Cisco ASA syslog message for User password change event

[shalendra2]

Hi All,

         What is the syslog message id for User password change event for Cisco ASA Firewall.

Please suggest us.

Regards,

Shalendra

[Aditya Ganjoo]

Hi,

You can use the following syslog for this:

111010

Error Message %ASA-5-111010: User username, running application-name from IP ip addr, executed cmd
Explanation A user made a configuration change.
username —The user making the configuration change
application-name —The application that the user is running
ip addr —The IP address of the management station
cmd —The command that the user has executed

Regards,

Aditya

Please rate helpful posts and mark correct answers.

[shalendra2]

Please provide the relevant real time log description.

Regards,

Shalendra

[Aditya Ganjoo]

Hi Shalendra,

If you make any changes with respect to the password you would see this syslog on the ASA.

You can even test it on the ASA by checking on the logging console,ASDM or a syslog server.

Regards,

Aditya