Syslog Server

[Lake]

Hi Guys,

I would like to configure our ASA firewall to send all it's logs to a syslog server. Does anyone know of a good syslog server which I can use? Any help would be greatly appreciated.

Thanks,

Lake

[Seb Rupik · Accepted solution]

Hi there,

At the most simple end of the spectrum, just configure a syslog service on a BSD/ Linux box. This setup would require a little effort to search and parse the logs once collected.

At the other end take a look at graylog: https://www.graylog.org/ . This is slightly more complicated to setup, but search the logs is a breeze!

...both are free and should provide you with what you need.

cheers,

Seb.

[Lake]

Thank you very much.

[Patrick.Bryant]

Please confirm my conclusion: although a USB drive can be mounted on the ASA 5506W-X firewall as "disk1:", there is no way to redirect syslog to this device?

If that's true, it's a real bummer since we are using the firewall in the field (outside a data center) and it means we will have to drag another box along with us. Sending syslog to a remote server isn't an option since Internet connectivity isn't continuous.

[Seb Rupik · Accepted solution]

There is another option for your situation, use the logging flash-bufferwrap command. This will save the existing buffer before it begins to be overwritten with new logs, to the internal flash.

You could then use a script to periodically scrap these .TXT files off the ASA and delete them when completed.

Your next challenge would to then inject these logs into your syslog server...?

cheers,

Seb.

[Lake]

Thanks Seb