topic Re: To reduce/drop unnecessary logs in syslog server in Network Security

To reduce/drop unnecessary logs in syslog server

Jigar Dave — Mon, 11 Mar 2019 20:38:53 GMT

Hello Cognizants, Greetings

I have a question, How is it possible to reduce unnecessary logs in syslog servers, I want to see/concentrate only logs which are critical and above level 7?

I am discussing about taking consideration of ASA/PIX Firewall, IDS,IPS, Router and Switches in enterprise environment

hope everyone share their experience, expertise and advices for this topic

- JD

Re: To reduce/drop unnecessary logs in syslog server

varrao — Thu, 26 May 2011 17:02:01 GMT

Hi Jigar,

There are different types of logging levels that you can enable on the ASA, here they are as follows:

http://www.cisco.com/en/US/partner/docs/security/asa/asa83/system/message/logsevp.html

Refer to this guide as well:

http://www.cisco.com/en/US/partner/products/hw/vpndevc/ps2030/products_configuration_example09186a00805a2e04.shtml

This is going to be really beneficial for you.

Thanks,

Varun

Re: To reduce/drop unnecessary logs in syslog server

fsebera — Thu, 26 May 2011 19:37:05 GMT

I am logged in with my CCO account. Both links seem to be blocked by Cisco's FORBIDDEN message.

Do you have any links for blocking syslog messages that don't require "employee" status??

Tks

Frank

Re: To reduce/drop unnecessary logs in syslog server

Antonio Knox — Thu, 26 May 2011 19:45:53 GMT

You may want to consider logging lists, which gives more control over the logs:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00805a2e04.shtml#use

Re: To reduce/drop unnecessary logs in syslog server

fsebera — Fri, 27 May 2011 11:59:25 GMT

Jigar,

I use ASA5500 IOS 8.0(4).

Once I know the log message number I want to omit, I use this CLI command in the config:

no logging message (message #)

Here is a public reference to ASA logging:

http://www.ciscopress.com/articles/article.asp?p=424447&seqNum=3

Hope this helps

Frank

Re: To reduce/drop unnecessary logs in syslog server

Jigar Dave — Sun, 29 May 2011 05:56:11 GMT

Varun, Antonio, fsebera - Thanks a lot, I will let you

know if more help needed.

HAGD

- JD