ASA syslog traffic

[cesseltine]

I work with LogRhythm and I am trying to filter out logs that did not get through the ASA firewall.  I see logs with the following message ID: 302013 Connection Built, 302015 Built UDP Connection, 302016 Connection Teardown,  Some of the 302016 logs show 0 duration with data listed, but if I do a search I do not see a traffic allow.  Do the three events I listed show traffic got through the ASA or is it safe to filter them out.

Thank You

Chris

[nspasov]

I would recommend reviewing the guide below that will give you details about each type of syslog message generated on the ASA:

https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog.html

Thank you for rating helpful posts!