Hi,
Naturally a long term solution for gathering this information would be to send logs to a separate Syslog server.
On the syslog server you will have better tools to go through the logs than just looking at the log buffer on the CLI of the ASA/PIX or on the ASDM real time monitor.
The very basic "logging" configuration would be
logging on
logging timestamp
logging device-id hostname
logging trap informational (or notifications)
logging host
This would include only the logs for syslog server.
There are options to tweak the log output but the above is a pretty basic setting without any extra.
With the above configuration (logging trap informational) you would get logs of every connection formed and every connection teardown. You could then parse the logs for the log messages of SMTP (TCP/25) connections. Naturally this would also log same for translations and other information and depending on the size of the network or amount of the connections this might generate quite a lot of logs.
You can also configure a "log" keyword on "access-list" lines that permit traffic (SMTP in this case). You can also configure a non default "level" for the messages after the "log" keyword.
Most of our Syslog setups log with pretty basic configurations and we use the Syslog server to check for the logs we need.
Your logging setup/configuration naturally depends on your needs. Is it something needed for long term monitoring of connections or just for some quick troubleshooting purposes. Generally I think it would be good to keep logs of most things that happen on the firewall to help with troubleshooting etc.
- Jouni
