CiscoASA‎ > ‎

Logging

Setup Cisco PIX or ASA to log on another server using syslog


  • the pix binds the ip 10.2.59.1 and the linux syslog server bind 10.2.59.2 on the pix add the following config
logging enable logging timestamp logging standby logging trap warnings logging host vpnnat 10.2.59.2
  • On the linux server install syslog-ng
  • Add the following to /etc/syslog-ng/syslog-ng.conf
source network { udp(ip("0.0.0.0") port(514)); }; destination pixlog { file("/var/log/pix.log"); }; filter f_pix { facility(local4); }; log{source(network);filter(f_pix);destination(pixlog);};
  • Make sure the firewall on the box is accepting UDP packets destined for port 514 from the pix.
  • Add the following to /etc/logrotate.d/syslog-ng
/var/log/pix.log { rotate 4 weekly missingok notifempty compress }
Comments