To reduce/drop unnecessary logs in syslog server

[Jigar Dave]

Hello Cognizants, Greetings

I have a question, How is it possible to reduce unnecessary logs in syslog servers, I want to see/concentrate only logs which are critical and above level 7?

I am discussing about taking consideration of ASA/PIX Firewall, IDS,IPS, Router and Switches in enterprise environment

hope everyone share their experience, expertise and advices for this topic

- JD

[varrao]

Hi Jigar,

There are different types of logging levels that you can enable on the ASA, here they are as follows:

http://www.cisco.com/en/US/partner/docs/security/asa/asa83/system/message/logsevp.html

Refer to this guide as well:

http://www.cisco.com/en/US/partner/products/hw/vpndevc/ps2030/products_configuration_example09186a00805a2e04.shtml

This is going to be really beneficial for you.

Thanks,

Varun

[fsebera]

I am logged in with my CCO account. Both links seem to be blocked by Cisco's FORBIDDEN message.

Do you have any links for blocking syslog messages that don't require "employee" status??

Tks

Frank

[Antonio Knox]

You may want to consider logging lists, which gives more control over the logs:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00805a2e04.shtml#use

[fsebera · Accepted solution]

Jigar,

I use ASA5500 IOS 8.0(4).

Once I know the log message number I want to omit, I use this CLI command in the config:

:

no logging message (message #)

:

Here is a public reference to ASA logging:

http://www.ciscopress.com/articles/article.asp?p=424447&seqNum=3

:

Hope this helps

Frank

[Jigar Dave]

Varun, Antonio, fsebera - Thanks a lot, I will let you

know if more help needed.

HAGD

- JD