Arista Eos

Overview

Arista EOS is the operating system for Arista Networks datacenter and campus switches, including the 7050, 7124, 7280, and 7500 series. EOS generates syslog messages for environmental monitoring, link state changes, routing protocol events, LLDP neighbor discovery, spanning tree transitions, authentication, and access control events.

App Function

Parses Arista EOS switch logs and extracts:

• Environmental monitoring events (system overheat, transceiver alarms)
• Interface state changes (link up/down, line protocol up/down)
• Routing protocol events (BGP, OSPF, ISIS, BFD adjacency changes)
• LLDP neighbor discovery, timeout, and departure events
• Spanning tree topology changes
• IGMP snooping events
• Authentication events (SSH login success/failure)
• ACL permit/deny logging
• MLAG high-availability events
• Port security and DHCP snooping violations

Provides a network overview dashboard and triggers for hardware alarms, routing instability, interface failures, and security events.

Vendor Documentation

• EOS System Event Logging
• EOS Logging of Event Notifications
• EOS Logging Explained

Prerequisites

LogZilla Dedicated Port

Arista EOS switches emit Cisco IOS-format syslog messages (%LINK-3-UPDOWN, %BGP-5-ADJCHANGE, etc.) that are indistinguishable from actual Cisco devices. A dedicated port is required to route these events to the Arista parser instead of the Cisco parser.

1. Navigate to Settings > System > Application Ports
2. Set Arista EOS syslog port to a dedicated port (e.g., 5524)
3. Click Save

Both TCP and UDP listeners are enabled on the configured port.

Arista Switch Configuration

Configure each Arista EOS switch to send syslog to the dedicated port:

1. Access the switch CLI via console or SSH

2. Enter configuration mode:

   text
   Wrap: OnCopyFullscreen
   configure terminal
   

3. Configure syslog server with the dedicated port:

   text
   Wrap: OnCopyFullscreen
   logging host <logzilla-ip> <port> protocol udp
   logging trap informational
   logging facility local0
   logging source-interface Management1
   

   Replace <logzilla-ip> with the LogZilla server IP and <port> with the dedicated port configured in step 1 (e.g., 5524).

4. Save the configuration:

   text
   Wrap: OnCopyFullscreen
   write memory
   

Verification

Generate a link event by toggling an interface (shutdown / no shutdown), then verify events appear in LogZilla with Vendor tag set to Arista.

Incoming Log Format

text
Wrap: OnCopyFullscreen
%<FACILITY>-<SEVERITY>-<MNEMONIC>: <message text>

Example:

text
Wrap: OnCopyFullscreen
%ENVMON-0-SYSTEMOVERHEATWARNING: The system is overheating

Parsed Metadata Fields

High-Cardinality Tags

The following tags are stored on disk due to high cardinality:

• SrcIP - Source IP addresses from auth and ACL events
• Neighbor IP - Routing protocol neighbor IP addresses
• User - Usernames from authentication events

Log Examples

Environmental - System Overheat Warning

text
Wrap: OnCopyFullscreen
%ENVMON-0-SYSTEMOVERHEATWARNING: The system is overheating

Environmental - Transceiver Overheat

text
Wrap: OnCopyFullscreen
%ENVMON-0-XCVR_OVERHEAT_CRITICAL: Xcvr3 temperature critical

LLDP - Neighbor Discovered

text
Wrap: OnCopyFullscreen
%LLDP-5-NEIGHBOR_NEW: LLDP neighbor with chassisId "switch-01"
and portId 0011.2233.4455 added on interface Ethernet2

IGMP Snooping - No Querier

text
Wrap: OnCopyFullscreen
%IGMPSNOOPING-6-NO_IGMP_QUERIER: No IGMP querier detected in
VLAN 910. IGMP report received from 192.0.2.10 on Ethernet48
for 224.0.1.60

Spanning Tree - Interface State Change

text
Wrap: OnCopyFullscreen
%SPANTREE-6-INTERFACE_STATE: Interface Ethernet24 instance Vl50
moving from discarding to learning

Interface - Link Down

text
Wrap: OnCopyFullscreen
%LINK-3-UPDOWN: Interface Ethernet5, changed state to down

Routing - BGP Adjacency Change

text
Wrap: OnCopyFullscreen
%BGP-5-ADJCHANGE: peer 10.0.0.1 (AS 65001) old state Established
event Stop new state Idle

Authentication - Login Success

text
Wrap: OnCopyFullscreen
%SEC_LOGIN-5-LOGIN_SUCCESS: Login Success from 10.1.1.100
user admin vty1

Authentication - Login Failure

text
Wrap: OnCopyFullscreen
%SEC_LOGIN-4-LOGIN_FAIL: Login Fail from 10.1.1.200 user unknown

ACL - Packet Denied

text
Wrap: OnCopyFullscreen
%ACL-6-ACLLOG: list mgmt-acl denied tcp 10.2.2.2(12345) ->
10.3.3.3(80), 1 packet

Dashboards

The Arista EOS Network Overview dashboard provides real-time visibility into switch events including EPS, event class and type distribution, top reporting hosts, interfaces, VLANs, routing neighbors, and a live event stream.

Triggers