ASA 5512X logging to either SSD Drive or USB

[max-sandoval]

I like to capture  the syslogs to either the option of installing a 100GB SSD drive, or USB, what would be the best route?

[Marvin Rhoads]

I don't believe either option is supported for ASA syslog messages.

The SSD drive is intended for exclusive use of the NGFW features. A device in the USB port is available for file transfers or as a potential storage location for boot, ASDM etc. as well as a means of transferring files onto the ASA.

The internal log buffer storage is in memory and, when you choose internal log, is not customizable - it goes to flash memory. Reference.

[max-sandoval]

Hi Marvin, I was already thinking of sending the syslog over to an external server as an option, but if I was to do that, the internal syslog will remain in case of failure on the external ?

[Marvin Rhoads · Accepted solution]

Yes-  if configured, you will still have the internal syslog. It is limited per the reference to a relatively small size.

If you're logging at anything higher that level 4 you will usually start wrapping the internal syslog buffer after a very short while so it is of limited utility. More for near-real-time troubleshooting than for foresnic analysis.