topic ASA logging list config in Network Security

ASA logging list config

mahesh18 — Tue, 12 Mar 2019 06:16:14 GMT

Hi Everyone,

On our ASA i see below config

logging list configuration level debugging class config

logging class config trap debugging

Need to what is purpose of this config and where it will send log messages to?

will this config send more logs to syslog server?

Regards

Mahesh

Mahesh,We typically do NOT

Marvin Rhoads — Wed, 15 Jul 2015 20:28:45 GMT

Mahesh,

We typically do NOT setup any debugging for syslog or trap server destinations. That can be very very verbose.

The commands you note do that for any config sessions (which does mitigate the effect but can be handled more effectively in other ways such as AAA authentication of all sessions and a configuration management tool) and the destination would be any syslog and trap (snmp) servers you have setup elsewhere in the configuration.

Hi Marvin, Reason i am asking

mahesh18 — Wed, 15 Jul 2015 21:13:11 GMT

Hi Marvin,

Reason i am asking is that we are seeing lot of logs from this ASA to syslog.

Can you explain me in more detail please?

Regards

MAhesh

Mahesh,The "logging ... trap

Marvin Rhoads — Wed, 15 Jul 2015 23:18:28 GMT

Mahesh,

The "logging ... trap debugging" line tells the ASA to send the syslog messages at the most verbose level (level 7 = debugging) to your syslog server. That server is setup elsewhere with a "logging host ..." command.

Best practice is to send syslog messages at no more verbose than level 4 or 5 (warning or notification respectively) on a regular basis unless there is a troubleshooting session (or some sort of regulatory or legal compliance reason) that would require the more verbose set of messages.

Please see this TAC article for more details. There was also a good TAC Security podcast a while back on just ASA logging. Here's a link to the show notes where you can download the podcast. Also see the configuration guide section on logging for syntax details.

Hi Marvin, Many thanks for

mahesh18 — Thu, 16 Jul 2015 04:50:34 GMT

Hi Marvin,

Many thanks for detailed explanation.

I will go through all the links tomorrow.

Best Regards

Mahesh