cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2678
Views
5
Helpful
1
Replies

ESA Authentication Log

RSteveKadish
Level 1
Level 1

Hi all,

We have two IronPort Email Security Appliances and one Management Security Appliance.  I just took a look at the authentication log on one of my ESAs and I saw that the user "smaduser" was connecting from the MSA every few seconds.  This makes sense - the MSA has to check for message tracking information, etc. - but it makes the signal/noise ratio in the log extremely high.  Is there any way to keep the ESA from logging this normal activity or would we have to filter it out after FTP'ing the log from the device?

Thanks,

- Steve

1 Reply 1

Enrico Werner
Cisco Employee
Cisco Employee

Hi Steve,

you can try changing the log level of the authentication log by running the command logconfig on the CLI. Select EDIT and the authentication log file. The log level will be most likely 3 Information. You can try chaning it to 2 Warning and see if that helps.

Log level:

1. Critical

2. Warning

3. Information

4. Debug

5. Trace

Otherwise you will need to filter it out once downloaded from the appliance.

Regards,

Enrico

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: