email administrators when inspect rules are violated

[cisco]

I have a Pix515 and was wondering if there is an easy way to email administratos when an inspect rule is violated. For example one of my ESMTP rules was violated and the following was logged in syslog:

%PIX-4-108004: ESMTP Classification: Dropped connection for ESMTP Request from outside:208.65.144.247/31095 to inside:mail.ddi.org_INSIDE/25; matched Class 4: header line length gt 998

It is an easy fix, but is there an easier way to be notified without looking in syslog or manually setting up for each case that I want to be notified for? Can the pix email me if one of the inspect rules denies traffic?

[jj27]

Not that I know of. You could setup SNMP on the PIX and relay all messages to a logging server and use SNMP traps to gather the messages you want then generate e-mails based on that.

[cisco24x7]

This is very simple. Write a simple Perl script with regex experession and watch the syslog message for what you want to see. Put in a condition that if the script sees it, it send you an email. The script can be written 5 minutes.

[srue]

you can use SMTP logging.

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/monitor.html#wp1064823

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/monitor.html#wp1064823