Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Multiple Syslog Servers

I know in the ASA5520 we use, i can created multiple syslog servers to send syslogs to. However, I am

wondering, is there a way to segment the data?  IE - We have a "generic" syslog server that gets all the syslog data (ncluding Informational), but I would like to create a second syslog entry on the ASA (pointing to a different IP address) and have it ONLY send specific message types.

Basically, I am wanting to have the messages related to the Botnet filtering send to a differnt syslog server.

Is this possible?

3 REPLIES
Cisco Employee

Re: Multiple Syslog Servers

Unfortunately, that cannot be configured.

The syslogs sent will be the same to all syslog servers.

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/monitor.html

PK

Cisco Employee

Re: Multiple Syslog Servers

Here is a thought may be this might work for you.

Refer this link for botnet:

https://supportforums.cisco.com/docs/DOC-8782

botnet syslogs

338001 - 338004

338101 - 338104

338201 - 338204

338301 - 338310

Refer this link for logging commands:http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/l2.html#wp1772272

1. configure a logging list and send it to buffer and wrap that to ftp server


hostname(config)# logging list my-list 338001 - 338004
hostname(config)# logging list my-list 338101 - 338104
hostname(config)# logging list my-list 338201 - 338204
hostname(config)# logging list my-list 338301 - 33831
hostname(config)# logging buffered my-list
hostname(config)# logging ftp-server 10.10.10.1 /syslogs userid password
hostname(config)# logging ftp-bufferwrap

2 Then you can send other syslogs to another syslog server

hostname(config)# logging trap 3
hostname(config)# logging host inside 10.10.10.2

-KS



















New Member

Multiple Syslog Servers

I was wondering also if there is a way to send only specific log messages (defined by the logging list) to one server while still sending the rest to another syslog server?

9041
Views
0
Helpful
3
Replies