topic Re: ASA syslog issues in Network Security

ASA syslog issues

James Lytle — Thu, 16 Feb 2023 22:51:06 GMT

Seems I'm having some issues configuring the syslog output correctly.

My config is as follows:
PPOK-EC-FW-2# sho run logging
logging enable
logging timestamp
no logging hide username
logging list vpn level warnings
logging list vpn message 722022
logging list vpn message 722023
logging buffer-size 8092
logging console warnings
logging monitor errors
logging buffered vpn
logging trap warnings
logging asdm warnings
logging from-address EC2.ASA@ppok.com
logging recipient-address firewalladmin@ppok.com level alerts
logging facility 21
logging device-id ipaddress inside
logging host inside x.x.x.x
logging permit-hostdown
logging class auth trap informational
logging class vpdn trap informational
logging class vpn trap informational
logging class vpnc trap informational
logging class webvpn trap informational
logging class svc trap informational

i am only interested in receiving levels 0-4 and the specific 2 level 6 messages. however, i am seeing quite a few extra level 6 messages that i need to eliminate. when i remove the logging class commands, i stop receiving all the extra messages, as well as 722022. then i'm stuck only getting the 722023 message and levels 0-4. any thoughts? i'm not sure what is going on, it's odd that i have to have those extra messages.

TIA

Jay

Re: ASA syslog issues

balaji.bandi — Thu, 16 Feb 2023 23:10:23 GMT

what extra messages do you have as an example?

check the message list with priority:

https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/messages-listed-by-severity-level.html

logging facility 21 ( so amend the correct facility to get all the output)

Cisco FW shows it as 16-23 and the same are interpreted as 0-7 by syslog server

16 = Local0 on syslog

17 = Local1 on rsyslog

18 = Local2 on syslog

19 = Local3 on syslog

20 = Local4 on syslog

21 = Local5 on syslog

22 = Local6 on syslog

23 = Local7 on syslog

Re: ASA syslog issues

James Lytle — Fri, 17 Feb 2023 02:12:07 GMT

I'm seeing multiple level 6 messages other than 722022 and 722023. Currently, I'm seeing 722055, 716002, 716038, 716058, 716059, 113012, 716002, 113008, 611101, 113009 and 113039. There may be more unless I missed it. These extra messages amount to quite a few extra messages per day, filling the syslogs with messages that are basically being ignored.

Re: ASA syslog issues

MHM Cisco World — Fri, 17 Feb 2023 09:19:00 GMT

Cisco ASA Syslog Simplified (packetswitch.co.uk)

there are some solution check each one
1-

no logging message 722055 716002

2-
using message class
3-
using logging list

Re: ASA syslog issues

James Lytle — Fri, 17 Feb 2023 12:11:05 GMT

Okay. I'll try option #1. I'm already using option #2 and #3. If I remove the message class statements, it corrects some of the issue, but then I stop getting the 722022 messages and only receive the 722023. However, all the other messages stop coming in as well, so that's a partial solution. I'm using the logging list command in an attempt to narrow down to only those 2 level 6 messages, and allow anything 0-4, which is where the issue all started.

Re: ASA syslog issues

James Lytle — Fri, 17 Feb 2023 19:14:41 GMT

well, option #1 did not affect the events being sent to syslog. back to square one.

Re: ASA syslog issues

MHM Cisco World — Fri, 17 Feb 2023 19:20:40 GMT

can I see last config

Re: ASA syslog issues

James Lytle — Fri, 17 Feb 2023 19:35:25 GMT

ogging enable
logging timestamp
no logging hide username
logging list vpn level warnings
logging list vpn message 722022
logging list vpn message 722023
logging buffer-size 8092
logging console warnings
logging monitor errors
logging buffered vpn
logging trap warnings
logging asdm warnings
logging from-address EC2.ASA@ppok.com
logging recipient-address firewalladmin@ppok.com level alerts
logging facility 21
logging device-id ipaddress inside
logging host inside x.x.x.x
logging permit-hostdown
logging class auth trap informational
logging class vpdn trap informational
logging class vpn trap informational
logging class vpnc trap informational
logging class webvpn trap informational
logging class svc trap informational

Re: ASA syslog issues

MHM Cisco World — Sat, 18 Feb 2023 10:23:58 GMT

Hello Freind
I think I found solution

you can only change the default level of message from Level 6 to Level 0-4
this make get logging level from 0-4 and also get two message from level 6 (it level now will appear as level 0-4)

Re: ASA syslog issues

balaji.bandi — Mon, 20 Feb 2023 09:54:20 GMT

you can also try :

logging message 722022 level 6
logging message 722023 level 6