How to redirect logs from Cisco firewall to a specific file?

Question

We need to redirect the logs from our Cisco firewall(SA520-K9) to syslogd server(it's a CentOS server). The settings are done on the firewall. But the messages from firewall are going to /var/log/messages and console instead of /var/log/firewall.log which is our requirent.

*.info;mail.none;authpriv.none;cron.none        /var/log/messages

authpriv.*                      /var/log/secure

mail.*                          -/var/log/maillog


cron.*                          /var/log/cron

*.emerg                         *

uucp,news.crit                      /var/log/spooler

local7.*     /var/log/firewall.log

This is our syslog config file. Any advices ?

Log Severity > Warning and set to sent to syslog in the device

Answer 1

default facility used by the Cisco ASA is 20 (LOCAL4):

  local4.*     /var/log/firewall.log

Answer 2

Check the raw messages and see the facility and the severity that is used. (%rawmsg% in rsyslog ) ... I don't know about syslogd, but you can always use wireshark for that. (the other way is to check every facility until you get your job done)