350-401 Question #1016: Real Exam Question with Answer & Explanation

Question

Which configuration filters out DOT1X messages in the format shown below from being sent toward Syslog server 10.15.20.33? Nov 20 13:47:32/553 %DOT1X-5-FAIL:Authentication failed for client (e04f.438e.de4f) on interface Gi1/0/1 AudtiSessionID 0A0B50A5000004543910739E

Options

• Alogging discriminator DOT1X facility drops DOT1X
• Blogging discriminator DOT1X msg-body drops DOTX
• Clogging discriminator DOT1X mnemonics includes DOTX
• Dlogging discriminator DOT1X mnemonics includes DOT1X

Explanation

The question asks for the correct logging discriminator configuration to filter out syslog messages that contain specific text related to DOT1X authentication failures.

Common mistakes.

• A. The facility keyword filters based on the syslog facility code (e.g., LOCAL7, USER), not on the message content 'DOT1X'.
• C. The mnemonics keyword filters based on the mnemonic code (e.g., FAIL), not on 'DOTX', and includes would retain messages rather than drop them.
• D. The mnemonics keyword filters based on the mnemonic code (e.g., FAIL), not on 'DOT1X', and includes would retain messages rather than drop them.

Concept tested. Cisco IOS logging discriminator configuration for syslog

Reference. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/esm/configuration/15-mt/esm-15-mt-book/esm-syslog-logging-disc.html

No community discussion yet for this question.