topic Re: No Messages from Syslog Server in Network Security

No Messages from Syslog Server

dianewalker — Fri, 21 Feb 2020 11:16:48 GMT

We have ASA 5550 (ver. 8.0.4). We configured the ASA so that messages can be sent to Syslog server. We were able to ping the Syslog server from the ASA. However, no messages are sent to the Syslog server. The Syslog server has been configured to accept messages from the ASA. Below is part of the config of the ASA. Thanks.

logging enable

logging list Events level errors class auth

logging list Events level errors class session

logging list Events level errors class sys

logging console errors

logging asdm informational

logging mail errors

logging from-address <A HREF="mailto:ASA@mydomain.com">ASA@mydomain.com</A>

logging recipient-address <A HREF="mailto:alerts@mydomain.com">alerts@mydomain.com</A> level errors

logging host Inside XXX.X.X.XXX

Re: No Messages from Syslog Server

eddie.mitchell — Tue, 10 Feb 2009 18:59:09 GMT

I don't see the configuration line to define your logging trap. You should have a line like this:

logging trap (I have mine set to informational)

I would also recommend enabling timestamps on your syslog messages via:

logging timestamp

Hope this helps.

Re: No Messages from Syslog Server

dianewalker — Tue, 10 Feb 2009 20:50:30 GMT

I added "logging trap informational" and "logging timestamp" statements on the ASA. Still, nothing showed up in the Syslog server. Do you have any other suggestions? Thanks.

Re: No Messages from Syslog Server

dianewalker — Tue, 10 Feb 2009 21:35:17 GMT

Eddie,

Please ignore my previous message. I added "logging facility 19" and now I started to receive messages from the Syslog server. May I ask you another question? Do I open the Sylog file by using Excel? I just wonder if you would use other utility to open the Syslog file. Thanks again.

Re: No Messages from Syslog Server

eddie.mitchell — Tue, 10 Feb 2009 22:15:11 GMT

Are you using a Kiwi Syslog server? What are you trying to do with the logs? If you're trying to do some level of analytics and run reports based on the syslog messages, there are a bunch of useful tools available for this:

http://www.kiwisyslog.com/kb/info:-log-reporting-and-analysis/

Re: No Messages from Syslog Server

dianewalker — Wed, 11 Feb 2009 02:42:07 GMT

Thanks for your prompt response and information, Eddie. My Syslog server is not a Kiwi server. I am using the logs to troubleshoot problems and to see the activities on the ASA. I will continue using Excel to open the Log files. Thanks very much again.

Re: No Messages from Syslog Server

eddie.mitchell — Wed, 11 Feb 2009 13:01:22 GMT

If it's a Unix based syslog server, you can just use the standard commands to view and search through the syslog files.

cat

cat | grep

tail

tail -f

Re: No Messages from Syslog Server

dianewalker — Thu, 12 Feb 2009 02:54:23 GMT

Thank you very much.