cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
420
Views
0
Helpful
3
Replies

Need information on logging ASA5505

Steven Couture
Level 1
Level 1

Hello,

I need to learn about logging and viewing the logs on an ASA5505.  I am new to this  - in general, I think logging means to track all traffic inbound to the firewall and then save it somewhere so I can look at to see what is going on.  Can someone explain the theory to me? Like what information I should be watching for?

 

Thanks

1 Accepted Solution

Accepted Solutions

Marvin Rhoads
Hall of Fame
Hall of Fame

I recommend you have a listen to the TAC Security Podcast #32. It had an excellent talk all about ASA syslogs and how to use them. You can find it (and all the other episodes) here.

Syslogs are much more than just connection and access-list records, although they can include those too. You basically set severity levels you are interested in and send the logs to a log server where they are archived and searchable (and perhaps setup to take certain action such as alert an admin if something goes wrong).

Many people set their logging level too high and then proceed to not use the syslog since a firewall with logging level 6 will create a message for every single tcp session establishment and teardown. That can often mean hundreds of thousand or even millions of message per day.

If you want an overview of the logging levels and how to setup logging in general, refer to this section of the configuration guide.

View solution in original post

3 Replies 3

Marvin Rhoads
Hall of Fame
Hall of Fame

I recommend you have a listen to the TAC Security Podcast #32. It had an excellent talk all about ASA syslogs and how to use them. You can find it (and all the other episodes) here.

Syslogs are much more than just connection and access-list records, although they can include those too. You basically set severity levels you are interested in and send the logs to a log server where they are archived and searchable (and perhaps setup to take certain action such as alert an admin if something goes wrong).

Many people set their logging level too high and then proceed to not use the syslog since a firewall with logging level 6 will create a message for every single tcp session establishment and teardown. That can often mean hundreds of thousand or even millions of message per day.

If you want an overview of the logging levels and how to setup logging in general, refer to this section of the configuration guide.

Thank you for your fast response Marvin - I will start here :)

johnlloyd_13
Level 9
Level 9

marvin,

 

this is great info! bookmarked!

Review Cisco Networking for a $25 gift card