topic Re: Syslog configuration for our PIX 515e in Network Security

Syslog configuration for our PIX 515e

mzamorano — Fri, 21 Feb 2020 07:49:19 GMT

I want to setup a server in our company so we can receive the logs from both or pix firewalls. I am not very satisfied with the documentation I found online. I would appretiate comments or advice as to how to set this up successfully?

Many thanks, Marcelo

Re: Syslog configuration for our PIX 515e

paddyxdoyle — Tue, 21 Dec 2004 17:00:36 GMT

Marcelo,

Everything you need is in this document!

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094030.shtml

Have a look through and if you have any further questions give us a shout.

Rgds

Re: Syslog configuration for our PIX 515e

dgaunt — Fri, 11 Feb 2005 16:58:49 GMT

I think it should be added that if you do a Syslog over TCP, that the PIX will buffer the logs if the syslog server is down. This is good, unless the buffer gets to big, in which case the PIX will no longer accept new connections.

Re: Syslog configuration for our PIX 515e

PE-PatInBC — Tue, 15 Feb 2005 22:02:40 GMT

Is there a particular Syslog server that people prefer running with the PIX ? I have downloaded one (no names mentioned) but would prefer to find something that runs as a service rather than an application.

Any preferences ?

Re: Syslog configuration for our PIX 515e

j.contreras — Wed, 16 Feb 2005 11:34:43 GMT

Hi,

I use usually two:

-Kiwi syslog (www.kiwisyslog.com) The freeware version is quite good, and you have a service version available. The commercial version adds some functionality (email alerts, filter by ip, etc) but the free one is quite good (and stable...)

-Ciscoworks VMS Security Monitor, if you have an IDS you have it... or with the full versions (20 or unlimited device). You can make reports and correlations.

Just take care that pixen are very "talkative" and send lots of messages, so on VMS, make sure you have a nice machine.

Regards