vs SHA, DES vs AES)

FixVerify NMS uses SHA for auth and AES128 for priv. Passwords are case-sensitive. Re-create the v3 user if configuration is uncertain.

SymptomSyslog messages not arriving at server

CauseSyslog server IP unreachable or logging source interface down

FixVerify connectivity: ping SYSLOG-SERVER source Loopback0. Check logging source-interface is up. Verify no firewall blocking UDP 514.

Further learning

Recommended books to go deeper on this topic.

CCNP Enterprise Core ENCOR 350-401 Official Cert Guide

Brad Edgeworth et al. · Cisco Press · Network management: SNMP v1/v2c/v3, syslog levels, NTP, NetFlow

Kindle ↗Hardcover ↗