Audit Log Trail from Cisco ASA

[NeWGuy1109]

Hello,

I need help in understanding the audit trail in Cisco ASA.

How can i cross check if audit logs are being generated in ASA and are being forwarded to syslog server correctly

[balaji.bandi]

Aan Accounting server (the third "A" in AAA) is the answer. An external RADIUS or TACACS+ server (like Cisco ISE) can keep a log of all actions.

You can also set the ASA to log all login and command execution actions and send those logs to an external syslog server.

logging enable
logging list cmds message 111009

logging trap cmds

logging host inside x.x.x.x

You can replace 'inside' with the name of interface where syslog server x.x.x.x resides.

[balaji.bandi]

Aan Accounting server (the third "A" in AAA) is the answer. An external RADIUS or TACACS+ server (like Cisco ISE) can keep a log of all actions.

You can also set the ASA to log all login and command execution actions and send those logs to an external syslog server.

logging enable
logging list cmds message 111009

logging trap cmds

logging host inside x.x.x.x

You can replace 'inside' with the name of interface where syslog server x.x.x.x resides.

[NeWGuy1109]

Thanks for the reply,

I am using an external syslog server where all informational logs re being forwarded.. however 111009 is classified as Debugging in syslog setup, so do i need to change it to Informational ?