Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We need to redirect the logs from our Cisco firewall(SA520-K9) to syslogd server(it's a CentOS server). The settings are done on the firewall. But the messages from firewall are going to /var/log/messages and console instead of /var/log/firewall.log which is our requirent.

*.info;mail.none;authpriv.none;cron.none        /var/log/messages

authpriv.*                      /var/log/secure

mail.*                          -/var/log/maillog

cron.*                          /var/log/cron

*.emerg                         *

uucp,news.crit                      /var/log/spooler

local7.*     /var/log/firewall.log

This is our syslog config file. Any advices ?

Log Severity > Warning and set to sent to syslog in the device

share|improve this question

default facility used by the Cisco ASA is 20 (LOCAL4):

  local4.*     /var/log/firewall.log
share|improve this answer
Any idea about SA520-K9 ? – nitins Feb 4 '11 at 6:38
sa520 has no cli. It's not an ios device. – Jason Berg Feb 4 '11 at 6:51
@Jason Berg: What facility "Administration> Logging > Logs Facility and Severity" ? – alvosu Feb 4 '11 at 8:16
Log Severity > Warning and set to sent to syslog – nitins Feb 4 '11 at 8:26
Use tcpdump to determinate facility: tcpdump -pn -s 0 -vv -i eth0 host $IP. Facility ... (N) – alvosu Feb 4 '11 at 8:28

Check the raw messages and see the facility and the severity that is used. (%rawmsg% in rsyslog ) ... I don't know about syslogd, but you can always use wireshark for that. (the other way is to check every facility until you get your job done)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.