1

We need to redirect the logs from our Cisco firewall(SA520-K9) to syslogd server(it's a CentOS server). The settings are done on the firewall. But the messages from firewall are going to /var/log/messages and console instead of /var/log/firewall.log which is our requirent.

*.info;mail.none;authpriv.none;cron.none        /var/log/messages

authpriv.*                      /var/log/secure

mail.*                          -/var/log/maillog


cron.*                          /var/log/cron

*.emerg                         *

uucp,news.crit                      /var/log/spooler

local7.*     /var/log/firewall.log

This is our syslog config file. Any advices ?

Log Severity > Warning and set to sent to syslog in the device

3

default facility used by the Cisco ASA is 20 (LOCAL4):

  local4.*     /var/log/firewall.log
  • Any idea about SA520-K9 ? – nitins Feb 4 '11 at 6:38
  • sa520 has no cli. It's not an ios device. – Jason Berg Feb 4 '11 at 6:51
  • @Jason Berg: What facility "Administration> Logging > Logs Facility and Severity" ? – alvosu Feb 4 '11 at 8:16
  • Log Severity > Warning and set to sent to syslog – nitins Feb 4 '11 at 8:26
  • 1
    Use tcpdump to determinate facility: tcpdump -pn -s 0 -vv -i eth0 host $IP. Facility ... (N) – alvosu Feb 4 '11 at 8:28
0

Check the raw messages and see the facility and the severity that is used. (%rawmsg% in rsyslog ) ... I don't know about syslogd, but you can always use wireshark for that. (the other way is to check every facility until you get your job done)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.