topic Why ASA is not sending admin logs to the syslog server in Network Security

Why ASA is not sending admin logs to the syslog server

Seeker369 — Tue, 12 Mar 2019 03:04:26 GMT

Hi ,

I have setup syslog server for my ASA 5520 logs. For ASDM and syslog server it is set from Informational level. But in my syslog server I am not able to find the "login details like which user access ASA on what time " etc. Is there any additional set up need to be done on the ASA ?

Thanks and regards

Deepak MK

Why ASA is not sending admin logs to the syslog server

Marius Gunnerud — Wed, 13 Nov 2013 09:22:43 GMT

Without seeing your configuration it is hard to tell if something is missing.

Have you configured accounting for the SSH/Telnet protocol?

aaa accounting ssh console GROUP

Where GROUP is the TACACS or RADIUS group you have configured.

http://www.cisco.com/en/US/docs/security/asa/asa91/configuration/general/admin_management.html#wp1146262

Why ASA is not sending admin logs to the syslog server

jumora — Thu, 14 Nov 2013 01:03:36 GMT

Please go through this link, it gives you options, like logging class or logging list, if you like you can configure the logging class just to see what logs are shown through ASDM real time log viewer with logging class auth:

logging class auth asdm debugging

Configure Syslog using ASDM

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080b83d04.shtml

FYI: It is the same thing on 8.X or 9.X.

Why ASA is not sending admin logs to the syslog server

Seeker369 — Thu, 14 Nov 2013 04:02:24 GMT

HI Guys,

Is it necessary that RADIUS and TACACS be configured as authentication servers to get the log ? I have only configured as local authentication. ASDM -logging level 6 and SNMP logging level 5.

Why ASA is not sending admin logs to the syslog server

jumora — Thu, 14 Nov 2013 04:03:23 GMT

Why ASA is not sending admin logs to the syslog server

jumora — Thu, 14 Nov 2013 04:04:12 GMT

Did you configure what I suggested and give it a try?

Why ASA is not sending admin logs to the syslog server

Seeker369 — Thu, 14 Nov 2013 04:08:05 GMT

I tried that only, I can get other logs but not able to get admin access or any login info

Re: Why ASA is not sending admin logs to the syslog server

Marius Gunnerud — Thu, 14 Nov 2013 07:49:01 GMT

Do you have the command logging console informational configured on the ASA? Keep in mind that you need to be logging to the console and not the ASDM.

Why ASA is not sending admin logs to the syslog server

jumora — Thu, 14 Nov 2013 14:29:01 GMT

Why would he need to do this over console??? he is just checking for user authentication.

can you get us a show run username?

If you are talking about console in any case then setting a timeout for console logging is necessary

console timeout 15

This will obligate user to authenticate when logging into the device

Why ASA is not sending admin logs to the syslog server

Seeker369 — Fri, 15 Nov 2013 02:52:02 GMT

Hi Marius/Jumora,

Ya there is no console logging enabled. Below is the logging setting;

Syslog logging: enabled

Facility: 23

Timestamp logging: enabled

Standby logging: disabled

Debug-trace logging: disabled

Console logging: disabled

Monitor logging: disabled

Buffer logging: disabled

Trap logging: level notifications, facility 23, 81520865 messages logged

Logging to Application XXXXX errors: 138897 dropped: 8890508

History logging: level informational, 187638103 messages logged

Device ID: disabled

Mail logging: disabled

ASDM logging: level informational, 188649338 messages logged

So Can you advise what are the changes need to be done ? Just console logging ? For SNMP poll to be added, is it necessary that monitor logging also enabled ?

Re: Why ASA is not sending admin logs to the syslog server

Marius Gunnerud — Fri, 15 Nov 2013 13:09:41 GMT

Sorry, my bad. If you are not logging to console then do not add that command.

try adding the command:

logging class auth trap debugging

If that doesn't work, then check if syslog ID 605004 and 605005 are set to informational level.

http://www.cisco.com/en/US/docs/security/asa/syslog-guide/logmsgs.html#wp6732707

Why ASA is not sending admin logs to the syslog server

jumora — Fri, 15 Nov 2013 22:55:51 GMT

We need to understand what the problem is before talking about any other topic, the ticket is for logging and I need you to test what I am saying and clarify what you refer to as admin user. are you talking about a user configured on the ASA's local database.

Why ASA is not sending admin logs to the syslog server

jumora — Sun, 17 Nov 2013 05:29:32 GMT

Do you still need assistance???

Re: Why ASA is not sending admin logs to the syslog server

Seeker369 — Tue, 19 Nov 2013 03:31:49 GMT

HI Guys,

Thanks for the advise. I will try put in the command as Marius suggested. The account is local. I also not able to find any where in the ASA 5520 , how to change the username as well.

Why ASA is not sending admin logs to the syslog server

jumora — Tue, 19 Nov 2013 03:52:09 GMT

If you did what I explained you should not have any problem viewing when you log in, if it does not work then I would need to see it with my own eyes, in that case I would suggest or either webex with me or open a TAC case, I´m from TAC.

Why ASA is not sending admin logs to the syslog server

Seeker369 — Tue, 19 Nov 2013 04:12:14 GMT

HI Jumora,

From the debugging I cant see that , Because setting is to go to SYSLOG server. Real time I am Unable to see it. May be I need to see it on logs after couple of days.

I could have logged a case with Cisco TAC but the issue is the support contract already expired.

I have inserted the image of the logging settings for your review.

Why ASA is not sending admin logs to the syslog server

jumora — Tue, 19 Nov 2013 04:16:55 GMT

what version are you at on the ASA

Why ASA is not sending admin logs to the syslog server

Seeker369 — Tue, 19 Nov 2013 05:51:00 GMT

8.0(4)

Why ASA is not sending admin logs to the syslog server

Julio Carvajal — Tue, 19 Nov 2013 06:27:20 GMT

This are the kind of logs you should look for:

%ASA-7-609001: Built local-host identity:1.1.1.2

%ASA-6-302013: Built inbound TCP connection 5 for inside:1.1.1.1/57227 (1.1.1.1/57227) to identity:1.1.1.2/23 (1.1.1.2/23)

%ASA-6-113012: AAA user authentication Successful : local database : user = cisco

%ASA-6-113008: AAA transaction status ACCEPT : user = cisco

%ASA-6-611101: User authentication succeeded: Uname: cisco

%ASA-6-605005: Login permitted from 1.1.1.1/57227 to inside:1.1.1.2/telnet for user "cisco"

I know you are not trying to make this happen locally but in a Syslog server with a Syslog trap but what happens if you do it locally?? Do u see those logs?

Rate all of the helpful posts!!!

Regards,

Jcarvaja

Follow me on http://laguiadelnetworking.com

Re: Why ASA is not sending admin logs to the syslog server

Marius Gunnerud — Tue, 19 Nov 2013 08:06:26 GMT

The ASDM is set to log informational too. You could go to Monitor > Logging in the ASDM and click View and you should be able to see real time logs there.

The account is local. I also not able to find any where in the ASA 5520 , how to change the username as well.

To change or add a user account in ASDM go to Configuration > Device Management and there should be a selection called AAA / users or similar on the left side pane.