Question about syslog messages

jorge.chavez — Fri, 21 Feb 2020 17:46:33 GMT

Hello
looking for assistance. Trying to figure out if there is a way to restrict the type of syslog messages I'm seeing.
For example, is there a way to filter out syslog message %ASA-6-302013, and only see syslog message Syslog Message %ASA-6-106100 when i issue command 'show log'?
thanks in advance

Re: Question about syslog messages

Karsten Iwen — Wed, 18 Dec 2019 22:08:26 GMT

Yes, you can restrict it in a couple of ways:

First you only see logs in the range that you enable:

he1-asa1(config)# logging buffered ?

configure mode commands/options:
  <0-7>          Enter syslog level (0 - 7)
  WORD           Specify the name of logging list
  alerts         Immediate action needed           (severity=1)
  critical       Critical conditions               (severity=2)
  debugging      Debugging messages                (severity=7)
  emergencies    System is unusable                (severity=0)
  errors         Error conditions                  (severity=3)
  informational  Informational messages            (severity=6)
  notifications  Normal but significant conditions (severity=5)
  warnings       Warning conditions                (severity=4)

You can turn off specific messages:

he1-asa1(config)# no logging message ?

configure mode commands/options:
  <100000-999999>  Specify a message number

And you can change the severity level of specific messages:

he1-asa1(config)# logging message 752015 level ?

configure mode commands/options:
  <0-7>          Enter syslog level (0 - 7)
  alerts         Immediate action needed           (severity=1)
  critical       Critical conditions               (severity=2)
  debugging      Debugging messages                (severity=7)
  emergencies    System is unusable                (severity=0)
  errors         Error conditions                  (severity=3)
  informational  Informational messages            (severity=6)
  notifications  Normal but significant conditions (severity=5)
  warnings       Warning conditions                (severity=4)

Here, 752015 by default is a severity 3 message. If you are logging in severity 5 and you don't want to see this specific message you can change it to 6.

Re: Question about syslog messages

Marvin Rhoads — Thu, 19 Dec 2019 02:08:51 GMT

What Karsten said for a permanent fix.

If you just want to see only certain log events then something like this:

show log | include 106100

topic Re: Question about syslog messages in Network Security

Question about syslog messages

Re: Question about syslog messages

Re: Question about syslog messages