PIX syslog facility and level

[hernacar]

I've found a document on cisco @ "http://cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094030.shtml"

explaining what both of these services are, but the concept is still unclear. Can you clarify please. We have a Network Intelligence syslog server that we direct alerts.

thanks,

Carlos.

[mostiguy]

What level does network intelligence recommend? Isn't it level 6 or 7? Level refers to the level of the event - emergency is zero, debug is 7. Facility is somewhat of a way for syslog to support multiple logs concurrently - meaning, you might have your pix to use facility 1, and a router to use 2, and configure your syslog server to log each facility in certain ways.

network intelligence has extensive cisco pix support, so they should have their recommendations documented.

[hernacar]

Thanks for the response I think this makes a little more sense to me now. I guess in the beginning of syslog facility was a method for tagging to store messages on the server. The logging trap is what the pix decides the level of alerts to send to the syslog server. I've experimented and go what I needed.

thanks again!

Carlos.