Cisco ASA 5505 - Manual (Page 1750)

77-8
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 77 Configuring Logging
Configuring Logging
Sending Syslog Messages to an External Syslog Server
You can archive messages according to the available disk space on the external syslog server, and
manipulate logging data after it is saved. For example, you could specify actions to be executed when
certain types of syslog messages are logged, extract data from the log and save the records to another
file for reporting, or track statistics using a site-specific script.
To send syslog messages to an external syslog server, perform the following steps:
Command Purpose
Step 1 logging host interface_name syslog_ip
[tcp[/port] | udp[/port] [format emblem]]
Example:
hostname(config)# logging host dmz1
192.168.1.5 udp 1026 format emblem
Configures the ASA to send messages to a syslog server.
The format emblem keyword enables EMBLEM format
logging for the syslog server with UDP only. The
interface_name argument specifies the interface through
which you access the syslog server. The syslog_ip argument
specifies the IP address of the syslog server. The tcp[/port] or
udp[/port] keyword and argument pair specify that the ASA
and ASASM should use TCP or UDP to send syslog messages
to the syslog server.
You can configure the ASA to send data to a syslog server
using either UDP or TCP, but not both. The default protocol is
UDP if you do not specify a protocol.
If you specify TCP, the ASA discover when the syslog server
fails and as a security protection, new connections through the
ASA are blocked. To allow new connections regardless of
connectivity to a TCP syslog server, see Step 3. If you specify
UDP, the ASA continue to allow new connections whether or
not the syslog server is operational. Valid port values for
either protocol are 1025 through 65535. The default UDP port
is 514. The default TCP port is 1470.
Step 2 logging trap {severity_level | message_list}
Example:
hostname(config)# logging trap errors
Specifies which syslog messages should be sent to the syslog
server. You can specify the severity level number (1 through
7) or name. For example, if you set the severity level to 3, then
the ASA send syslog messages for severity levels 3, 2, and 1.
You can specify a custom message list that identifies the
syslog messages to send to the syslog server.
Step 3 logging permit-hostdown
Example:
hostname(config)# logging permit-hostdown
(Optional) Disables the feature to block new connections
when a TCP-connected syslog server is down. If the ASA is
configured to send syslog messages to a TCP-based syslog
server, and if either the syslog server is down or the log queue
is full, then new connections are blocked. New connections
are allowed again after the syslog server is back up and the log
queue is no longer full. For more information about the log
queue, see the
“Configuring the Logging Queue” section on
page 77-15 .
Step 4 logging facility number
Example:
hostname(config)# logging facility 21
(Optional) Sets the logging facility to a value other than 20,
which is what most UNIX systems expect.