topic ASA send syslog messages for configuration changes in Network Security

ASA send syslog messages for configuration changes

netdood — Fri, 21 Feb 2020 12:42:28 GMT

On a router you can send configuration changes to the syslog server by doing,

conf t

ASA send syslog messages for configuration changes

Jennifer Halim — Wed, 08 Aug 2012 17:24:07 GMT

The syslog number 111008 and 111010 will log the command that is entered by user.

111010 is for configuration changes.

Here is the syslog for your information:

111008:

http://www.cisco.com/en/US/docs/security/asa/asa84/system/message/logmsgs.html#wp4769400

111010:

http://www.cisco.com/en/US/docs/security/asa/asa84/system/message/logmsgs.html#wp4769410

You need to enable syslog, and severity level 5, and if you don't want to see any other logging, you can only log the above 2 syslog numbers.

Re: ASA send syslog messages for configuration changes

netdood — Mon, 13 Aug 2012 17:22:31 GMT

Thanks, here's what I did,

logging list notif-cfg-changes message 111008-111010

logging list notif-cfg-changes level errors

logging trap notif-cfg-changes

I think this means send those specific messages even though they are a higher numbered level (5) than the 'error' level 3. Then send level 3 messages.

My syslog server gets the 111008 messages.

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/monitor_syslog.html#wp1064820