Email Notification

[dianewalker]

I just setup email notification. I want to make sure that I get email notification when there are problems with the ASA.  How do I test to see if I receive anything in my email?  Thanks.

logging enable
logging timestamp
logging list Events level errors class auth
logging list Events level errors class session
logging list Events level errors class sys
logging console errors
logging trap informational
logging asdm informational
logging mail errors
logging from-address ciscoasa@consoto.com
logging recipient-address admin@consoto.com level errors
logging facility 19

Diane

[Marcin Latosiewicz · Accepted solution]

Diane,

You have not indicated whether you configured the SMTP server and version it is.

(Command reference link, example later on: http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/l2.html#wp1773126 )

Typically if I wanted to test. The easiest way you be to:

1) Enable "logging mail info" which should FLOOD SMTP server with emails. (be careful with this step)

2) Capture on ASA to see if we're sending packets to SMTP server

3) Capture/logs on SMPT server.

Marcin

[mvsheik123 · Accepted solution]

Hi,

You can test per Marcin recomendation or below is working configuration on our ASAs (email address modified). We receive emails for any alerts. You can also add secondary SMTP server.

logging mail alerts
logging from-address ASA@myorg.com
logging recipient-address admin@myorg.com level alerts
!
smtp-server 192.168.29.30
!

hth

MS

[dianewalker]

I got email notification from one ASA.  However, I do not get any email notifications from another ASA.  Both ASA's have the same logging statements.  Do you have any suggestions?  Thanks.

logging enable
logging timestamp
logging list Events level errors class auth
logging list Events level errors class session
logging list Events level errors class sys
logging console errors
logging trap informational
logging asdm informational
logging mail alerts
logging from-address ciscoasa@consoto.com
logging recipient-address admin@consoto.com level alerts
logging facility 19
logging host Inside 216.132.251.1
logging class auth monitor emergencies

smtp-server 216.132.251.12

Thanks.

Diane

[mvsheik123]

Hi,

Just want to make sure, the second ASA able to reach the mail server? Also, the ASA generating 'alerts' logs?

hth

MS

[dianewalker]

Thanks for your prompt response, MS.  I am able to ping the SMTP server from the ASA.  How do you check to see if the ASA generates the "alerts" log?  Do you have any other suggestions?

Thanks.

Diane

[mvsheik123]

Alert message are 'severity 1' type messages. Check the below link, this gives you more information. Unless there is an even that falls under 'Alert' category, you do not receive any email. You may want to change the email message level :

logging mail alerts to critical/warning.. but it all depends on your requirement.

http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logsev.html#wp1009233

hth

MS

[dianewalker]

Thanks for your prompt response and information.   By changing the different types of messages, I still do not get email notification.  Do you have any other suggestions?  I can't think of anything else to fix this problem.

Thanks.

Diane

[mvsheik123]

You are welcome. This is how I recomend to test. enable 'logging buffered alerts/critical/warnings. This is will log any matched event to ASA local log which you can check by issues 'show log' command on ASA. Keep the mail level same as logging buffered level (atleast for testing). In this case If you see a message in ASA log, this should trigger an email.

you can also try by Marcin's suggestion- but informational will cause lot of messages.

hth

MS