Thanks for the quick reply, I will be using Kiwi syslog. Can you tell me how I can configure my ASA to log just log on's and log off's to a specific syslog? I know the ASA can be very chaty.

login username information can be found in:-

"debug" level, messages

7-715047,7-715075,7-715036,7-715046

TCP/UDP connection information per user can be found in:-

"info" level, messages

6-302013, 6-302014

Sadly both debug, and info levels do send high amount of traffic, but if you have bought KiwiSyslog - you can filter and save disk space!

HTH>

Sorry wrong info there - you can create a filter in the ASA to only send the specific logs you want....I was thinking about PIX!

So which filter would I create if I only wanted login's and Out's? Or how do I create that filter?

Never actually done it before, but looking at the command line something like:-

logging list test-log-filter message 715046

logging list test-log-filter message 715047

logging list test-log-filter message 715075

logging list test-log-filter message 715036

logging list test-log-filter level Debugging class auth

I think you will have to play with it, someother netpro's might have done this before....or you could see if there is a way to do it from the asdm?

HTH>

I'd be interested in knowing a solution to this too if anyone else has any ideas?

(Have tried the suggestion above but it doesn't seem to be doing it for me although hopefully its along the right lines and maybe just some further tweaking is required?)

Thanks!