No Messages from Syslog Server

dianewalker · ‎02-09-2009

We have ASA 5550 (ver. 8.0.4). We configured the ASA so that messages can be sent to Syslog server. We were able to ping the Syslog server from the ASA. However, no messages are sent to the Syslog server. The Syslog server has been configured to accept messages from the ASA. Below is part of the config of the ASA. Thanks.

logging enable

logging list Events level errors class auth

logging list Events level errors class session

logging list Events level errors class sys

logging console errors

logging asdm informational

logging mail errors

logging from-address <A HREF="mailto:ASA@mydomain.com">ASA@mydomain.com</A>

logging recipient-address <A HREF="mailto:alerts@mydomain.com">alerts@mydomain.com</A> level errors

logging host Inside XXX.X.X.XXX

eddie.mitchell · ‎02-10-2009

I don't see the configuration line to define your logging trap. You should have a line like this:

logging trap (I have mine set to informational)

I would also recommend enabling timestamps on your syslog messages via:

logging timestamp

Hope this helps.

dianewalker · ‎02-10-2009

I added "logging trap informational" and "logging timestamp" statements on the ASA. Still, nothing showed up in the Syslog server. Do you have any other suggestions? Thanks.

dianewalker · ‎02-10-2009

Eddie,

Please ignore my previous message. I added "logging facility 19" and now I started to receive messages from the Syslog server. May I ask you another question? Do I open the Sylog file by using Excel? I just wonder if you would use other utility to open the Syslog file. Thanks again.

eddie.mitchell · ‎02-10-2009

Are you using a Kiwi Syslog server? What are you trying to do with the logs? If you're trying to do some level of analytics and run reports based on the syslog messages, there are a bunch of useful tools available for this:

http://www.kiwisyslog.com/kb/info:-log-reporting-and-analysis/

dianewalker · ‎02-10-2009

Thanks for your prompt response and information, Eddie. My Syslog server is not a Kiwi server. I am using the logs to troubleshoot problems and to see the activities on the ASA. I will continue using Excel to open the Log files. Thanks very much again.

eddie.mitchell · ‎02-11-2009

If it's a Unix based syslog server, you can just use the standard commands to view and search through the syslog files.

cat

cat | grep

tail

tail -f

dianewalker · ‎02-11-2009

Thank you very much.