Hi,
we are trying to decrease the number of deny logs logged in our SIEM.
The approach is to disable message 106023 and to log only 106100, by adding "deny ip any any log" at the end of all access lists. This way we are receiving summarized deny logs instead of logs for each denied connection.
But after implementing this, every 5 minutes the error message is logged:
%ASA-1-106101: Number of cached deny-flows for ACL log has reached limit
We tried decreasing the interval to 30 seconds but no success.
Does anybody know if the logs from the flow memory are dropped (and not logged) after the flow memory is reached?
Regards,
Borut
