Where can I find Cisco ASA syslog format description? Log example:
Dec 11 08:01:24 <IP> %ASA-6-302015: Built outbound UDP connection 447235 for outside:NTP_Server_2/<port> (NTP_Server_2/<port>) to identity:<IP>/<port> (<IP>/<port>)
Dec 11 08:01:24 <IP> %ASA-6-302015: Built outbound UDP connection 447235 for outside:NTP_Server_2/<port> (NTP_Server_2/<port>) to identity:<IP>/<port> (<IP>/<port>)
Dec 11 08:01:24 <IP> %ASA-4-106023: Deny udp src dmz:OCSP_Server/<port> dst outside:DNS_Server_DO/<port> by access-group "dmz" [0x123a465e, 0x4c7bf613]
Dec 11 08:01:24 <IP> %ASA-4-106023: Deny udp src dmz:OCSP_Server/<port> dst outside:DNS_Server_DO/<port> by access-group "dmz" [0x123a465e, 0x4c7bf613]
Dec 11 08:01:31 <IP> %ASA-6-302013: Built outbound TCP connection 447236 for outside:KAV_Update_Server/<port> (KAV_Update_Server/<port>) to dmz:OCSP_Server/<port> (OCSP_Server/<port>)
Dec 11 08:01:31 <IP> %ASA-6-302013: Built outbound TCP connection 447236 for outside:KAV_Update_Server/<port> (KAV_Update_Server/<port>) to dmz:OCSP_Server/<port> (OCSP_Server/<port>)
Dec 11 08:01:31 <IP> %ASA-6-302014: Teardown TCP connection 447236 for outside:KAV_Update_Server/<port> to dmz:OCSP_Server/<port> duration 0:00:00 bytes 14804 TCP FINs
Dec 11 08:01:38 <IP> %ASA-6-302014: Teardown TCP connection 447234 for outside:KAV_Update_Server/<port> to dmz:TSP_Server/<port> duration 0:01:08 bytes 134781 TCP FINs
Dec 11 08:01:38 <IP> %ASA-6-302014: Teardown TCP connection 447234 for outside:KAV_Update_Server/<port> to dmz:TSP_Server/<port> duration 0:01:08 bytes 134781 TCP FINs
Dec 11 08:01:38 <IP> %ASA-6-106015: Deny TCP (no connection) from KAV_Update_Server/<port> to TSP_Server/<port> flags RST on interface outside
Dec 11 08:01:38 <IP> %ASA-6-106015: Deny TCP (no connection) from KAV_Update_Server/<port> to TSP_Server/<port> flags RST on interface outside
Dec 11 08:01:39 <IP> %ASA-4-106023: Deny udp src dmz:TSP_Server/<port> dst outside:DNS_Server_DO/<port> by access-group "dmz" [0x123a465e, 0x8c20f21]
Dec 11 08:01:53 %ASA-4-106023: last message repeated 9 times
Dec 11 08:01:53 <IP> %ASA-6-302013: Built outbound TCP connection 447237 for outside:KAV_Update_Server/<port> (KAV_Update_Server/<port>) to dmz:TSP_Server/<port> (TSP_Server/<port>)
Dec 11 08:01:53 <IP> %ASA-6-302013: Built outbound TCP connection 447237 for outside:KAV_Update_Server/<port> (KAV_Update_Server/<port>) to dmz:TSP_Server/<port> (TSP_Server/<port>)
Dec 11 08:01:53 <IP> %ASA-6-302014: Teardown TCP connection 447237 for outside:KAV_Update_Server/<port> to dmz:TSP_Server/<port> duration 0:00:00 bytes 11420 TCP FINs
I found only this doc from Cisco where nothing explained about "Message_text" field.