topic Re: ASA 5550 - Two different syslogs servers in Network Security

ASA 5550 - Two different syslogs servers

acimalacqua — Mon, 11 Mar 2019 18:23:16 GMT

Hi to all.

In my Cisco ASA 5550, I need to set two different syslogs servers, and I need to send the system logs to the first one (only admins login/logout), and the traffic logs and all the rest (informational level) to the second one. Do you know if is it possible or not and, if yes, how to configure it? All suggestions will be really appreciated. Thanks.

Re: ASA 5550 - Two different syslogs servers

Nitin Agarwal — Tue, 10 Aug 2010 14:58:54 GMT

Hi,

As per my reserch it is not possible to have two syslog server configured and working at same time.

They can be configured as primary and secondary.

Regards,

Nitin agarwal.

Re: ASA 5550 - Two different syslogs servers

mirober2 — Tue, 10 Aug 2010 15:15:12 GMT

Hi Alessandro,

You can configure multiple syslog servers using multiple 'logging host' commands, such as:

logging trap warnings

logging host inside 10.1.1.1

logging host inside 10.1.1.2

This will send syslogs to both servers. However, it does not meet your second requirement of sending different logs to each host. For that, you would have to use a different logging facility, such as 'logging mail' or 'logging asdm'.

Hope that helps.

-Mike

Re: ASA 5550 - Two different syslogs servers

Kureli Sankar — Tue, 10 Aug 2010 17:37:29 GMT

Alessandro,

You can send the same warning level to both syslogs servers.

You cannot send debug to one syslog server and critical to the other syslog server.

That would be nice if we can do that. May be an ENH request is filed somewhere.

-KS

Re: ASA 5550 - Two different syslogs servers

acimalacqua — Tue, 10 Aug 2010 20:19:49 GMT

Thanks to all, guys.

I supposed it. I succeded to set two syslogs servers, but I had the "problem" to have the same logging level in both of them (just a "replica" of logs). I hope that Cisco can make this upgrade in the future, because it will be very usefull in my company to have different recipients for the logs. My area needs to have traffic logs for troubleshooting and a security area needs to have only the admin's login and logout to track them for Italian's laws. I'll keep in touch about this upgrade... Thanks again. Have a nice holidays.

Re: ASA 5550 - Two different syslogs servers

Nagaraja Thanthry — Wed, 11 Aug 2010 05:44:43 GMT

Hello,

While there is a limitation in the syslog server configurations, you could

use other logging methods to collect specific information. While it is not

very efficient method, if you are just concerned about login/logout messages

for security audit purposes, you could use email logging. You can create a

logging list and then send those messages to your email.

Example:

logging list mail message 111008

logging list mail message 111004

logging from-address

You can do similar things by sending specific log events to SNMP server as

well.

Hope this helps.

Regards,

Re: ASA 5550 - Two different syslogs servers

acimalacqua — Sun, 20 Mar 2011 22:09:24 GMT

Hi,

just to take you updated and to suggest a solution to other users that need to solve the same problem, I want to tell you that I've solved it as you told me, and it's working. In detail, I've created a logging list with all the auth events I need, and I've configured the ASA to send a SNMP trap to a target device (Qradar Appliance in my case) that stores all the events. This solution is not very simple to manage, and I hope that Cisco can upgrade ASA's syslog functions and features in the next releases, but can help you in having different logs sent to different destinations, as requested to the Italian's laws to audit login and logout of administrators. Thanks for your help.

ASA 5550 - Two different syslogs servers

Alain-Florent Essome — Mon, 17 Feb 2014 10:11:44 GMT

Hi Alessandro

can you please send me the solution ? i have the same proble and need to configure it. i will be happy to get the syslog config you don on the ASA

Thanks

Alain

ASA 5550 - Two different syslogs servers

Kureli Sankar — Mon, 17 Feb 2014 14:44:56 GMT

Pls. refer CSCea93753. It is still not resolved. You are welcome to add your comments to the enhancement request.

-Kureli

Hello,

abdhija.s — Thu, 30 Mar 2017 08:52:43 GMT

Hello,

I am currently facing the same issue and need a solution. Did you ever find one?

Regards,

Abdhija