ASA - Syslog shows hostname need IP

[Andy White]

Hello,

I can't figure this out.  I am sending logs from one ASA to our syslog server and it displays on the syslog server as the hostname of the ASA, however our other ASA shows its IP, how can I get the first ASA to send its logs and show as its IP and not hostname as I prefer this?

Thanks

[Marvin Rhoads]

I don't think this is a setting on the ASA causing the behavior you are seeing. The ASA command for sending logs to a syslog server is very basic without any option for choosing to use a name (or not):

hostname(config)# logging host interface_name ip_address [tcp[/port] | udp[/port]] [format emblem]

I suspect something on the syslog server - does it perhaps have a local hosts file entry for the ASA appearing by hostname?

[dkuzmenkov]

Use this command:

asa5520(config)#logging device-id ?

configure mode commands/options:

  context-name  Specifies to use the name of the current security context to

                uniquely identify syslog messages from the system

  hostname      Specifies to use the hostname to uniquely identify syslog

                messages from the system

  ipaddress     Specifies to use the IP address of the Firewall interface to

                uniquely identify messages from the system

  string        Specifies the text string to uniquely identify the syslog

                messages from the system

for example:

asa5520(config)#logging device-id ipaddress