topic SYSLOG message in Network Security

SYSLOG message

rahul.borah — Sat, 01 Feb 2020 09:47:28 GMT

HI Expert,

I have a query regarding syslog message. In my cisco ASA firewall 5585X (9.1) remote syslog server ip is configured. Regular basis syslog logs received by syslog server from ASA firewall aroung 3Lakh logs (level 6) per day but suddenly syslog msg count is increase to aroung 20 Lakh per day. Please guide how to troubleshoot the issue. And what are the common cause for this type of error.

Regards,

Re: SYSLOG message

RS_58556 — Sat, 01 Feb 2020 10:58:25 GMT

Hi,

First step would be see if you the logging level for syslog (trap logging) has been changed (informational to debugging )

Secondly, any new ACLs implemented with log keyword (for which lot of hits are there)

Thirdly, check the syslog server to find any newer kind of logs you have started observing.

HTH

Re: SYSLOG message

rahul.borah — Sat, 01 Feb 2020 11:55:42 GMT

HI HTH,

Thakns for your reply.

I have checked step 1 and 2, both settings are looks good. Now i am waiting for all logs from the SOC team for troubleshooting.

One more query, is there any command for checking the count of syslog logs send to the remote syslog server in one day.

Regards,

Re: SYSLOG message

RS_58556 — Sat, 01 Feb 2020 15:24:22 GMT

That is not possible. The output of ‘show log’ would only show the total number of messages sent over until the counter is reset.