ASA 5550 - Two different syslogs servers

[acimalacqua]

Hi to all.

In my Cisco ASA 5550, I need to set two different syslogs servers, and I need to send the system logs to the first one (only admins login/logout), and the traffic logs and all the rest (informational level) to the second one. Do you know if is it possible or not and, if yes, how to configure it? All suggestions will be really appreciated. Thanks.

[Nitin Agarwal]

Hi,

As per my reserch it is not possible to have two syslog server configured and working at same time.

They can be configured as primary and secondary.

Regards,

Nitin agarwal.

[mirober2]

Hi Alessandro,

You can configure multiple syslog servers using multiple 'logging host' commands, such as:

logging trap warnings

logging host inside 10.1.1.1

logging host inside 10.1.1.2

This will send syslogs to both servers. However,  it does not meet your second requirement of sending different logs to each host. For that, you would have to use a different logging facility, such as 'logging mail' or 'logging asdm'.

Hope that helps.

-Mike

[Kureli Sankar]

Alessandro,

You can send the same warning level to both syslogs servers.

You cannot send debug to one syslog server and critical to the other syslog server.

That would be nice if we can do that.  May be an ENH request is filed somewhere.

-KS

[acimalacqua]

Thanks to all, guys.

I supposed it. I succeded to set two syslogs servers, but I had the "problem" to have the same logging level in both of them (just a "replica" of logs). I hope that Cisco can make this upgrade in the future, because it will be very usefull in my company to have different recipients for the logs. My area needs to have traffic logs for troubleshooting and a security area needs to have only the admin's login and logout to track them for Italian's laws. I'll keep in touch about this upgrade... Thanks again. Have a nice holidays.

[Nagaraja Thanthry]

Hello,

While there is a limitation in the syslog server configurations, you could

use other logging methods to collect specific information. While it is not

very efficient method, if you are just concerned about login/logout messages

for security audit purposes, you could use email logging. You can create a

logging list and then send those messages to your email.

Example:

logging list mail message 111008

logging list mail message 111004

logging from-address

You can do similar things by sending specific log events to SNMP server as

well.

Hope this helps.

Regards,

NT

[acimalacqua]

Hi,

just to take you updated and to suggest a solution to other users that need to solve the same problem, I want to tell you that I've solved it as you told me, and it's working. In detail, I've created a logging list with all the auth events I need, and I've configured the ASA to send a SNMP trap to a target device (Qradar Appliance in my case) that stores all the events. This solution is not very simple to manage, and I hope that Cisco can upgrade ASA's syslog functions and features in the next releases, but can help you in having different logs sent to different destinations, as requested to the Italian's laws to audit login and logout of administrators. Thanks for your help.

[Alain-Florent Essome]

Hi Alessandro

can you please send me the solution ? i have the same proble and need to configure it. i will be happy to get the syslog config you don on the ASA

Thanks

Alain

[Kureli Sankar]

Pls. refer CSCea93753. It is still not resolved. You are welcome to add your comments to the enhancement request.

-Kureli

[abdhija.s]

Hello,

I am currently facing the same issue and need a solution. Did you ever find one?

Regards,

Abdhija