topic Re: Creating custom event lists to be sent to syslog server (ASA in Network Security https://community.cisco.com/t5/network-security/creating-custom-event-lists-to-be-sent-to-syslog-server-asa-5520/m-p/880859#M954769 <HTML><HEAD></HEAD><BODY><P>Unless it's possible to create an access rule which includes my external web server IP range and if any thing is denied/triggered then log it to critical?</P></BODY></HTML> Tue, 19 Feb 2008 16:33:42 GMT jamesgonzo 2008-02-19T16:33:42Z Creating custom event lists to be sent to syslog server (ASA 5520) https://community.cisco.com/t5/network-security/creating-custom-event-lists-to-be-sent-to-syslog-server-asa-5520/m-p/880853#M954763 <P>Hi, I'm hoping this is possible. I need to set the syslog ID of 106023 to error level (currently warning) only for about a dozen IP addresses only (as it generates millions of logs) can I do this, I can't see a way?</P> Mon, 11 Mar 2019 12:04:34 GMT https://community.cisco.com/t5/network-security/creating-custom-event-lists-to-be-sent-to-syslog-server-asa-5520/m-p/880853#M954763 whiteford 2019-03-11T12:04:34Z Re: Creating custom event lists to be sent to syslog server (ASA https://community.cisco.com/t5/network-security/creating-custom-event-lists-to-be-sent-to-syslog-server-asa-5520/m-p/880854#M954764 <HTML><HEAD></HEAD><BODY><P>Nopes</P></BODY></HTML> Tue, 19 Feb 2008 14:38:49 GMT https://community.cisco.com/t5/network-security/creating-custom-event-lists-to-be-sent-to-syslog-server-asa-5520/m-p/880854#M954764 abinjola 2008-02-19T14:38:49Z Re: Creating custom event lists to be sent to syslog server (ASA https://community.cisco.com/t5/network-security/creating-custom-event-lists-to-be-sent-to-syslog-server-asa-5520/m-p/880855#M954765 <HTML><HEAD></HEAD><BODY><P>It's all or nothing then?</P><P></P><P>I want to basically send alerts to my syslog server when my DMZ web servers (on my ASA) have denied access to Internet users attempting to hack. 106023 ID shows this.</P></BODY></HTML> Tue, 19 Feb 2008 15:44:59 GMT https://community.cisco.com/t5/network-security/creating-custom-event-lists-to-be-sent-to-syslog-server-asa-5520/m-p/880855#M954765 jamesgonzo 2008-02-19T15:44:59Z Re: Creating custom event lists to be sent to syslog server (ASA https://community.cisco.com/t5/network-security/creating-custom-event-lists-to-be-sent-to-syslog-server-asa-5520/m-p/880856#M954766 <HTML><HEAD></HEAD><BODY><P>you can't lower the log level to a specific message ID for few IPs..though you may filter it on KIWI log server</P></BODY></HTML> Tue, 19 Feb 2008 16:04:45 GMT https://community.cisco.com/t5/network-security/creating-custom-event-lists-to-be-sent-to-syslog-server-asa-5520/m-p/880856#M954766 abinjola 2008-02-19T16:04:45Z Re: Creating custom event lists to be sent to syslog server (ASA https://community.cisco.com/t5/network-security/creating-custom-event-lists-to-be-sent-to-syslog-server-asa-5520/m-p/880857#M954767 <HTML><HEAD></HEAD><BODY><P>I want to basically send alerts to my syslog server when my DMZ web servers (on my ASA) have denied access to Internet users attempting to hack. 106023 ID shows this.</P><P></P><P>106023 creates to many alerts on it's own for my database I think it will fill up fast. What a shame. </P></BODY></HTML> Tue, 19 Feb 2008 16:06:18 GMT https://community.cisco.com/t5/network-security/creating-custom-event-lists-to-be-sent-to-syslog-server-asa-5520/m-p/880857#M954767 jamesgonzo 2008-02-19T16:06:18Z Re: Creating custom event lists to be sent to syslog server (ASA https://community.cisco.com/t5/network-security/creating-custom-event-lists-to-be-sent-to-syslog-server-asa-5520/m-p/880858#M954768 <HTML><HEAD></HEAD><BODY><P>do you want to report all the traffic for 106023 to KIWI..well thats possible, however as whitefor asked, you can't point logs for this message ID for few IPS...either its all traffic or none at all</P></BODY></HTML> Tue, 19 Feb 2008 16:12:32 GMT https://community.cisco.com/t5/network-security/creating-custom-event-lists-to-be-sent-to-syslog-server-asa-5520/m-p/880858#M954768 abinjola 2008-02-19T16:12:32Z Re: Creating custom event lists to be sent to syslog server (ASA https://community.cisco.com/t5/network-security/creating-custom-event-lists-to-be-sent-to-syslog-server-asa-5520/m-p/880859#M954769 <HTML><HEAD></HEAD><BODY><P>Unless it's possible to create an access rule which includes my external web server IP range and if any thing is denied/triggered then log it to critical?</P></BODY></HTML> Tue, 19 Feb 2008 16:33:42 GMT https://community.cisco.com/t5/network-security/creating-custom-event-lists-to-be-sent-to-syslog-server-asa-5520/m-p/880859#M954769 jamesgonzo 2008-02-19T16:33:42Z