ASA 5550 - Two different syslogs servers

Unanswered Question
Aug 10th, 2010

Hi to all.

In my Cisco ASA 5550, I need to set two different syslogs servers, and I need to send the system logs to the first one (only admins login/logout), and the traffic logs and all the rest (informational level) to the second one. Do you know if is it possible or not and, if yes, how to configure it? All suggestions will be really appreciated. Thanks.

I have this problem too.
2 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4.7 (3 ratings)
Loading.
Nitin Agarwal Tue, 08/10/2010 - 07:58

Hi,

As per my reserch it is not possible to have two syslog server configured and working at same time.

They can be configured as primary and secondary.

Regards,

Nitin agarwal.

mirober2 Tue, 08/10/2010 - 08:15

Hi Alessandro,

You can configure multiple syslog servers using multiple 'logging host' commands, such as:

logging trap warnings

logging host inside 10.1.1.1

logging host inside 10.1.1.2

This will send syslogs to both servers. However,  it does not meet your second requirement of sending different logs to each host. For that, you would have to use a different logging facility, such as 'logging mail' or 'logging asdm'.

Hope that helps.

-Mike

Kureli Sankar Tue, 08/10/2010 - 10:37

Alessandro,

You can send the same warning level to both syslogs servers.

You cannot send debug to one syslog server and critical to the other syslog server.

That would be nice if we can do that.  May be an ENH request is filed somewhere.

-KS

acimalacqua Tue, 08/10/2010 - 13:19

Thanks to all, guys.

I supposed it. I succeded to set two syslogs servers, but I had the "problem" to have the same logging level in both of them (just a "replica" of logs). I hope that Cisco can make this upgrade in the future, because it will be very usefull in my company to have different recipients for the logs. My area needs to have traffic logs for troubleshooting and a security area needs to have only the admin's login and logout to track them for Italian's laws. I'll keep in touch about this upgrade... Thanks again. Have a nice holidays.

Nagaraja Thanthry Tue, 08/10/2010 - 22:44

Hello,

While there is a limitation in the syslog server configurations, you could

use other logging methods to collect specific information. While it is not

very efficient method, if you are just concerned about login/logout messages

for security audit purposes, you could use email logging. You can create a

logging list and then send those messages to your email.

Example:

logging list mail message 111008

logging list mail message 111004

logging from-address

You can do similar things by sending specific log events to SNMP server as

well.

Hope this helps.

Regards,

NT

acimalacqua Sun, 03/20/2011 - 15:09

Hi,

just to take you updated and to suggest a solution to other users that need to solve the same problem, I want to tell you that I've solved it as you told me, and it's working. In detail, I've created a logging list with all the auth events I need, and I've configured the ASA to send a SNMP trap to a target device (Qradar Appliance in my case) that stores all the events. This solution is not very simple to manage, and I hope that Cisco can upgrade ASA's syslog functions and features in the next releases, but can help you in having different logs sent to different destinations, as requested to the Italian's laws to audit login and logout of administrators. Thanks for your help.

Alain-Florent Essome Mon, 02/17/2014 - 02:11

Hi Alessandro

can you please send me the solution ? i have the same proble and need to configure it. i will be happy to get the syslog config you don on the ASA

Thanks

Alain

Actions

This Discussion

Related Content