topic Re: Splitting syslog between servers on ASA in Network Security

Splitting syslog between servers on ASA

tahscolony — Fri, 21 Feb 2020 17:05:37 GMT

Is it possible to configure logging in a way that the majority you want to see on one server can be blocked to another server so that only specific syslog messages can be sent to server 2? I have a bunch of no logging messages set up to be sent to an existing server, and on another server, just want to send 111010 and similar to only trigger config events. Hard to weed through the tons of events being sent by the ASA to just find the one that is sent.

Re: Splitting syslog between servers on ASA

balaji.bandi — Wed, 01 May 2019 06:16:33 GMT

Look at the below reference :

https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html#anc6

Other way what i have done for one of the customer ;

we send all the Logs to both syslog server, manage script to sort what we need for that servers for reporting.

rest will be remove from the log server.