Configuring the ASDM to View Logging
The ASDM Log panel, shown in Figure 10-1, allows you to view syslog messages that are
captured in the ASDM Log buffer in the Security Appliance memory. You may select the level
of syslog messages you want to view. When you view the ASDM Log, all the buffered syslog
messages at and below the logging level you choose are displayed.
ASDM Log Viewer Screen
The ASDM logging panel has the following fields:
■ Logging Level—Enables you to choose the level of syslog messages to view.
To view the logs using the PDM interface, click the View button shown in Figure 10-1. Figure
10-2 shows a sample output of logs viewed from the PDM logging panel.
■ Buffer Limit—Sets the maximum number of log messages that will display. The default
for this value is 1000.
Configuring Syslog Messages at the Console
Configuring logging on the console interface is useful when you are troubleshooting or
observing traffic patterns directly from a Security Appliance. This gives you real-time
information about what is happening on the Security Appliance. To configure logging at the
Security Appliance console interface, use the logging console command as follows. After
logging into configuration mode, enter the following:
Pixfw(config)#logging on
Pixfw(config)#logging console 5
The 5 indicates the logging level. In this case, it is logging notification. From the console, you
can see the logs in real time.
Sending Syslog Messages to a Telnet Session
Remotely troubleshooting or viewing real-time Security Appliance traffic patterns can be
done by configuring the PIX to send logging information to a Telnet session. The logging
monitor command configures the Security Appliance to send syslog messages to Telnet
sessions. For example, after logging into configuration mode, enter the following:
Pixfirewall (config)#logging monitor 6
Pixfirewall(config)#terminal monitor
In this example, syslog messages 0 to 6, or emergency to informational, are sent to a Telnet
session. To disable logging to Telnet, you use the no logging monitor command.
The terminal monitor displays messages directly to the Telnet session. You can disable the
direct display of messages by entering the terminal no monitor command. A Telnet session
sometimes is lost in busy networks when the logging monitor command is used.
IT Certification CCIE,CCNP,CCIP,CCNA,CCSP,Cisco Network Optimization and Security Tips
logging Command Parameters (Continued)
loggin device -id n Sets the device ID that will be logged with a syslog
message.
logging host [interface] ip_address Specifies the host that receives the syslog messages.
[protocol/ port] A Cisco Security Appliance can send messages across
UDP or TCP (which you specify by setting the protocol
variable). The default UDP port is 514. The default
TCP port is 1470.
logging history severity_level Sets the logging level for SNMP traps.
logging queue msg_count Specifies how many syslog messages can appear in the
message queue while waiting for processing. The
default is 512 messages. Use the show logging queue
command to view queue statistics.
logging timestamp Specifies that each message sent to the syslog server
should include a timestamp to indicate when the event
occurred.
logging trap n Sets the logging level for syslog messages.
show logging disabled Displays a complete list of disabled syslog messages.
show logging Lists the current syslog messages and which logging
command options are enabled.
logging standby Lets the failover standby unit send syslog messages.
Table 10-3 logging Command Parameters (Continued)
message.
logging host [interface] ip_address Specifies the host that receives the syslog messages.
[protocol/ port] A Cisco Security Appliance can send messages across
UDP or TCP (which you specify by setting the protocol
variable). The default UDP port is 514. The default
TCP port is 1470.
logging history severity_level Sets the logging level for SNMP traps.
logging queue msg_count Specifies how many syslog messages can appear in the
message queue while waiting for processing. The
default is 512 messages. Use the show logging queue
command to view queue statistics.
logging timestamp Specifies that each message sent to the syslog server
should include a timestamp to indicate when the event
occurred.
logging trap n Sets the logging level for syslog messages.
show logging disabled Displays a complete list of disabled syslog messages.
show logging Lists the current syslog messages and which logging
command options are enabled.
logging standby Lets the failover standby unit send syslog messages.
Table 10-3 logging Command Parameters (Continued)
Configuring Syslog on a Cisco Security Appliance
Configuring Syslog on a Cisco Security Appliance
The logging command is used to configure logging on the PIX Firewall. Logging is disabled
by default. Table 10-3 describes the parameters of the logging command.
Table 10-3 logging Command Parameters
Command Description
logging on Enables the transmission of syslog messages to all
output locations. You can disable sending syslog
messages with the no logging on command.
no logging message n Allows you to disable specific syslog messages. Use the
logging message message_number command to resume
logging of specific disabled messages.
logging buffered n Stores syslog messages in the Cisco Security Appliance
so that you can view them with the show logging
command. Cisco Systems recommends that you use this
command to view syslog messages when the PIX
Seecurity Appliance is in use on a network.
clear logging Clears the message buffer created with the logging
buffered command.
clear logging message Reenables all disabled syslog messages.
logging console n Displays syslog messages on a Security Appliance
console as they occur. Use this command when you are
debugging problems or when there is minimal load on
the network. Do not use this command when the
network is busy because it can reduce the Security
Appliance performance.
logging monitor n Displays syslog messages when you access the Security
Appliance console with Telnet.
continues
The logging command is used to configure logging on the PIX Firewall. Logging is disabled
by default. Table 10-3 describes the parameters of the logging command.
Table 10-3 logging Command Parameters
Command Description
logging on Enables the transmission of syslog messages to all
output locations. You can disable sending syslog
messages with the no logging on command.
no logging message n Allows you to disable specific syslog messages. Use the
logging message message_number command to resume
logging of specific disabled messages.
logging buffered n Stores syslog messages in the Cisco Security Appliance
so that you can view them with the show logging
command. Cisco Systems recommends that you use this
command to view syslog messages when the PIX
Seecurity Appliance is in use on a network.
clear logging Clears the message buffer created with the logging
buffered command.
clear logging message Reenables all disabled syslog messages.
logging console n Displays syslog messages on a Security Appliance
console as they occur. Use this command when you are
debugging problems or when there is minimal load on
the network. Do not use this command when the
network is busy because it can reduce the Security
Appliance performance.
logging monitor n Displays syslog messages when you access the Security
Appliance console with Telnet.
continues
How to Read System Log Messages
How to Read System Log Messages
System log messages received at a syslog server begin with a percent sign (%) and are
structured as follows:
%PIX-level-message-number: message-text
■ PIX identifies the message facility code for messages generated by the Cisco Security
Appliance.
■ level reflects the severity of the condition described by the message. The lower the
number, the more serious the condition.
■ message-number is the numeric code that uniquely identifies the message.
■ message-text is a text string describing the condition. This portion of the message
sometimes includes IP addresses, port numbers, or usernames.
You can find more information on syslog messages at http://www.cisco.com/en/US/products/
sw/secursw/ps2120/products_system_message_guide_book09186a00801582a9.html.
System log messages received at a syslog server begin with a percent sign (%) and are
structured as follows:
%PIX-level-message-number: message-text
■ PIX identifies the message facility code for messages generated by the Cisco Security
Appliance.
■ level reflects the severity of the condition described by the message. The lower the
number, the more serious the condition.
■ message-number is the numeric code that uniquely identifies the message.
■ message-text is a text string describing the condition. This portion of the message
sometimes includes IP addresses, port numbers, or usernames.
You can find more information on syslog messages at http://www.cisco.com/en/US/products/
sw/secursw/ps2120/products_system_message_guide_book09186a00801582a9.html.
How Log Messages Are Organized
How Log Messages Are Organized
Syslog messages are listed numerically by message code. Each message is followed by a brief
explanation and a recommended action. If several messages share the same explanation and
recommended action, the messages are presented together, followed by the common
explanation and recommended action.
The explanation of each message indicates what kind of event generated the message.
Possible events include the following:
■ Authentication, authorization, and accounting (AAA) events
■ Connection events (for example, connections denied by the PIX configuration or address
translation errors)
■ Failover events reported by one or both units of a failover pair
■ File Transfer Protocol (FTP)/Uniform Resource Locator (URL) events (for example,
successful file transfers or blocked Java applets)
■ Mail Guard/SNMP events
■ Security Appliance management events (for example, configuration events or Telnet
connections to the Security Appliance console port)
■ Routing errors
Syslog messages are listed numerically by message code. Each message is followed by a brief
explanation and a recommended action. If several messages share the same explanation and
recommended action, the messages are presented together, followed by the common
explanation and recommended action.
The explanation of each message indicates what kind of event generated the message.
Possible events include the following:
■ Authentication, authorization, and accounting (AAA) events
■ Connection events (for example, connections denied by the PIX configuration or address
translation errors)
■ Failover events reported by one or both units of a failover pair
■ File Transfer Protocol (FTP)/Uniform Resource Locator (URL) events (for example,
successful file transfers or blocked Java applets)
■ Mail Guard/SNMP events
■ Security Appliance management events (for example, configuration events or Telnet
connections to the Security Appliance console port)
■ Routing errors
Subscribe to:
Posts (Atom)