https://community.cisco.com/t5/network-security/asa-syslog-traffic/m-p/4001412#M28964 <P>I work with LogRhythm and I am trying to filter out logs that did not get through the ASA firewall.&nbsp; I see logs with the following message ID: 302013 Connection Built, 302015&nbsp;Built UDP Connection, 302016&nbsp;Connection Teardown,&nbsp; Some of the 302016 logs show 0 duration with data listed, but if I do a search I do not see a traffic allow.&nbsp; Do the three events I listed show traffic got through the ASA or is it safe to filter them out.</P><P>&nbsp;</P><P>Thank You</P><P>&nbsp;</P><P>Chris</P> Thu, 19 Dec 2019 16:30:31 GMT cesseltine 2019-12-19T16:30:31Z https://community.cisco.com/t5/network-security/asa-syslog-traffic/m-p/4001412#M28964 <P>I work with LogRhythm and I am trying to filter out logs that did not get through the ASA firewall.&nbsp; I see logs with the following message ID: 302013 Connection Built, 302015&nbsp;Built UDP Connection, 302016&nbsp;Connection Teardown,&nbsp; Some of the 302016 logs show 0 duration with data listed, but if I do a search I do not see a traffic allow.&nbsp; Do the three events I listed show traffic got through the ASA or is it safe to filter them out.</P><P>&nbsp;</P><P>Thank You</P><P>&nbsp;</P><P>Chris</P> Thu, 19 Dec 2019 16:30:31 GMT https://community.cisco.com/t5/network-security/asa-syslog-traffic/m-p/4001412#M28964 cesseltine 2019-12-19T16:30:31Z https://community.cisco.com/t5/network-security/asa-syslog-traffic/m-p/4001694#M28989 <P>I would recommend reviewing the guide below that will give you details about each type of syslog message generated on the ASA:</P> <P><A href="https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog.html" target="_blank">https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog.html</A></P> <P><EM>Thank you for rating helpful posts!</EM></P> Fri, 20 Dec 2019 05:12:16 GMT https://community.cisco.com/t5/network-security/asa-syslog-traffic/m-p/4001694#M28989 nspasov 2019-12-20T05:12:16Z