Configure Firewall Logging

Configuring the firewall logging is made up of three important steps:

1. Enter configuration mode.
2. Enable logging.
3. Enable and configure the syslog output.

Additionally you can configure other settings, such as create filtering conditions or custom message lists, change facility settings, etc. However, these additional settings are not a requirement for using the Cisco PIX/ASA Security ThinAgent.

Entering Privileged Mode

To enter the privileged mode, run the enable command as per the following example:

After running the command, the command prompt will change from > to #.

Entering Configuration Mode

To enter the configuration mode you must already be in privileged mode and run the configure terminal command:

After running this command, the command prompt will change from >to (config):

Enabling Logging

To enable logging on the Cisco Firewall enter privileged mode and run the logging enable command:

To disable logging run the no logging enable command:

Configuring Syslog Logging Output

To enable logging output to syslog the following actions have to be performed:

1. Set logging level by running the logging trap command:

2. Configure the host to which messages will be sent.

3. Set the facility number for syslog messages. This step is optional.

By default, port 514 is used to send messages to the syslog server. The port can be changed by using this syntax:

To disable the syslog logging output, run:

Adding Timestamp to Messages

Adding a timestamp to messages is very useful to know the exact moment an event occurs on the firewall device. Although this is an optional step, it is highly recommended.

To add the timestamp to messages run the following command:

Adding Device ID to Messages

If you are monitoring several devices it might be useful to add the device ID to messages. This helps to determine the host name of the firewall on each message. Although this is an optional step, it is highly recommended.

To add the device id to messages run the following command:

You could also set other kind of device id instead of the name. For example you could set any other word as device id by running this:

The example above defines MyPIXFirewall as device id.

Viewing Logging Configuration

To see the whole logging configuration you can run the show logging command:

An example output can be seen below:

As you can see, the output gives you all the details about each logging configuration.

Logging Queue

Another very important parameter is logging queue. Although this is an optional step, it is highly recommended. The default value for the logging queue is 512 messages.

The queue size can be checked by running the show logging queue command:

An example output can be seen below:

In this example the average number of messages generated by the system is 23 and there is no problem sending them. However, if the value of xxx msgs most on queue is equal or higher than 512, that means the firewall will have dropped some messages.

You can adjust the queue size manually by running the following command:

The queue size can range from 0 to 8192 messages. Setting this parameter to 0 means the queue size has no limit (up to available memory).

Filtering Messages Using Message ID

This is an optional configuration in case you know which messages you want to exclude from syslog logging.

Although the ThinAgent has a filtering configuration which is carried out in the firewall device, so messages don’t ever appear in the syslog. Using this filtering feature could substantially reduce the syslog traffic and ThinAgent resources usage.

In order to filter for specific messages run the no logging message msg_number command:

To check if a specific message is being logged you can run the following command:

Filtering Messages Using Message Class

Besides filtering by message ID number, you can use the message classes as filters. Message classes group several ID numbers together, so if you exclude a class you’ll be excluding all message IDs in it. Successfully implementing this filtering method can substantially reduce syslog traffic resulting in better ThinAgent performance and resource usage. The classes are all defined in Cisco’s documentation. This step is not required for the general configuration.

For example, classes for software version 8.1 are:

Class	Definition	Message ID (that start with these digits)
auth	User Authentication	109, 113
bridge	Transparent Firewall	110, 220
ca	PKI Certification Authority	717
config	Command Interface	111, 112, 208, 308
dap	Dynamic Access Policies	734
e-mail	E-mail Proxy	719
ha	High Availability (Failover)	101, 102, 103, 104, 210, 211, 709
Ip	IP Stack	209, 215, 313, 317, 408
Ips	Intrusion Protection Service	400, 401, 415
np	Network Processor	319
npssl	NP SSL	725
ospf	OSPF Routing	318, 409, 503, 613
rip	RIP Routing	107, 312
rm	Resource Manager	321
session	User Session	106, 108, 201, 202, 204, 302, 303, 304, 305, 314, 405, 406, 407, 500, 502, 607, 608, 609, 616, 620, 703, 710
snmp	SNMP	212
sys	System	199, 211, 214, 216, 306, 307, 315, 414, 604, 605, 606, 610, 612, 614, 615, 701, 711
vpdn	PPTP and L2TP Sessions	213, 403, 603
vpn	IKE and IPSEC	316, 320, 402, 404, 501, 602, 702, 713, 714, 715
vpnc	VPN Client	611
vpnfo	VPN Failover	720
vpnlb	VPN Load Balancing	718
webvpn	Web-based VPN	716

Please review the Cisco documentation for your particular software version, since some classes may be different between software versions.

In order to filter a particular message class run the following command:

Defining Custom Messages List

To define a list, for example to include all messages with severity 3 (error), and also messages from 611101 to 611323, run the following commands:

To send your custom list to syslog output, run the following command:

This step is not required for the general configuration.

Further Information

This chapter is not intended to be a full firewall logging configuration guide.

For further information about logging configuration please consult the Cisco documentation for your particular device or software version:

• Cisco Security Appliance System Log Messages, Version 7.0 - Configuring Logging on the Security Appliance:

• Cisco Security Appliance System Log Messages, Version 7.1 - Configuring Logging on the Security Appliance:

• Cisco Security Appliance System Log Messages, Version 7.2 - Configuring Logging and SNMP:

• Cisco Security Appliance Command Line Configuration Guide, Version 8.0 - Monitoring the Security Appliance:

• Cisco Security Appliance Command Line Configuration Guide, Version 8.1 - Monitoring the Security Appliance:

• PIX/ASA 7.x and later with Syslog Configuration Example (Cisco Document ID: 63884):