topic events per second in Network Security

events per second

WILLIAM STEGMAN — Tue, 12 Mar 2019 02:59:09 GMT

Is there a command to determine the events per second that an ASA is generating? I can see the total messages logged, but can't tell what measurement of time they're associated with.

thank you

events per second

johnlloyd_13 — Sat, 02 Nov 2013 01:46:26 GMT

hi william,

are you referring to threat detection rate?

what syslogs are you looking? kindly post them.

events per second

WILLIAM STEGMAN — Mon, 04 Nov 2013 14:32:14 GMT

Hi John. No, I'm looking to gather statistics on how many syslog messages I'm sending per second. I have it set to notifications and we're trying to guauge some requirements for an event correlation product, so I'm trying to determine how many events per second our ASAs are generating.

thank you

Re: events per second

johnlloyd_13 — Mon, 04 Nov 2013 15:11:57 GMT

hi william,

thanks for you feedback! you could verify if the the 'rate-limit' for syslog is enabled on the ASA.

see sample below.

ASA5505(config)# logging rate-limit ?

configure mode commands/options:

<1-2147483647> Specify logging rate-limit number

unlimited Specify unlimited option for rate-limit

ASA5505(config)# logging rate-limit 100 ?

configure mode commands/options:

<1-2147483647> Specify logging rate-limit interval

level Specify logging level for rate-limit

message Specify the syslog id for rate-limit

ASA5505(config)# logging rate-limit 100 1 ? <<< 100 LOGS EVERY 1 SECOND

configure mode commands/options:

level Specify logging level for rate-limit

message Specify the syslog id for rate-limit

ASA5505(config)# logging rate-limit 100 1 level ?

configure mode commands/options:

<0-7> Enter syslog level (0 - 7)

alerts Immediate action needed (severity=1)

critical Critical conditions (severity=2)

debugging Debugging messages (severity=7)

emergencies System is unusable (severity=0)

errors Error conditions (severity=3)

informational Informational messages (severity=6)

notifications Normal but significant conditions (severity=5)

warnings Warning conditions (severity=4)

ASA5505(config)# logging rate-limit 100 1 level 7

ASA5505(config)# sh run logging

logging rate-limit 100 1 level 7

events per second

WILLIAM STEGMAN — Mon, 04 Nov 2013 15:27:19 GMT

That command wasn't enabled, but I just added it.

events per second

johnlloyd_13 — Mon, 04 Nov 2013 16:09:00 GMT

cool! i hope that was what you're looking for.

please help rate the post or mark as 'correct answer' if it's resolved.

events per second

WILLIAM STEGMAN — Mon, 04 Nov 2013 16:28:50 GMT

sort of John. That allows me to define the statisitic, but how could I tell how much is being dropped? I guess I'm looking for some counters somewhere.

thanks again

Re: events per second

johnlloyd_13 — Mon, 04 Nov 2013 17:01:11 GMT

Hi,

The only command that I can think of is the 'show logging.'

I saw it's also mentioned on the URL:

http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/l2.html#wp1773894

Sent from Cisco Technical Support iPhone App