topic Re: Missing traffic log on ASA in Network Security

Missing traffic log on ASA

Wai Nam Mao — Tue, 12 Mar 2019 01:28:13 GMT

I have two ASA form a cluster and part of configuration as below

the number of hit count of this ACE is very very large, so that i suppose to receive lot of log on ASDM and log server, however, i found that i can just receive part of log, yes PART of it, let say 100 packet hit this ACE, but i can only receive about only 1 to 2 log entry

I tried to failover, to reboot, upgrade, all not work, i also directly plugin a log server onto ASA, but problem remain the same

access-list inside_access_in extended permit udp any any eq domain log

logging enable

logging console informational

logging buffered debugging

logging trap warnings

logging history informational

logging asdm informational

logging facility 22

logging host inside 1.1.1.1

Cisco Adaptive Security Appliance Software Version 8.2(5)

Device Manager Version 7.0(2)

Missing traffic log on ASA

Julio Carvajal — Mon, 15 Apr 2013 18:45:44 GMT

Hello Wai,

Hmm, what is the log ID you are receving for this ?

Regards

Missing traffic log on ASA

Wai Nam Mao — Tue, 16 Apr 2013 01:08:58 GMT

%ASA-6-302016

%ASA-6-302015

%ASA-6-302013

We can received those log on both ASDM and syslog server, however, not all of log we suppose to received

Syslog logging: enabled

Facility: 22

Timestamp logging: disabled

Standby logging: disabled

Debug-trace logging: disabled

Console logging: level informational, 6904 messages logged

Monitor logging: disabled

Buffer logging: level debugging, 7175 messages logged

Trap logging: level warnings, facility 22, 360 messages logged

Logging to inside 172.16.10.50

History logging: level informational, 6903 messages logged

Device ID: disabled

Mail logging: disabled

ASDM logging: level informational, 6903 messages logged

Missing traffic log on ASA

Julio Carvajal — Tue, 16 Apr 2013 01:12:38 GMT

Hello Wai,

Those logs are not related to ACL hits, so that is expected

You should be looking for this:

106023

Regards

Missing traffic log on ASA

Wai Nam Mao — Tue, 16 Apr 2013 01:19:39 GMT

May i ask the log ID for permit packet?

since 106023 is for packet denied by the ACL right?

Missing traffic log on ASA

Julio Carvajal — Tue, 16 Apr 2013 01:28:46 GMT

Wai,

Here it is

106100

remember to rate all of the helpful posts

Missing traffic log on ASA

Wai Nam Mao — Tue, 16 Apr 2013 01:34:22 GMT

i found it

%ASA-6-106100: access-list outside_access_in permitted tcp outside/101.226.33.205(50827) -> dmz/10.0.0.71(80)

%ASA-4-106023: Deny tcp src dmz:10.0.0.71/3079 dst outside:119.57.54.51/8080 by access-group "dmz_access_in"

I am facing the same problem with this two type of log

this log is missing, not every time the ACE is hitted

Missing traffic log on ASA

Julio Carvajal — Tue, 16 Apr 2013 05:00:00 GMT

Hello Wai,

Really, Can you share your Access-list and Logging configuration please?

Re: Missing traffic log on ASA

Wai Nam Mao — Wed, 17 Apr 2013 01:40:39 GMT

ASA# show run log

logging enable

logging console informational

logging buffered debugging

logging trap warnings

logging history informational

logging asdm informational

logging facility 22

logging host inside 172.16.10.50

and one of our ACE

access-list inside_access_in extended permit udp host 172.16.10.18 any eq domain log

Re: Missing traffic log on ASA

Julio Carvajal — Wed, 17 Apr 2013 04:14:28 GMT

Hello Wai,

Hmm, you should be getting them on the syslog server at least ( are you are sending a lot of traffic to the local buffer of the ASA it might get oversubscripded at the time you go and check it)

Can you doble check it on the server side for me please

Re: Missing traffic log on ASA

Wai Nam Mao — Wed, 17 Apr 2013 04:26:34 GMT

I got the same result on my syslog server, just a part of log is recived, i also tried, offline the ASA, directly connect a syslog server, change log server setting on ASA, then I open a Wireshar, found that, ASA not senting out those log at all, ASA just send part of them

Re: Missing traffic log on ASA

Julio Carvajal — Wed, 17 Apr 2013 04:48:30 GMT

Hmm,

what version are you running?

Re: Missing traffic log on ASA

Wai Nam Mao — Wed, 17 Apr 2013 05:01:44 GMT

8.2(5)

Re: Missing traffic log on ASA

Julio Carvajal — Wed, 17 Apr 2013 05:10:13 GMT

Hello Wai,

106100

That is the one we should be looking at

Remember this :

When you enable logging for message 106100, if a packet matches an ACE, the ASA creates a flow entry to track the number of packets received within a specific interval. The ASA generates a system message at the first hit and at the end of each interval, identifying the total number of hits during the interval. At the end of each interval, the ASA resets the hit count to 0. If no packets match the ACE during an interval, the ASA deletes the flow entry.

Permitted packets that belong to established connections do not need to be checked against access lists; only the initial packet is logged and included in the hit count. For connectionless protocols, such as ICMP, all packets are logged, even if they are permitted, and all denied packets are logged.

You are taking that into consideration right?

Re: Missing traffic log on ASA

Wai Nam Mao — Wed, 17 Apr 2013 05:15:03 GMT

Yes, since this firewall is handling thousand of users, i tried this, put a permit any ACE on the top on ACL, and found that i just receive a log entry in about 20 seconds

Re: Missing traffic log on ASA

Julio Carvajal — Wed, 17 Apr 2013 05:17:27 GMT

Hello Wai,

well that is expected,

If you enter the log option without any arguments, you enable system log message 106100 at the default level (6) and for the default interval (300 seconds). See the following options:

•level—A severity level between 0 and 7. The default is 6.

•interval secs—The time interval in seconds between system messages, from 1 to 600. The default is 300. This value is also used as the timeout value for deleting an inactive flow.

•disable—Disables all access list logging.

•default—Enables logging to message 106023. This setting is the same as having no log option.

As you can see there is an interval for each of the hits, so you can try to customize as you want but I mean you already know it's being hitted why should we waist CPU on this

Remember to rate all of the helpful posts, that is as important as a thanks :d