topic Re: Any way to have ASA "debug" commands stay on? in Network Security

Any way to have ASA "debug" commands stay on?

thomasdzubin — Mon, 11 Mar 2019 12:19:22 GMT

ASA v8.03: I've noticed that if I turn on various debug commands (eg: "debug crypto isakmp sa"), they seem to be automatically turned off when I exit my SSH session. Is there any way to keep them persistent between sessions? Cisco routers (IOS) keep debug settings after I exit.

Basically I'm looking for a rare occurrence in my debug logs, but I don't want to stay logged in all the time.

Re: Any way to have ASA "debug" commands stay on?

tstanik — Mon, 24 Mar 2008 21:24:29 GMT

This is not possible since a command is run for that specific instance of the SSH session. When the session is terminated the command is also terminated.

Re: Any way to have ASA "debug" commands stay on?

abinjola — Mon, 24 Mar 2008 21:29:18 GMT

send them to your log server

log debug-trace

Re: Any way to have ASA "debug" commands stay on?

thomasdzubin — Mon, 24 Mar 2008 21:44:51 GMT

I just find it odd that I can SSH into a *router* (IOS) and the debug stays on even when I terminate the SSH session. Yeah, I know the PIX/ASA firewalls and IOS routers are different products that work different, but it would be nice to have debug consistency

Re: Any way to have ASA "debug" commands stay on?

thomasdzubin — Mon, 24 Mar 2008 21:45:28 GMT

Yes, that's what I finally ended up doing. Thanks

Re: Any way to have ASA "debug" commands stay on?

malkhati — Tue, 28 Jul 2020 22:07:08 GMT

We have to use the command "logging debug-trace persistent" and then input the debugs we want to run, because if we had the debugs applied before that command, those debugs will not persist after ending the session.

To confirm that you debugs will remain after ending the session , use the command "show debug" and look for the "persistent" keyword , as the below example :

debug aaa shim enabled at level 255
debug aaa shim enabled at level 255 (persistent)
debug webvpn enabled at level 255
debug webvpn enabled at level 255 (persistent)
debug webvpn xml enabled at level 255
debug webvpn xml enabled at level 255 (persistent)
debug webvpn anyconnect enabled at level 255
debug webvpn anyconnect enabled at level 255 (persistent)

Re: Any way to have ASA "debug" commands stay on?

lukasl1991 — Thu, 29 Feb 2024 15:29:46 GMT

Unfortunately, the persistent debug doesn't work in 9.9(2)80 anymore. logging debug-trace persistent is quite useless when all debuggers won't. Do you have information on that?

Re: Any way to have ASA "debug" commands stay on?

MHM Cisco World — Thu, 29 Feb 2024 16:05:26 GMT

This old post

Make new one it is better

MHM