0

I have an ASA5520 that is set up to send logs to a splunk syslog server. the setup works for a while, usually around 24 hours or so, but then stops until either the logging is reconfigured (twiddling the ports) or the ASA is restarted.

what should i be looking at to resolve this issue? im not sure if its the splunk syslog daemon ignoring connections or the ASA that gets messed up and stops sending.

id like to enable the 'dont pass traffic without logging working' option, but without a stable connection to syslog, thats a non starter.

tried so far: TCP and UDP, different ports, changing the logging level

Improve this question

1 Answer 1

Reset to default
1

Put a packet sniffer on the Splunk host, set up a capture filter to capture only packets that originate from the ASA, start a capture, when splunk stops "seeing" data from the ASA look at the capture and see if traffic is still coming in from the ASA, if it is then the problem is with Splunk, if it's not then the problem is with the ASA or the network between the two.

Improve this answer
2
  • this is totally the right answer, however in this installation i dont have permission to install a packet capture utility.
    – Devnull
    Dec 7, 2010 at 14:59
  • If you're able to and have the equipment, you could install a packet sniffer on an intermediary host and connect a hub between the 3 hosts (the hub is essentially acting as a network tap) or you could install a packet sniffer on an intermediary host and configure the switch to mirror traffic from the ASA connected port to the intermediary host connected port.
    – joeqwerty
    Dec 7, 2010 at 15:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .