Interfaces log

[Adaa Tajuddin]

Hi,

How can i check the interfaces logs in ASA firewall and filter it by specific time in ASDM? or CLI? Currently using ASA 5506. 

[Sheraz.Salim]

if logging already enabled on ASA, you can just enable it on the buffer similar to the following:

logging buffer-size 8096

logging buffered informational

To view the logs use the following command:

sh logging

"show logging" will show you the logging information from the "buffered logging". If you want to see the logging information from asdm logging, you may use the command "show logging asdm". buffered loggign and asdm logging can be configured independently from each other, for example "logging buffered informational" and "logging asdm warnings". You may also configure the ASA to send logs via syslog to a logging server or even via email to a mail address.

reference https://learningnetwork.cisco.com/thread/99827

[Adaa Tajuddin]

Thanks a lot for your reply sir. Its works but how can i show the interfaces logs in specific time? Is it possible? I want to check the logs that happened 12 hours ago. the command that u suggest can only show the real time logs. Thanks. 

[Sheraz.Salim · Accepted solution]

the only option I can suggest is to configure a sys log server. (Kivi syslog) server could be your best bet.

https://www.kiwisyslog.com/kiwi-syslog-server

[Adaa Tajuddin]

Which means if i don't have the syslog server, i can't see all the previous interfaces log right? 

[Sheraz.Salim]

with syslog server (Kiwi server) you have to off load the log from ASA to your (computer/any storage device etc) which mean where ever you configure/install the kiwi software. Kiwi syslog server come with ten network device to let you configure to log the syslog.

[Adaa Tajuddin]

Ok now i understood. Thanks so much for your help! :)