topic Re: Syslog Server in Network Security

Syslog Server

Lake — Fri, 21 Feb 2020 14:54:27 GMT

Hi Guys,

I would like to configure our ASA firewall to send all it's logs to a syslog server. Does anyone know of a good syslog server which I can use? Any help would be greatly appreciated.

Thanks,

Lake

Re: Syslog Server

Seb Rupik — Wed, 06 Dec 2017 09:05:23 GMT

Hi there,

At the most simple end of the spectrum, just configure a syslog service on a BSD/ Linux box. This setup would require a little effort to search and parse the logs once collected.

At the other end take a look at graylog: https://www.graylog.org/ . This is slightly more complicated to setup, but search the logs is a breeze!

...both are free and should provide you with what you need.

cheers,

Seb.

Re: Syslog Server

Lake — Thu, 07 Dec 2017 16:44:17 GMT

Thank you very much.

Re: Syslog Server

Patrick.Bryant — Wed, 13 Dec 2017 18:24:54 GMT

Please confirm my conclusion: although a USB drive can be mounted on the ASA 5506W-X firewall as "disk1:", there is no way to redirect syslog to this device?

If that's true, it's a real bummer since we are using the firewall in the field (outside a data center) and it means we will have to drag another box along with us. Sending syslog to a remote server isn't an option since Internet connectivity isn't continuous.

Re: Syslog Server

Seb Rupik — Wed, 13 Dec 2017 20:16:12 GMT

There is another option for your situation, use the logging flash-bufferwrap command. This will save the existing buffer before it begins to be overwritten with new logs, to the internal flash.

You could then use a script to periodically scrap these .TXT files off the ASA and delete them when completed.

Your next challenge would to then inject these logs into your syslog server...?

cheers,

Seb.

Re: Syslog Server

Lake — Thu, 21 Dec 2017 14:34:15 GMT

Thanks Seb