ASA logging issue

[mze]

We are unable to get the logging information on this below mentioned devices.

[johnd2310]

Hi,

What is your logging configuration?

Thanks

John

[balaji.bandi]

where you not seeing logs ? or sending logs to syslog ?

check below document for reference ;

https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html

[mze]

logging issue 

[mze]

logging issue  

[marce1000]

                                  - >... logging host Inside 10.1.1.1. 17/10516 

 As far as I understand  it the arguments following IP address of the syslog server should denote Protocol/Port-number. Protocol refers to UDP or TCP.

 M.

[Patryk Nieborak]

Hey, 

As per my understanding you're trying to send SYSLOGs to the external SYSLOG server. Questions that come to my mind:

1) Is there end-to-end connectivity between ASA(s) and SYSLOG server?

2) Can the traffic be policy-dropped (f.e. ACL, another firewall etc.) before reaching the server?

You can refer to this documentation file: https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html#anc6

[mze]

thanks 

[balaji.bandi · Accepted solution]

we understand that,  try below what is the outcome, does the syslog server reachable to ASA 10.1.1.1

no logging host Inside 10.1.1.1. 17/10516

logging host Inside 10.1.1.1

[balaji.bandi]

logging host Inside 10.1.1.1. 17/10516

what you mean in red color your point of view ?

[Georg Pauwen · Accepted solution]

Hello,

which syslog server are you using ? It might not understand facility 16 - 23. Try and remove

logging facility 22

from the configuration.

[Richard Burts]

I think the suggestion about logging facility is a good one. I also wonder about the use of a non standard protocol port number for the syslog messages. Are you sure that the syslog server is looking for port 10516?

[paul driver · Accepted solution]

Hello
Suggest also to decrease your logging queue, so the asa wont discard so many if it cannot handle them due to such a large queue size.and also reset the logging port to udp 514, test again

llogging host inside x.x.x.x udp 514
logging queue 100