topic Searching logs in ASDM for IP address in Network Security

Searching logs in ASDM for IP address

mahesh18 — Tue, 12 Mar 2019 01:28:37 GMT

Hi Everyone,

I need to check logs for user PC IP in asdm.

I am on asdm page that shows real time log viewer.

Under filter by i put user PC IP address and click on filter it shows blank?

Thanks

MAhesh

Searching logs in ASDM for IP address

Jouni Forss — Mon, 15 Apr 2013 17:51:49 GMT

Hi,

It usually either means that the users connection isnt reaching the ASA

Your firewall ASDM logging level isnt high enough

Usually I have the ASDM logging level as "informational"

If you chech the logging configuration on the CLI you can use the command "show run logging"

And see that "logging asdm informational" is included in the output. If not you will need to add it.

Though you should be able to define it before opening the log window on the ASDM also.

- Jouni

Searching logs in ASDM for IP address

mahesh18 — Mon, 15 Apr 2013 18:11:47 GMT

Hi Jouni.

I ran the command sh run logging

it shows logging asdm critical.

On ASDM it shows

logging level debugging

Is there command i can check the logs while i am ASA by SSH?

Thanks

MAhesh

Searching logs in ASDM for IP address

Julio Carvajal — Mon, 15 Apr 2013 18:26:13 GMT

Hello

Logging level debugging you are basically logging everything

While connected via SSH

do a show logging | include x.x.x.x ( the IP address of the host you want to check)

Searching logs in ASDM for IP address

mahesh18 — Mon, 15 Apr 2013 18:40:22 GMT

Hi Julio,

Did that nothing comes back.

Also can you tell me difference between

when i run command on cli sh run logging

it says logging asdm critical.

When i login to device using asdm it says logging level debugging?

So what is ASDM logging level is it critical or debugging?

Thanks

MAhesh

Re: Searching logs in ASDM for IP address

Jouni Forss — Mon, 15 Apr 2013 18:40:34 GMT

Hi,

If you have high amount of traffic and not a large buffer configured then it will be pretty hard checking the logs on the SSH connection.

Use ASDM or a separate Syslog server is better in this case.

I would suggest configuring the "logging asdm informational" on the CLI and then checking the situation again on the ASDM logs.

- Jouni

Searching logs in ASDM for IP address

Julio Carvajal — Mon, 15 Apr 2013 18:43:12 GMT

Okey,

Do the following

logging buffered debugging

Then clear logging

and finally

show logging | include x.x.x.x

Searching logs in ASDM for IP address

mahesh18 — Tue, 16 Apr 2013 14:44:14 GMT

Hi Jouni,

I was able to check the logs on the syslog server.

I have few questions here

Can you please let me know when you say buffer size does this mean for logging to CLI? or ASDM?

Also can you tell me difference between

when i run command on cli sh run logging

it says logging asdm critical.

When i login to device using asdm it says logging level debugging?

So what is ASDM logging level is it critical or debugging?

Thanks

Mahesh

Re: Searching logs in ASDM for IP address

Jouni Forss — Tue, 16 Apr 2013 14:59:44 GMT

Hi Mahesh,

With the buffer size I meant the setting which defines how much logs the ASA keeps in its buffer which you can check on the CLI.

For example my setting in CLI format is this (Home ASA)

logging buffer-size 8192

This simply states how many bytes of logs is stored in the buffer of the ASA at any given time

ASA(config)# logging buffer-size ?

configure mode commands/options:

<4096-1048576> Specify logging buffer size in bytes

I think there is an own setting for ASDM also but I have never had the need to touch that setting

Regarding the command "show run logging" in the CLI. I too have witnessed that the CLI configuration might have some different logging level than the one shown in the ASDM.

I have never gone into depth with the setting so I cant give you a 100% sure answer at the moment.

I would imagine the setting on the ASDM side refers to some setting that only applies to the ASDM session you have open.

I would also imagine that the setting you see in the CLI with "show run logging" is the setting that is staticly configured to apply always.

Did you check the ASDM logging level on ASDM from the following menu

Configuration (Top Bar) -> Device Management (Bottom Left) -> Logging (Drop Down Menu) -> Logging Filters (Drop Down Menu)

- Jouni

Re: Searching logs in ASDM for IP address

mahesh18 — Tue, 16 Apr 2013 15:13:16 GMT

Hi Jouni,

Did you check the ASDM logging level on ASDM from the following menu

Configuration (Top Bar) -> Device Management (Bottom Left) -> Logging (Drop Down Menu) -> Logging Filters (Drop Down Menu)

Yes i check this way.

Logging setup shows

Also when i click on logging i see on ASDM logging is enabled.

Logging to internal buffer

Buffer size is 4098

ASDM logging shows

QUEUE SIZE shows 100

seems 100 is quite small.

Thanks a lot for answering the questions.

Best regards

Mahesh

Message was edited by: mahesh parmar

Re: Searching logs in ASDM for IP address

jerryroy777 — Fri, 03 Apr 2020 22:53:52 GMT

So there is absolutely no way to search logs in the GUI for a particular IP?

Re: Searching logs in ASDM for IP address

Marvin Rhoads — Sat, 04 Apr 2020 03:53:43 GMT

@jerryroy777 this thread is 7 years old.

Yes you can absolutely search the logs in the ASDM GUI for a specific endpoint IP address. However if the traffic isn't reaching the ASA in the first place you may not get any results in your search.

If I search in the ASDM Realtime log viewer and don't find what I think should be there, the next level of troubleshooting is to do a packet capture and look for the raw packets incoming. (Assuming I've confirmed my logging level is correct and that there are no logging filters in place)