Cisco ASA Mail Logging - Group syslog messages

[Christian Woegerbauer]

Hello!

I configured logging via e-mail for messages related to the Cisco ASA botnet filter. It should send syslog messages to the admin when the botnet filter recognizes traffic from infected hosts :

logging list e-mail-notification message 338002
logging list e-mail-notification message 338001
logging list e-mail-notification message 338003
logging list e-mail-notification message 338004
logging mail e-mail-notification
logging from-address firewall@domain.com
logging recipient-address admin@domain.com level warnings

The logging works fine, mails are sent. But I receive one email per syslog messages. So if there are 1000 syslog messages regarding the botnet filter the admin got 1000 mails in his inbox.

My question is, is it possible to summarize/group these messages into one mail? For instance to send an email each 100 syslog messages with these 100 messages in the body.

Thanks,

Woger

[Vibhor Amrodia]

Hi,

This is not possible to configure on the ASA device. The reason is that if you group all the syslog together , how would the ASA device judge when to send the trigger out. If only a single syslog is generated and not the others.

The trigger can only be a syslog being generated.

Thanks and Regards,

Vibhor Amrodia