Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Pix 515 stop responding enabling logging

Hi everyone ! I've got a PIX 515E (ios version 6.2(2), pdm version (2.1) 32Mb ram).

Enabling logging and monitoring results (both from pix itself or sending to syslog server) Pix stop responding and give me some messages like:

PIX IS DISALLOWING CONNECTIONS. The only way to re-establish normal conditions is to disable anykind of logging and reload PIX.

Which kind of problem could be ? Memory lack ? Ios bug ?

Thank you very much.

Herman

7 REPLIES
Silver

Re: Pix 515 stop responding enabling logging

Are you using tcp logging? Do a "write t" , and look for the "logging host" line. If it says tcp, then whenever the pix cannot log to the logging server, it will block connections. What are you using as a syslog server? Doing standards based UDP logging does not have this "feature"

New Member

Re: Pix 515 stop responding enabling logging

Thank you for your answer. I'm using kiwi as syslog server and i'm using a tcp logging. Do you advise me to use UDP rather than TCP ?

I'm not sure but I think tcp is the default type of loggin connection in PIX

Bye

erman

New Member

Re: Pix 515 stop responding enabling logging

I had the exact same issue yesterday, with the same results. I am also running 6.22....

Silver

Re: Pix 515 stop responding enabling logging

Some people feel tcp logging is a bit more secure. But if you use it, you need to figure out how to keep the logging server running 24x7, or else expect these incidents.

New Member

Re: Pix 515 stop responding enabling logging

On any version of the pix if you choose to log via TCP and the syslog server is not reachable from the pix for any reason your pix will stop passing traffic. With Kiwi choose to use UDP and you will be fine. I have had a pix logging to a Kiwi server (desktop running 2000server) for at least a year now and no issues.

New Member

Re: Pix 515 stop responding enabling logging

Hi everybody !! Thank you very much for your support.

I will try to use UDP logginging and I will keep you informed.

Thanks

Herman

New Member

Re: Pix 515 stop responding enabling logging

Same issue. I was going to post this exact same thing and then found this thread. I am using a PIX 515 and software v5.1(2). I have tried using a command like "logging host dmz 10.x.x.x" which should use the default of udp/514, and I too get this blocking behavior. I am using PFSS as the syslog server.

First time I tried to turn on logging it was with TCP and a level of "debugging": a bad idea, which brought the PIX down. The second time, I removed the existing "logging host" command and entered a new one using the default protocol and port (i.e. I did not specify any protocol/port, so it should have defaulted to udp/514) and tried "logging trap informational" I got about 15 log messages (progress, at least!) before I tried a ping through the PIX and it again shut down, blocking out all traffic. Both times someone had to telnet from inside and reload it.

Is it possible that when I don't specify the protocol and port, it is actually defaulting to TCP? When I do "show logging" it does not say.

164
Views
0
Helpful
7
Replies
CreatePlease login to create content