09-11-2013 01:56 AM - edited 03-11-2019 07:36 PM
Guys,
Is there any option in ASA to set alerts such as email whenever somebody login to ASA through telnet, ssh or asdm?
How can I set this alert system?
Solved! Go to Solution.
09-11-2013 03:44 AM
Hi,
At its very basic I would imagine you could need something like this
smtp-server
logging list LOGIN message 113012
logging list LOGIN message 113015
logging list LOGIN message 605004
logging list LOGIN message 605005
logging from-address
logging recipient-address
logging mail LOGIN
The above configuration should send emails from succesfull and unsuccesfull logins.
This is something that I just quickly tested and there would probably be some other log messages IDs that could be added to the list LOGIN.
Do notice when you configure a "logging mail LOGIN" this will mean that only the Syslog IDs mentioned in the list LOGIN will be sent to the email. I would recomend that you always use a list here and not just some logging level. Using a logging level instead of a specified list of Syslog IDs might generate a large amount of log messages sent and cause problems.
- Jouni
09-11-2013 03:44 AM
Hi,
At its very basic I would imagine you could need something like this
smtp-server
logging list LOGIN message 113012
logging list LOGIN message 113015
logging list LOGIN message 605004
logging list LOGIN message 605005
logging from-address
logging recipient-address
logging mail LOGIN
The above configuration should send emails from succesfull and unsuccesfull logins.
This is something that I just quickly tested and there would probably be some other log messages IDs that could be added to the list LOGIN.
Do notice when you configure a "logging mail LOGIN" this will mean that only the Syslog IDs mentioned in the list LOGIN will be sent to the email. I would recomend that you always use a list here and not just some logging level. Using a logging level instead of a specified list of Syslog IDs might generate a large amount of log messages sent and cause problems.
- Jouni
09-11-2013 05:35 AM
Hi Jouni,
Thanks very much. That is working great. But it was not reporting ASDM login. But I have found the solution.
logging list LOGIN message 606001
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide