topic Re: RSyslog cannot parse timestamps from ASA Syslog in Network Security

RSyslog cannot parse timestamps from ASA Syslog

Ronit Bhattacharjee — Tue, 11 Jul 2023 08:43:03 GMT

We use Rsyslog and LogAnalyzer as our Syslog collector. All our routers/switches/firewalls send Syslogs to Rsyslog. We would like timestamps in the log payload and this works fine for routers and switches, but Rsyslog cannot recognise the timestamp of the logs sent by Cisco ASA.

Here's the difference

Router

Firewall

Using packet captures, we can see that the firewall is indeed sending timestamps in the UDP message, but the format is different from the router and that may explain why Rsyslog is not able to parse it.

Is this known behaviour? Any way to get the firewall to send the timestamps in the same format as the router?

Re: RSyslog cannot parse timestamps from ASA Syslog

Aref Alsouqi — Tue, 11 Jul 2023 08:56:31 GMT

Did you apply the "logging timestamp" command on the ASA?

Re: RSyslog cannot parse timestamps from ASA Syslog

Ronit Bhattacharjee — Tue, 11 Jul 2023 08:59:15 GMT

Yes, applying the command enables timestamps in the pcap, but they are still not recognisable by Rsyslog. The solution was to add "format emblem" at the end of each syslog host. Now the timestamps are recognisable by Rsyslog.

Re: RSyslog cannot parse timestamps from ASA Syslog

MHM Cisco World — Tue, 11 Jul 2023 09:01:01 GMT

Thanks for update us and share solution.