Setup Cisco PIX or ASA to log on another server using syslog

• the pix binds the ip 10.2.59.1 and the linux syslog server bind 10.2.59.2 on the pix add the following config

logging enable
logging timestamp
logging standby
logging trap warnings
logging host vpnnat 10.2.59.2

• On the linux server install syslog-ng

• Add the following to /etc/syslog-ng/syslog-ng.conf

source network { udp(ip("0.0.0.0") port(514)); };
destination pixlog { file("/var/log/pix.log"); };
filter f_pix { facility(local4); };
log{source(network);filter(f_pix);destination(pixlog);};

• Make sure the firewall on the box is accepting UDP packets destined for port 514 from the pix.

• Add the following to /etc/logrotate.d/syslog-ng

/var/log/pix.log {
  rotate 4
  weekly
  missingok
  notifempty
  compress
}