Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Requesting for Syslog config help on ASA

I am trying to configure Syslog on ASA 5510 and 5505. I just want ASA to sent Syslog message for Warning. while i have only defined trap for Warning. it is still sending message for level 3,2, and 1

In Cisco notes it says

You can specify the severity level number (1 through 7) or name. For example, if you set the severity level to 3, then the ASA send syslog messages for severity levels 3, 2, and 1.

How I can limit my message to just Level to 3 instead of getting 2,1 level at same time..

logging enable

logging timestamp

logging buffer-size 128000

logging trap warnings  ---------------------only trying to send Warning but i am also getting Critical logs in my server

logging asdm informational

logging host inside 10.80.13.42

I also tried to do Class base but it is not sending any messages to syslog

logging enable

logging timestamp

logging list VPN level warnings

logging list VPN level warnings class auth

logging list VPN level warnings class vpn

logging list VPN level warnings class ssl

logging buffer-size 128000

logging buffered VPN

logging host inside 10.80.13.42

Please advice. thanks in advance...

1 ACCEPTED SOLUTION

Accepted Solutions
Hall of Fame Super Silver

Requesting for Syslog config help on ASA

The settings are, as noted in the documentation, inclusive of higher priority messages. The only way (on an ASA)  I know of excluding the Level 1,2 and 3 messages when you are logging Level 4 would be to specifically exclude the individual syslog messages by number.

Why would you not want the higher priority messages?

3 REPLIES
Hall of Fame Super Silver

Requesting for Syslog config help on ASA

The settings are, as noted in the documentation, inclusive of higher priority messages. The only way (on an ASA)  I know of excluding the Level 1,2 and 3 messages when you are logging Level 4 would be to specifically exclude the individual syslog messages by number.

Why would you not want the higher priority messages?

New Member

Requesting for Syslog config help on ASA

My Client only wants to receive message for warning into his external Syslog server so he can track VPN users login if we keep getting Critical logs then it will fill whole server quickly and you wont be able to see login users

Can you please suggest me, how i can exclude syslog level 1,2 and only receive 3

thank you

Hall of Fame Super Silver

Requesting for Syslog config help on ASA

Probably the easiest way to do what you're asking would be to elevate the severity level (say to "1" = "alert" - see levels here) of the specific messages you are looking for and then making that your global logging level.

If you're getting too many "other" severity 1 messages, you have a much bigger problem than tracking VPN users.

The VPN users login syslog message ID (I don't know the message ID off the top of my head) would be elevated like this example

87
Views
0
Helpful
3
Replies