topic Re: Logging PIX xlates? in Network Security https://community.cisco.com/t5/network-security/logging-pix-xlates/m-p/61568#M707779 <HTML><HEAD></HEAD><BODY><P>the pix message that tracks connections is</P><P>pix-6-305002. BUT:</P><P>in a hih traffic network, this will impact performance greatly. Its an informational message.</P><P>I would suggest that you send it to a syslog server,</P><P>&amp; then parse the output to a readable form. Don't forget timestamping.</P></BODY></HTML> Thu, 20 Sep 2001 17:11:48 GMT millerv 2001-09-20T17:11:48Z Logging PIX xlates? https://community.cisco.com/t5/network-security/logging-pix-xlates/m-p/61567#M707778 <P>Is it possible to log the xlates occuring in a PIX firewall so I can go back later and see what internal address mapped to a particular external address? We have our xlate time set rather high because of the high volume of use our students have on the network and the need to be good stewards of our address space. Yet now, I am having some locations indicating some possible port scanning going on. By the time these locations contact me the xlate has long since changed to a different user. Is there any way to log xlates by time and date either on the pix for so long or externally using CISCOWorks or something else?</P><P></P><P>Thomas Knight</P><P>Taylor University</P><P><A href="mailto:thknight@tayloru.edu" target="_blank">thknight@tayloru.edu</A></P> Fri, 21 Feb 2020 05:49:49 GMT https://community.cisco.com/t5/network-security/logging-pix-xlates/m-p/61567#M707778 thknight 2020-02-21T05:49:49Z Re: Logging PIX xlates? https://community.cisco.com/t5/network-security/logging-pix-xlates/m-p/61568#M707779 <HTML><HEAD></HEAD><BODY><P>the pix message that tracks connections is</P><P>pix-6-305002. BUT:</P><P>in a hih traffic network, this will impact performance greatly. Its an informational message.</P><P>I would suggest that you send it to a syslog server,</P><P>&amp; then parse the output to a readable form. Don't forget timestamping.</P></BODY></HTML> Thu, 20 Sep 2001 17:11:48 GMT https://community.cisco.com/t5/network-security/logging-pix-xlates/m-p/61568#M707779 millerv 2001-09-20T17:11:48Z Re: Logging PIX xlates? https://community.cisco.com/t5/network-security/logging-pix-xlates/m-p/61569#M707780 <HTML><HEAD></HEAD><BODY><P>Has CISCO released a PIX Syslog Server that will run on Win2000 yet? </P><P></P><P>Also, what level of logging are you doing to get this info? </P></BODY></HTML> Fri, 21 Sep 2001 13:04:39 GMT https://community.cisco.com/t5/network-security/logging-pix-xlates/m-p/61569#M707780 thknight 2001-09-21T13:04:39Z Re: Logging PIX xlates? https://community.cisco.com/t5/network-security/logging-pix-xlates/m-p/61570#M707781 <HTML><HEAD></HEAD><BODY><P>You would need to set the logging level to 6 to get translation messages. If volumes are high keep an eye on memory and processor usage. Logging at that level for long periods of time will kill the performance at peak periods.</P></BODY></HTML> Tue, 25 Sep 2001 22:03:48 GMT https://community.cisco.com/t5/network-security/logging-pix-xlates/m-p/61570#M707781 thompson 2001-09-25T22:03:48Z Re: Logging PIX xlates? https://community.cisco.com/t5/network-security/logging-pix-xlates/m-p/61571#M707782 <HTML><HEAD></HEAD><BODY><P>To my knowledge, Cisco does not have a Syslog server for Win2k at this time. However, you can obtain a very simple and free Syslog server from the following URL:</P><P><A class="jive-link-custom" href="http://www.boson.com/promo/utilities/syslog/syslog_utility.htm" target="_blank">http://www.boson.com/promo/utilities/syslog/syslog_utility.htm</A></P><P></P><P>By default, it listens to the local7 facility.</P><P></P><P>However, I would really recommend you looking into having some type of linux based server.</P></BODY></HTML> Thu, 04 Oct 2001 16:13:04 GMT https://community.cisco.com/t5/network-security/logging-pix-xlates/m-p/61571#M707782 mweddle 2001-10-04T16:13:04Z