Syslog over TCP?

Answered Question
Jan 29th, 2009

Hi all,

Does anyone know if the MARS can accept syslog over TCP? The issue is that I want the ASA to stop making new connections in case the connection is lost to the MARS.

Thanks in advance!



I have this problem too.
0 votes
Correct Answer by rajett about 7 years 8 months ago

The configuration on MARS is in the bottom of the table located at:

And yes, SECURE is the key word needed, but only works if you specify TCP.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
rajett Thu, 01/29/2009 - 09:48

For the ASA:

MARS release 4.x and 5.x support syslog over UDP.

Release 6.x supports Syslog over UDP and Secure Syslog on TCP

It does not support unsecured syslog on TCP.

jfoldager Thu, 01/29/2009 - 11:24


Thank you very much for the answer.

Does the optional 'secure' keyword in the 'logging host' command in ASA 8.x enable the same secure syslog that is supported in MARS release 6.x?

randytoni Wed, 02/04/2009 - 12:54

add'l related question - can Snare use this same secure syslog protocol to talk to MARS?

rajett Wed, 02/04/2009 - 13:15

No. Secure Syslog is only supported from the ASA.

randytoni Wed, 02/04/2009 - 13:18

thanks rajett - so as I understand it, MARS will only listen for syslog on udp 514 in R6, with the exception being ASA which uses secure syslog?

thanks for the prompt replies


This Discussion