cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
983
Views
0
Helpful
3
Replies

Cisco ASA syslog message for User password change event

shalendra2
Beginner
Beginner

Hi All,

         What is the syslog message id for User password change event for Cisco ASA Firewall.

Please suggest us.

Regards,

Shalendra

3 Replies 3

Aditya Ganjoo
Cisco Employee
Cisco Employee

Hi,

You can use the following syslog for this:

111010

Error Message %ASA-5-111010: User username, running application-name from IP ip addr, executed cmd
Explanation A user made a configuration change.
username —The user making the configuration change
application-name —The application that the user is running
ip addr —The IP address of the management station
cmd —The command that the user has executed

Regards,

Aditya

Please rate helpful posts and mark correct answers.

Please provide the relevant real time log description.

Regards,

Shalendra

Hi Shalendra,

If you make any changes with respect to the password you would see this syslog on the ASA.

You can even test it on the ASA by checking on the logging console,ASDM or a syslog server.

Regards,

Aditya

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: