topic Hi Stacey, in Network Security

Unable to email logs

stacey.alden — Tue, 12 Mar 2019 07:24:32 GMT

I have a cisco asa and I have set up a log trap to email me when certain events are triggered, but I never get the email. I setup the ASDM logging to be the same trigger as my email and I see events there but the email is never sent.

I have configured the email smtp settings as well as set my email addresses for from and two for these but nothing ever happens. Anyone have a clue why the email part doesn't work?

Thanks,

Stacey Alden

I'm assuming you are using

Rolando Valenzuela — Fri, 26 Feb 2016 22:35:56 GMT

I'm assuming you are using something like "logging mail" can you share your configuration?

Can you check if ESMTP and SMTP Inspection are enabled and try removing them.

Regards.

Rolando A. Valenzuela.

Hi Stacey,

Aditya Ganjoo — Sat, 27 Feb 2016 03:18:05 GMT

Hi Stacey,

Make sure you have enabled the SMTP servers on the ASA.

You can check this link for further info:

http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-pix70-syslog.html#maintask1

Regards,

Aditya

Please rate helpful posts.

Assuming you have configured

Marius Gunnerud — Sat, 27 Feb 2016 08:33:22 GMT

Assuming you have configured the ASA logging correctly, the issue would be on the SMTP server. Make sure the mail is not being blocked by spam filter.

Please remember to select a correct answer and rate helpful posts

I was able to get the email

stacey.alden — Tue, 01 Mar 2016 19:30:50 GMT

I was able to get the email part working but only after I cleared the buffer out. Is there a way to prevent the buffer from fully filling so the emails keep coming out?

Hi Stacey,

Aditya Ganjoo — Wed, 02 Mar 2016 01:50:58 GMT

Hi Stacey,

You can try reducing the level of logging on the ASA.

I am not sure what is the logging level you are using for trapping the syslogs.

Regards,

Aditya

Please rate helpful posts.

The ASA should overwrite

Marius Gunnerud — Wed, 02 Mar 2016 06:09:26 GMT

The ASA should overwrite older logs.

could you issue the command show run all logging.

Please remember to select a correct answer and rate helpful posts