Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We need to redirect the logs from our Cisco firewall(SA520-K9) to syslogd server(it's a CentOS server). The settings are done on the firewall. But the messages from firewall are going to /var/log/messages and console instead of /var/log/firewall.log which is our requirent.

*.info;mail.none;authpriv.none;cron.none        /var/log/messages

authpriv.*                      /var/log/secure

mail.*                          -/var/log/maillog


cron.*                          /var/log/cron

*.emerg                         *

uucp,news.crit                      /var/log/spooler

local7.*     /var/log/firewall.log

This is our syslog config file. Any advices ?

Log Severity > Warning and set to sent to syslog in the device

share|improve this question

2 Answers 2

default facility used by the Cisco ASA is 20 (LOCAL4):

  local4.*     /var/log/firewall.log
share|improve this answer
    
Any idea about SA520-K9 ? –  nitins Feb 4 '11 at 6:38
    
sa520 has no cli. It's not an ios device. –  Jason Berg Feb 4 '11 at 6:51
    
@Jason Berg: What facility "Administration> Logging > Logs Facility and Severity" ? –  alvosu Feb 4 '11 at 8:16
    
Log Severity > Warning and set to sent to syslog –  nitins Feb 4 '11 at 8:26
1  
Use tcpdump to determinate facility: tcpdump -pn -s 0 -vv -i eth0 host $IP. Facility ... (N) –  alvosu Feb 4 '11 at 8:28

Check the raw messages and see the facility and the severity that is used. (%rawmsg% in rsyslog ) ... I don't know about syslogd, but you can always use wireshark for that. (the other way is to check every facility until you get your job done)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.