2.Cisco ASA Syslog Configuration

The Cisco ASA firewall generates syslog messages for many different events. For example, interfaces going up or down, security alerts, debug information and more. We can configure the ASA to tell it how much and where to store logging information.

Before you configure logging, make sure your clock has been configured.

Let’s take a look at our configuration options.

1.Configuration

First, make sure logging is enabled:

ASA1(config)# logging enable

1.1.Logging to SSH or Telnet

We’ll start by looking at logging on SSH or telnet sessions. Let’s see what level of logging options we have:

ASA1(config)# logging monitor ?

configure mode commands/options:
  <0-7>          Enter syslog level (0 - 7)
  WORD           Specify the name of logging list
  alerts         Immediate action needed           (severity=1)
  critical       Critical conditions               (severity=2)
  debugging      Debugging messages                (severity=7)
  emergencies    System is unusable                (severity=0)
  errors         Error conditions                  (severity=3)
  informational  Informational messages            (severity=6)
  notifications  Normal but significant conditions (severity=5)
  warnings       Warning conditions                (severity=4)

The logging monitor command configures the level of logging that we want to use. For example, when you select debugging (level 7) then it will log all lower levels as well. If you select “errors” then it will only log level 3,2,1 and 0. We will select debugging so that we can see debug messages on our telnet or SSH session:

ASA1(config)# logging monitor debugging

The logging level has been configured but we still need to enable logging, here’s how:

ASA1(config)# terminal monitor

This enables logging up to the debug level on your telnet or SSH session. Let’s continue with another example…

1.2.Logging to Internal Buffer

The ASA has an internal buffer that we can use for syslog messages. By default it’s enabled so let’s enable it:

ASA1(config)# logging buffered warnings

This will log all syslog messages with level “warnings” or lower to the internal buffer. We can also configure the size of the internal buffer:

ASA1(config)# logging buffer-size 8192

By default it’s only 4KB, I changed it to 8KB with the logging buffer-size command. Let’s see if we can find some syslog information in our internal buffer. Here’s an example how we can test it:

ASA1(config)# interface E0/0
ASA1(config-if)# shutdown
ASA1(config-if)# no shutdown

Shutting an interface is something that will be logged. Now use the show logging command to view the log:

ASA1# show logging 
Syslog logging: enabled
    Facility: 20
    Timestamp logging: disabled
    Standby logging: disabled
    Debug-trace logging: disabled
    Console logging: disabled
    Monitor logging: level debugging, 32 messages logged
    Buffer logging: level warnings, 3 messages logged
    Trap logging: disabled
    Permit-hostdown logging: disabled
    History logging: disabled
    Device ID: disabled
    Mail logging: disabled
    ASDM logging: disabled
%ASA-4-411003: Interface Ethernet0/1, changed state to administratively down
%ASA-4-411001: Line protocol on Interface Ethernet0/1, changed state to up

You can see the logging settings but also two entries at the bottom…the interface going down and up. Let’s try something else now…

1.3.Logging to console

We can log syslog messages to the console like this:

ASA1(config)# logging console warnings

This will log all syslog messsages with level “warnings” or lower to the console. Keep in mind that the console is only running at 9600 bps so it’s easy to overburden it with logging messages. If there are too many logging messages then it will be rate-limited and even dropped if the console can’t handle it.

1.4.Logging to e-mail

We can also send syslog messages directly to e-mail, here’s an example:

ASA1(config)# logging mail alerts
ASA1(config)# logging from-address asa@networklessons.com
ASA1(config)# logging recipient-address info@networklessons.com
ASA1(config)# smtp-server 192.168.1.1

This will send all syslog messages with level “alerts” or lower to an e-mail address. Don’t forget to configure a SMTP server.

1.5.Logging to ASDM

We can also log to ASDM where you can see the syslog messages in the dashboard. Here’s how to enable it:

ASA1(config)# logging asdm debugging

This is how we can send all syslog messages to ASDM. Once you login, you can see the syslog messages at the bottom:

Above you can see the syslog messages in ASDM.

1.6.Logging to Syslog Server

A good choice is to send syslog messages to a syslog server. Here’s how to do it:

ASA1(config)# logging host INSIDE 192.168.1.3
ASA1(config)# logging trap alerts

You need to configure the host and the level of syslog messages. Here’s what it looks like on a syslog server:

Above you see some incoming messages on my syslog server.

1.7.Logging to SNMP server

Last but not least, we can send syslog messages as SNMP traps to a SNMP server. Here’s how:

ASA1(config)# snmp-server host INSIDE 192.168.1.1 trap community MY_COMMUNITY
ASA1(config)# snmp-server enable traps syslog
ASA1(config)# logging history notifications

First we configure the SNMP server and the community and then we tell the ASA to send syslog messages using SNMP traps. The logging history commands sets the syslog level.

That’s all there is, I hope this lesson has been useful