topic Re: Firewall Syslog in Network Security

Firewall Syslog

Steven Williams — Fri, 21 Feb 2020 16:42:05 GMT

Is there anyway to send certain logs from ASA to syslog, like to stop logging on a ACL or anything like that?

Re: Firewall Syslog

Ilia Sanashvili — Thu, 24 Jan 2019 19:02:19 GMT

The easiest and simplest way it to use severity levels from 0 to 7. If you don't know them https://en.wikipedia.org/wiki/Syslog#Severity_level here is the table that shows it.

You can only send up to level 2 or 3, which you can do using logging trap 3 in a global config mode.

I personally never send firewall messages to syslog because it's so many and it's so endless that you can't just sit and stare at syslog 24/7. If you want to send really critical ones just send level 2 let's say.

Hope this is helpful

Re: Firewall Syslog

balaji.bandi — Fri, 25 Jan 2019 07:25:48 GMT

ASA can only filter messages by severity, or by log message class, or by individual log message.

here is the connfiguration guide for reference :

https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.pdf