cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
326
Views
0
Helpful
2
Replies

Set alert for ASA login

lzakariya
Level 1
Level 1

Guys,

Is there any option in ASA to set alerts such as email whenever somebody login to ASA through telnet, ssh or asdm?

How can I set this alert system?

1 Accepted Solution

Accepted Solutions

Jouni Forss
VIP Alumni
VIP Alumni

Hi,

At its very basic I would imagine you could need something like this

smtp-server

logging list LOGIN message 113012

logging list LOGIN message 113015

logging list LOGIN message 605004

logging list LOGIN message 605005

logging from-address

logging recipient-address level informational

logging mail LOGIN

The above configuration should send emails from succesfull and unsuccesfull logins.

This is something that I just quickly tested and there would probably be some other log messages IDs that could be added to the list LOGIN.

Do notice when you configure a  "logging mail LOGIN" this will mean that only the Syslog IDs mentioned in the list LOGIN will be sent to the email. I would recomend that you always use a list here and not just some logging level. Using a logging level instead of a specified list of Syslog IDs might generate a large amount of log messages sent and cause problems.

- Jouni

View solution in original post

2 Replies 2

Jouni Forss
VIP Alumni
VIP Alumni

Hi,

At its very basic I would imagine you could need something like this

smtp-server

logging list LOGIN message 113012

logging list LOGIN message 113015

logging list LOGIN message 605004

logging list LOGIN message 605005

logging from-address

logging recipient-address level informational

logging mail LOGIN

The above configuration should send emails from succesfull and unsuccesfull logins.

This is something that I just quickly tested and there would probably be some other log messages IDs that could be added to the list LOGIN.

Do notice when you configure a  "logging mail LOGIN" this will mean that only the Syslog IDs mentioned in the list LOGIN will be sent to the email. I would recomend that you always use a list here and not just some logging level. Using a logging level instead of a specified list of Syslog IDs might generate a large amount of log messages sent and cause problems.

- Jouni

Hi Jouni,

Thanks very much. That is working great. But it was not reporting ASDM login. But I have found the solution.

logging list LOGIN message 606001

Review Cisco Networking products for a $25 gift card