Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

ASA 5550 - Two different syslogs servers

Hi to all.

In my Cisco ASA 5550, I need to set two different syslogs servers, and I need to send the system logs to the first one (only admins login/logout), and the traffic logs and all the rest (informational level) to the second one. Do you know if is it possible or not and, if yes, how to configure it? All suggestions will be really appreciated. Thanks.

Everyone's tags (2)
9 REPLIES
New Member

Re: ASA 5550 - Two different syslogs servers

Hi,

As per my reserch it is not possible to have two syslog server configured and working at same time.

They can be configured as primary and secondary.

Regards,

Nitin agarwal.

Cisco Employee

Re: ASA 5550 - Two different syslogs servers

Hi Alessandro,

You can configure multiple syslog servers using multiple 'logging host' commands, such as:

logging trap warnings

logging host inside 10.1.1.1

logging host inside 10.1.1.2

This will send syslogs to both servers. However,  it does not meet your second requirement of sending different logs to each host. For that, you would have to use a different logging facility, such as 'logging mail' or 'logging asdm'.

Hope that helps.

-Mike

Cisco Employee

Re: ASA 5550 - Two different syslogs servers

Alessandro,

You can send the same warning level to both syslogs servers.

You cannot send debug to one syslog server and critical to the other syslog server.

That would be nice if we can do that.  May be an ENH request is filed somewhere.

-KS

New Member

Re: ASA 5550 - Two different syslogs servers

Thanks to all, guys.

I supposed it. I succeded to set two syslogs servers, but I had the "problem" to have the same logging level in both of them (just a "replica" of logs). I hope that Cisco can make this upgrade in the future, because it will be very usefull in my company to have different recipients for the logs. My area needs to have traffic logs for troubleshooting and a security area needs to have only the admin's login and logout to track them for Italian's laws. I'll keep in touch about this upgrade... Thanks again. Have a nice holidays.

Cisco Employee

Re: ASA 5550 - Two different syslogs servers

Hello,

While there is a limitation in the syslog server configurations, you could

use other logging methods to collect specific information. While it is not

very efficient method, if you are just concerned about login/logout messages

for security audit purposes, you could use email logging. You can create a

logging list and then send those messages to your email.

Example:

logging list mail message 111008

logging list mail message 111004

logging from-address

You can do similar things by sending specific log events to SNMP server as

well.

Hope this helps.

Regards,

NT

New Member

Re: ASA 5550 - Two different syslogs servers

Hi,

just to take you updated and to suggest a solution to other users that need to solve the same problem, I want to tell you that I've solved it as you told me, and it's working. In detail, I've created a logging list with all the auth events I need, and I've configured the ASA to send a SNMP trap to a target device (Qradar Appliance in my case) that stores all the events. This solution is not very simple to manage, and I hope that Cisco can upgrade ASA's syslog functions and features in the next releases, but can help you in having different logs sent to different destinations, as requested to the Italian's laws to audit login and logout of administrators. Thanks for your help.

ASA 5550 - Two different syslogs servers

Hi Alessandro

can you please send me the solution ? i have the same proble and need to configure it. i will be happy to get the syslog config you don on the ASA

Thanks

Alain

Cisco Employee

ASA 5550 - Two different syslogs servers

Pls. refer CSCea93753. It is still not resolved. You are welcome to add your comments to the enhancement request.

-Kureli

New Member

Hello,

Hello,

I am currently facing the same issue and need a solution. Did you ever find one?

Regards,

Abdhija

4097
Views
19
Helpful
9
Replies