topic Yes- if configured, you will in Network Security

ASA 5512X logging to either SSD Drive or USB

max-sandoval — Tue, 12 Mar 2019 03:54:54 GMT

I like to capture the syslogs to either the option of installing a 100GB SSD drive, or USB, what would be the best route?

I don't believe either option

Marvin Rhoads — Mon, 10 Mar 2014 03:35:59 GMT

I don't believe either option is supported for ASA syslog messages.

The SSD drive is intended for exclusive use of the NGFW features. A device in the USB port is available for file transfers or as a potential storage location for boot, ASDM etc. as well as a means of transferring files onto the ASA.

The internal log buffer storage is in memory and, when you choose internal log, is not customizable - it goes to flash memory. Reference.

Hi Marvin,

max-sandoval — Wed, 12 Mar 2014 19:41:36 GMT

Hi Marvin, I was already thinking of sending the syslog over to an external server as an option, but if I was to do that, the internal syslog will remain in case of failure on the external ?

Yes- if configured, you will

Marvin Rhoads — Thu, 13 Mar 2014 04:03:45 GMT

Yes- if configured, you will still have the internal syslog. It is limited per the reference to a relatively small size.

If you're logging at anything higher that level 4 you will usually start wrapping the internal syslog buffer after a very short while so it is of limited utility. More for near-real-time troubleshooting than for foresnic analysis.