On my firewall ASA5588x, I what to see when a user creates a VPN session and the duration of that session.
I inherited the config below. I added the last 6 entries thinking they would give information about AnyConnect.
logging enable
logging timestamp
logging buffer-size 1048576
logging monitor critical
logging buffered debugging
logging asdm informational
logging mail emergencies
logging from-address network_alerts@tm-america.com
logging recipient-address haggittmark@tm-america.com level critical
logging facility 23
logging host inside 192.168.130.97
logging class config mail warnings
logging class ha mail warnings
logging class ip mail warnings
logging class np mail warnings
logging class sys mail warnings
no logging message 106015
no logging message 313001
no logging message 313008
no logging message 106023
no logging message 710003
no logging message 106100
no logging message 302015
no logging message 302014
no logging message 302013
no logging message 302018
no logging message 302017
no logging message 302016
no logging message 302021
no logging message 302020
logging message 105008 level debugging
logging message 105009 level debugging
logging message 105005 level debugging
logging message 751020 level informational
logging message 751005 level informational
logging message 113019 level informational
logging message 113032 level informational
logging message 113035 level informational
logging message 113031 level informational
I thought 113019 would at least give me the duration. ( Error Message %ASA-4-113019: Group = group , Username = username , IP = peer_address , Session disconnected. Session Type: type , Duration: duration , Bytes xmt: count , Bytes rcv: count , Reason: reason )
I'm pretty sure my syslog server is working because I get messages from other sources. Is there something that should or should not be in this config? Are there other considerations?
