Cisco ASA firewalls - Logging changes made through ASDM

[PottaPitot]

Hi,

We wish to log the firewall rule administration done through the Cisco asdm on the Cisco asa firewalls to our SIEM solution.

Do we need to set the ASDM logging to informational or does setting the logging asdm have any effect on the logs sent to the SIEM for the firewall rules applied through the ASDM?

We have set the logging trap to informational and logging asdm to alerts but we are not seeing all activities or sometimes nothing on the SIEM when the firewall rules are applied through the ASDM.

Thanks in advance,

Potta Pitot

[Seb Rupik]

Hi there,

Changing the log level for ASDM will not have any effect on the SIEM device as it is a different target.

You need to change the trap level:

!
logging trap <severity_level>
!

https://www.cisco.com/c/en/us/td/docs/security/asa/asa94/config-guides/cli/general/asa-94-general-config/monitor-syslog.html#ID-2121-00000169

cheers,

Seb.