topic Re: Change Access List logging globally in Network Security

Change Access List logging globally

cshannahan — Fri, 21 Feb 2020 16:30:39 GMT

It seems we don't have the "LOG" entry on any of our access lists. Is there a way to globally turn this on so it logs all access lists to the syslog server or do I have to enter this one by one on the ASA command line or ASDM?

Re: Change Access List logging globally

Abheesh Kumar — Tue, 27 Nov 2018 20:53:59 GMT

Hi,

Try enable logging message 106100 and see are you getting the ACL hit logs in syslog server

HTH
Abheesh

Re: Change Access List logging globally

cshannahan — Wed, 28 Nov 2018 01:02:04 GMT

I'm not exactly sure how to do this. I tried logging message 106100 but it didn't work. I don't see any clear instruction how to get permits to log if the default acl logging is being used WITHOUT the log entry at the end. There are articles but nothing pointing me in the right direction yet.

Re: Change Access List logging globally

Marvin Rhoads — Wed, 28 Nov 2018 02:19:47 GMT

106100 is a level 6 (informational) message, so you would need your global logging also set to level 6 (or 7) for it to start appearing.

Re: Change Access List logging globally

cshannahan — Wed, 28 Nov 2018 02:24:04 GMT

No you get an error message when doing this.

INFO: Please use the access-list command to change the severity level of this syslog

I've tried everything I think.

Re: Change Access List logging globally

Marvin Rhoads — Wed, 28 Nov 2018 02:27:34 GMT

I'm not suggesting to change the severity of the message but rather your GLOBAL setting.

Can you share the output of "show run logging"?

Re: Change Access List logging globally

cshannahan — Wed, 28 Nov 2018 02:32:04 GMT

My global sending to syslog servers is 6...info.