Question about syslog messages

[jorge.chavez]

Hello
looking for assistance. Trying to figure out if there is a way to restrict the type of syslog messages I'm seeing.
For example, is there a way to filter out syslog message %ASA-6-302013, and only see syslog message Syslog Message %ASA-6-106100 when i issue command 'show log'?
thanks in advance

[Karsten Iwen]

Yes, you can restrict it in a couple of ways:

First you only see logs in the range that you enable:

he1-asa1(config)# logging buffered ?

configure mode commands/options:
  <0-7>          Enter syslog level (0 - 7)
  WORD           Specify the name of logging list
  alerts         Immediate action needed           (severity=1)
  critical       Critical conditions               (severity=2)
  debugging      Debugging messages                (severity=7)
  emergencies    System is unusable                (severity=0)
  errors         Error conditions                  (severity=3)
  informational  Informational messages            (severity=6)
  notifications  Normal but significant conditions (severity=5)
  warnings       Warning conditions                (severity=4)

You can turn off specific messages:

he1-asa1(config)# no logging message ?

configure mode commands/options:
  <100000-999999>  Specify a message number

And you can change the severity level of specific messages:

he1-asa1(config)# logging message 752015 level ?

configure mode commands/options:
  <0-7>          Enter syslog level (0 - 7)
  alerts         Immediate action needed           (severity=1)
  critical       Critical conditions               (severity=2)
  debugging      Debugging messages                (severity=7)
  emergencies    System is unusable                (severity=0)
  errors         Error conditions                  (severity=3)
  informational  Informational messages            (severity=6)
  notifications  Normal but significant conditions (severity=5)
  warnings       Warning conditions                (severity=4)

Here, 752015 by default is a severity 3 message. If you are logging in severity 5 and you don't want to see this specific message you can change it to 6.

[Marvin Rhoads]

What Karsten said for a permanent fix.

If you just want to see only certain log events then something like this:

show log | include 106100