Filtering logs

[Thomas McLean]

Guys,

I'm getting to a stage that I'm beginning to be really happy with my CW logging but I'm at a cross roads now where I'm needing a little more help. I'm needing to do two reports with my firewalls, one that reports warnings -> emergencies in one report (daily) and another that reports everything daily. These have to be seperate reports but the only way I can do this is to change the severity log settings within the ASA that sends the log messagges to CW and then CW parses them into a daily report - what I would be looking for is that CW would be doing the filtering but I cannot see that option anywhere.

Can anyone advise me if the above is possible please?

Thanks,

Thomas.

[Michel Hegeraat]

Have you tried to create your own custom syslog reports?

That should do exactly what you want here.

There you can say what severity level you want in your report

Cheers,

Michel