How do I apply different custom message lists to different syslog servers?
from the documents (https://www.cisco.com/c/en/us/td/docs/security/asa/asa910/configuration/general/asa-910-general-config/monitor-syslog.html#ID-2121-0000048e) our network engineer tried:
Create the group “list-sec”:
ciscoasa(config)# logging list list-sec level 6**
set the message ID’s requested to group:
ciscoasa(config)# logging list list-sec message 716001-716002
ciscoasa(config)# logging list list-sec message 716007
ciscoasa(config)# logging list list-sec message 716039
ciscoasa(config)# logging list list-sec message 716052
ciscoasa(config)# logging list list-sec message 716056-716057
Apply severity and class:
ciscoasa(config)# logging list list-sec level critical
ciscoasa(config)# logging list list-sec level warning class vpn
And then when setting up the syslog server as the destination you then set the output to use the custom message list:
ciscoasa(config)# logging host interface_name IP protocol/port
ciscoasa(config)# logging trap list-sec
The response i get is this from my network engineer:
"I can apply it only to all destinations. So if multiple syslog server are configured, all messages to all of them are limited based on the last custom list applied"
Is this a known limitation? The document online clearly states:
"
Custom Message Lists
Creating a custom message list is a flexible way to exercise control over which syslog messages are sent to which output destination. In a custom syslog message list, you specify groups of syslog messages using any or all of the following criteria:
"
And that implies you can have multiple lists for different destinations?
Please can someone explain this as I am not 100% confident with the response i am getting internally.
