Endpoint to see last port activity on MS switches

[RaphaelL]

Hi ,

I have a task to determine the last activity of a 300K switchports eg: The last oper status change ( up / down ). 

I don't see any endpoint to achieve that... I know some sketchy ways to do :

1- Fetch eventlogs and get RSTP / Port Status change event logs. Will take a while

2- Get Network clients , if no clients are seen on the port : the port never went up. Not 100% certain since some clients may not be detected

Any other creative painless way to achieve that ?

[alemabrahao]

Hi, 

Have you ever considered setting up webhooks to capture port status change events in real time and then store these events in a database or logging system?

[RaphaelL]

Yes it is my last resort, these logs are already sent into our SIEM but still a messy solution. 

I also found getOrganizationSwitchPortsUsageHistoryByDeviceByInterval which list data usage for a port but only for the last 31 days. I might just have to start logging every month usage for every port

[alemabrahao]

Oh I get it now. 😊

[PhilipDAth]

This is a snippit of a script I have used that does some of what you are interested in.  It finds ports that have no usage for 30 days.

dashboard = meraki.DashboardAPI('your_api_key', suppress_logging=True)
devices = dashboard.organizations.getOrganizationDevices('your_org_id', total_pages='all')
for device in devices:
    if device['productType'] == 'switch':
        port_statuses = dashboard.switch.getDeviceSwitchPortsStatuses(device['serial'], timespan=(31*24*60*60))
        for port_status in port_statuses:
            port_id = port_status['portId']
            total_usage_kb = port_status['usageInKb']['total']

If total_usage_kb == 0, you could consider the port unused.  You could also use a small threshold for ports that are actually up, but not really in use.

You could also run this every day (with an interval of 24 hours) and record the usage for the last 24 hours.  Then look at the change in usage from the prior day to determine if the port has started/stopped being used.

[RaphaelL]

getDeviceSwitchPortsStatuses is a per device endpoint which is not something I want to go with considering that we have 4500 switches.

I ended up using getOrganizationSwitchPortsUsageHistoryByDeviceByInterval with a timespan of 31 days and a daily interval. 

I don't trust getOrganizationSwitchPortsClientsOverviewByDevice at all because Meraki's definition of clients is somewhat shaky.