03-15-2010 07:51 AM - edited 03-11-2019 10:21 AM
I am logging to MARS from a Cisco ASA 5520 and read somewhere (can't remember where) that you can configure the ASA to include the domain name in the accessed URL (instead of just IP) of the log entries. This is the data I need logged to MARS. One site said you needed to enable web filtering to do this, but everything I've found on web filtering is actually URL filtering (using websense). I've been searching, but keep coming up with nothing. Any help is appreciated.
03-15-2010 09:56 AM
AFAIK, the ASA can not do this. You probably wouldn't want it too anyway, the overhead of the lookup would be pretty taxing on the device.
Hope it helps.
03-15-2010 08:51 PM
With the resolution of this defect CSCsw6851, when http inspection is enabled the syslog 304001 will now log the host name instead of the ip address.
This is resolved in 008.002(001.010) 008.001(002.014) 008.000(005) 008.000(004.024)
-KS
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide