topic Re: Syslog formats in Network Security https://community.cisco.com/t5/network-security/syslog-formats/m-p/933085#M940234 <HTML><HEAD></HEAD><BODY><P>Wont' work because of the different devices. The Concentrators were acquired from [I forget] so the logs are different. Sorry but you'll have to change your scripts. I've always found it useful to filter the scripts on the code type (ie ASA-6-113009). Pretty easy to change the script when Cisco changes something.</P><P></P><P>HTH</P></BODY></HTML> Thu, 27 Mar 2008 18:55:10 GMT Collin Clark 2008-03-27T18:55:10Z Syslog formats https://community.cisco.com/t5/network-security/syslog-formats/m-p/933084#M940231 <P>Very new to Cisco products and syslog...</P><P></P><P>Question:</P><P>We have 2 devices ASA 5520 and VPN 3000 Concentrator sending data to syslog server.</P><P></P><P>I'm looking to gather information regarding authentication from these devices, but the format for syslog messages is different.</P><P></P><P>ASA 5520 Example:</P><P>2008-03-24,07:45:59,xxx.xxx.xxx.xxx,21,6,%ASA-6-113004: AAA user authentication Successful : server = xxx: user = testuser</P><P></P><P>2008-03-24,07:46:02,xxx.xxx.xxx.xxx,21,6,%ASA-6-113009: AAA retrieved default group policy (xxx) for user = testuser</P><P></P><P>2008-03-24,07:46:05,xxx.xxx.xxx.xxx,21,6,%ASA-6-113008: AAA transaction status ACCEPT : user = testuser</P><P></P><P>VPN 3000 Concentrator Example:</P><P>2008-03-24,03:03:07,xxx.xxx.xxx.xxx,23,5,1042195: 2008 Mar 24 01:58:42.650 CST -6:00 %AUTH-5-28: RPT=12964: 70.3.134.114: User [domain\testuser] Group [vpnremote-trusted] disconnected: Session Type: IPSec/UDP Duration: 0:28:15 Bytes xmt: 48160 Bytes rcv: 89152 Reason: Lost Service</P><P></P><P>I'm trying to get ASA 5520 to format the same as VPN 3000 Concentrator. We have reports that look for specifics in the syslog data.</P><P></P><P>Is this possible or not even an option due to different device types?</P><P></P><P>TIA...Scott</P> Mon, 11 Mar 2019 12:22:57 GMT https://community.cisco.com/t5/network-security/syslog-formats/m-p/933084#M940231 k9adv2 2019-03-11T12:22:57Z Re: Syslog formats https://community.cisco.com/t5/network-security/syslog-formats/m-p/933085#M940234 <HTML><HEAD></HEAD><BODY><P>Wont' work because of the different devices. The Concentrators were acquired from [I forget] so the logs are different. Sorry but you'll have to change your scripts. I've always found it useful to filter the scripts on the code type (ie ASA-6-113009). Pretty easy to change the script when Cisco changes something.</P><P></P><P>HTH</P></BODY></HTML> Thu, 27 Mar 2008 18:55:10 GMT https://community.cisco.com/t5/network-security/syslog-formats/m-p/933085#M940234 Collin Clark 2008-03-27T18:55:10Z