cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
9536
Views
29
Helpful
9
Replies

ASA 5550 - Two different syslogs servers

acimalacqua
Level 1
Level 1

Hi to all.

In my Cisco ASA 5550, I need to set two different syslogs servers, and I need to send the system logs to the first one (only admins login/logout), and the traffic logs and all the rest (informational level) to the second one. Do you know if is it possible or not and, if yes, how to configure it? All suggestions will be really appreciated. Thanks.

9 Replies 9

Nitin Agarwal
Level 1
Level 1

Hi,

As per my reserch it is not possible to have two syslog server configured and working at same time.

They can be configured as primary and secondary.

Regards,

Nitin agarwal.

mirober2
Cisco Employee
Cisco Employee

Hi Alessandro,

You can configure multiple syslog servers using multiple 'logging host' commands, such as:

logging trap warnings

logging host inside 10.1.1.1

logging host inside 10.1.1.2

This will send syslogs to both servers. However,  it does not meet your second requirement of sending different logs to each host. For that, you would have to use a different logging facility, such as 'logging mail' or 'logging asdm'.

Hope that helps.

-Mike

Alessandro,

You can send the same warning level to both syslogs servers.

You cannot send debug to one syslog server and critical to the other syslog server.

That would be nice if we can do that.  May be an ENH request is filed somewhere.

-KS

acimalacqua
Level 1
Level 1

Thanks to all, guys.

I supposed it. I succeded to set two syslogs servers, but I had the "problem" to have the same logging level in both of them (just a "replica" of logs). I hope that Cisco can make this upgrade in the future, because it will be very usefull in my company to have different recipients for the logs. My area needs to have traffic logs for troubleshooting and a security area needs to have only the admin's login and logout to track them for Italian's laws. I'll keep in touch about this upgrade... Thanks again. Have a nice holidays.

Hello,

While there is a limitation in the syslog server configurations, you could

use other logging methods to collect specific information. While it is not

very efficient method, if you are just concerned about login/logout messages

for security audit purposes, you could use email logging. You can create a

logging list and then send those messages to your email.

Example:

logging list mail message 111008

logging list mail message 111004

logging from-address

You can do similar things by sending specific log events to SNMP server as

well.

Hope this helps.

Regards,

NT

Hi,

just to take you updated and to suggest a solution to other users that need to solve the same problem, I want to tell you that I've solved it as you told me, and it's working. In detail, I've created a logging list with all the auth events I need, and I've configured the ASA to send a SNMP trap to a target device (Qradar Appliance in my case) that stores all the events. This solution is not very simple to manage, and I hope that Cisco can upgrade ASA's syslog functions and features in the next releases, but can help you in having different logs sent to different destinations, as requested to the Italian's laws to audit login and logout of administrators. Thanks for your help.

Hi Alessandro

can you please send me the solution ? i have the same proble and need to configure it. i will be happy to get the syslog config you don on the ASA

Thanks

Alain

Pls. refer CSCea93753. It is still not resolved. You are welcome to add your comments to the enhancement request.

-Kureli

abdhija.s
Level 1
Level 1

Hello,

I am currently facing the same issue and need a solution. Did you ever find one?

Regards,

Abdhija

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: