topic Monitor logging on PIX515(E) in Network Security

Monitor logging on PIX515(E)

dannypostma — Mon, 11 Mar 2019 12:02:14 GMT

Hi,

We have a PIX515(E) and we want to monitor the traffic. So that we have the posibility to see which user is visiting which websites and how often. I believe there is a certain logging command, isn't there?

Could anyone tell me which logging that would be and how to turn in on?

Thanks in advance.

Danny.

Re: Monitor logging on PIX515(E)

abinjola — Wed, 13 Feb 2008 14:36:11 GMT

Logs at debug level would not tell you which website you visits but would definitely tell you the ip address..along with the ports information...

First you would need to install a syslog server software on one of the computers. You may

download one of the popular kiwisyslog server from

http://www.kiwisyslog.com/software_downloads.htm .

It is listed as Kiwi Syslog Daemon and latest version is 7.1.0. You may download standard

edition that runs as a program.

Once the syslog server is installed you will then need to login into the PIX in

configuration terminal mode and enter the following commands.

logging host [in_if_name] ip_address

(example: logging host inside 1.2.3.4

We are assuming syslog server is installed on computer with IP address 1.2.3.4 in the

inside network.)

logging timestamp

logging trap 7

logging on

"Logging on level 7 is only for debugging purposes and do not leave pix on level 7 "

see if this helps !

Re: Monitor logging on PIX515(E)

cisco24x7 — Wed, 13 Feb 2008 15:52:57 GMT

logging on

logging host 1.2.3.4

logging timestamp

logging trap 6

you do NOT need "logging trap 7" to tell you which website users visit. "logging trap 6"

will generate less syslog messages and it also

can tell you which website user(s) visit.

They both can tell you the same thing but

"logging trap 6" generates much less message.

I am not a windows person. If you use

Linux/Unix syslog-ng, you can have granular

syslog than windows. Just make sure you

have the "-r" option in your syslog config

so that it can accept syslog from other

devices.

CCIE Security

Re: Monitor logging on PIX515(E)

abinjola — Wed, 13 Feb 2008 16:09:25 GMT

Requster..you need to be on logging trap 7 to see www/urls..

http://www.cisco.com/en/US/docs/security/asa/asa72/command/reference/l2_72.html#wp1690864

Re: Monitor logging on PIX515(E)

dannypostma — Thu, 14 Feb 2008 11:26:41 GMT

Alright, thanks everybody for the answers. I will read the documenation and I'll let you know if it resolved my problem.

With Kind Regards,

Danny