Cisco SNMPv3 Authfail - Can it log username?

Question

I'm wondering if it's possible to receive the username that failed a login attempt with snmp logging on a Cisco ML card. Can SNMPv3 do this, and if so, what would be the command to enable it?

Thanks!

Answer 1

If you're running version 12.3(4)T or higher you can use the command login on-failure trap

Router(config)#login on-failure trap ?
  every  Periodicity for logs/traps generated
  <cr>

This is what I show on a wireshark capture:

LOGIN_FAILED0....+......).........Login failed [user: test] [Source: 210.10.0.2] 
[localport: 23] [Reason: Login Authentication Failed - BadUser]

http://www.cisco.com/en/US/docs/ios/12_3t/secur/command/reference/sec_k1gt.html#wp1180994