Hi,
In our ArcSight ESM we are seeing the "bytes in" and "bytes out" field as the same number for ASA syslog events.
From looking at the log explanation (www.cisco.com/c/en/us/td/docs/security/asa/syslogs/logmsgs2.html#pgfId-6941209) , I noticed that the bytes field only gives the total data transfer of the connection. Could this be the reason why it has it as both fields?
