topic FWSM and failover syslog messages. in Network Security

FWSM and failover syslog messages.

andrea.meconi — Mon, 11 Mar 2019 22:03:41 GMT

Hello.

I need to add a new syslog server on my FWSM to send it only failover related messages.

Any ideas?

Thanks.

Regards.

Andrea

FWSM and failover syslog messages.

Julio Carvajal — Mon, 19 Dec 2011 17:37:25 GMT

Hello Andrea,

-Lets start saying that the failover event messages belong to level 1 (alert).

-If you want to enable logging for the stand by unit please enter the command: Logging standby

Now if you want just to get the failover messages you could create a logging list for the messages you want to monitor.

Here are the syslog messages available, you will need to decide witch ones are you going to monitor and create the syslog lis:.

http://tools.cisco.com/squish/cb7Dc

Logging list test xxxx message #

Hope this helps, any other question just let me know.

Please rate helpful posts,

Kind regards,

Julio

Re: FWSM and failover syslog messages.

andrea.meconi — Mon, 19 Dec 2011 23:34:21 GMT

Hello Julio and many thanks for your help.

We are using more than one syslog servers. Now we need to add a new syslog server and send to it only the ha related messages.

I prefered to use class filtering like this

logging class ha mail alerts

but I do not understand how I can send these messages to only one server and not to all.

Now we are using mail with

logging mail alerts

logging from-address blade@test.com

logging recipient-address andrea@test.com level alerts

snmtp-server 1.1.1.1

Regards.

Andrea

Re: FWSM and failover syslog messages.

Julio Carvajal — Mon, 19 Dec 2011 23:51:08 GMT

Hello Andrea,

The think with this kind of setups is that the ASA will send all the messages belonging to that class to all of the syslog servers or will not send them at all.

So at this point its not supported.

Regards,

Julio

Re: FWSM and failover syslog messages.

andrea.meconi — Tue, 20 Dec 2011 07:29:55 GMT

Many thanks Julio.

Regards.

Andrea

Re: FWSM and failover syslog messages.

andrea.meconi — Tue, 20 Dec 2011 11:04:03 GMT

Hello.

Sorry, but with this config

logging enable

logging standby

logging mail alerts

logging from-address fwsm@test.it

logging recipient-address fm.net@test.it level alerts

logging class ha mail alerts

smtp-server 10.0.0.1

I'm not able to receive any ha syslog related messages.

Any ideas?

Thanks.

Regards.

Andrea

FWSM and failover syslog messages.

Julio Carvajal — Tue, 20 Dec 2011 18:29:14 GMT

Hello Andrea,

But you are still getting other messages right?

You are just not getting the HA messages?

Regards,

Julio

Re: FWSM and failover syslog messages.

andrea.meconi — Tue, 20 Dec 2011 22:34:31 GMT

Hello Julio.

Yes, my syslog servers are receiving all messages, ha related also.

I'm not receiving mail notification about ha.

Show logging command reports that messages are logged by mail.

FWSMs are running application image version 4.1(7).

Regards,

Andrea

Re: FWSM and failover syslog messages.

Julio Carvajal — Wed, 21 Dec 2011 03:03:14 GMT

Hello Andrea,

Some times the Syslog daemon used by the ASA migth get stuck, so lets take out the email configuration and do it one more time but this time using a higher level of trap.

no logging enable

no logging standby

no logging mail alerts

no logging from-address fwsm@test.it

no logging recipient-address fm.net@test.it level alerts

no logging class ha mail alerts

Logging enable

logging standby

logging mail list example

logging from-addresfwsm@test.it

logging recipient-addresfm.net@test.i

logging list example level notifications class ha

Please give it a try and let me know.

Regards,

Julio

Re: FWSM and failover syslog messages.

andrea.meconi — Thu, 16 Feb 2012 10:28:47 GMT

Hello Julio.

Sorry for my later reply.

Now, we are using application software version 4.1(6) with multiple contexts.

Using the admin context I configure the logging facility with

logging enable

logging asdm informational

logging mail alerts

logging from-address fw-csc1@dominio.it

logging recipient-address andrea@dominio.it level alerts

logging class ha mail alerts

but I'm receiving only the monitoring interface messages

<161>%FWSM-1-105003: (Secondary_group_1) Monitoring on interface P2P-FW-CSC1 waiting

How can I receive message like "Switching to...".

Thanks.

Regards.

Andrea