Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Recomended PIX logging level

Can anyone advise on a recommended level of logging for a PIX firewall?

I tried informational and debugging but in only a couple of hours I have a 700MB log file on my syslog server!

We need to be able to investigate incidents if and when they arise retrospectivly.

Thanks

3 REPLIES
New Member

Re: Recomended PIX logging level

I use 3 different solutions to log the PIX data and recommend (6) Information logging to get HTTP sites.

1. Use FireGen product for syslog analysis and purchased version of kiwisyslog to zip the files after a certain size or time.

www.eventid.net/firegen/firegenpix2.asp

2. EIQ Networks Network Security Analyzer(eiqnetworks.com) for Excellent log analysis, reporting and alerting. $900 for 515 + $500 for 501-506.

3. Get the Ciscoworks VMS product for PIX, IDS & Router management a logging. Good product and multifunctional in management, alerting and IDS.

Level Number Level Keyword Description

0 emergency

System unusable.

1 alert

Immediate action needed.

2 critical

Critical condition.

3 error

Error condition.

4 warning

Warning condition.

5 notification

Normal but significant condition.

6 informational

Informational message only.

7 debugging

Appears during debugging only.

New Member

Re: Recomended PIX logging level

I use Level (6) also, I have used the full version of kiwi and Firegen.

I also use the program Insideout that logs everything and does charts/graphs that are nice. you can look by user or Protocol.

http://www.stonylakesolutions.com/sls/index.jsp

New Member

Re: Recomended PIX logging level

The following is what I have. You can log everything, and then filter out what you don't want.

logging monitor debugging

logging buffered debugging

logging trap debugging

logging facility 21

logging queue 4096

logging host dmz 10.1.1.205

no logging message 106015

no logging message 106023

no logging message 305006

no logging message 305012

no logging message 305011

no logging message 305010

no logging message 305009

no logging message 710005

no logging message 400011

no logging message 400014

no logging message 400015

no logging message 302015

no logging message 302014

no logging message 302013

no logging message 304001

no logging message 609002

no logging message 609001

no logging message 302016

The no logging messages that I selected got rid of around 99% or more of the messages. I didn't want to get every url that comes to our website or that we go to.

It will be easy for you to filter out the unnecessary responses. By choosing what you want to filter, you will be able to get all of the important messages. There are several hundred logging messages, and the 18 I picked get rid of gigs worth of unnecessary logging.

Cheers,

Jim

1043
Views
8
Helpful
3
Replies
CreatePlease login to create content