Cisco ASA logging to remote syslog question

Question

I have Cisco ASA and i have setup graylog logging server and i am seeing no logs coming on remote syslog so this is what i did..

Current config:

asa-fw1-010101-2-7/pri/act(config)# show run logging
logging enable
logging timestamp
logging buffer-size 16384
logging monitor debugging
logging buffered debugging
logging asdm errors
logging device-id hostname
logging host inside 10.30.0.91

If i run this command to see how many logs generated by ASA

asa-fw1-010101-2-7/pri/act(config)# show logging
Syslog logging: enabled
    Facility: 20
    Timestamp logging: enabled
    Hide Username logging: enabled
    Standby logging: disabled
    Debug-trace logging: disabled
    Console logging: disabled
    Monitor logging: level debugging, 467629 messages logged
    Buffer logging: level debugging, 3108298794 messages logged
    Trap logging: disabled
    Permit-hostdown logging: disabled
    History logging: disabled
    Device ID: hostname "asa-fw1-010101-2-7"
    Mail logging: disabled
    ASDM logging: level errors, 298891 messages logged

If you noticed in following two line from above output, this number growing faster, look like thousands of logs getting logs..

Monitor logging: level debugging, 467629 messages logged
Buffer logging: level debugging, 3108298794 messages logged

Is it safe to that ASA generating that many logs.. look like every single packet getting log in buffer..

I have set logging buffered debugging because before it was informational

If i set logging trap debugging in its flooding syslog mesg and i am seeing 192k/s logs coming on my graylog server...

What is the best practice on ASA for logging? my conn count is following..

20776 in use, 248156 most used

Answer 1

The "debugging" level is way too detailed for most uses. As you can see, it generates a lot of messages; most are not helpful. Also, it puts a heavy load on the ASA. You can try

logging trap info

or

logging trap warning

to see which one gives you the information you need.

Answer 2

Trap logging: disabled

That's the first problem. "trap" is the mechanism that sends to syslog hosts. logging trap informational will start messages flowing, but on an active firewall, there will a lot of messages. You can cut down the spew by increasing the logging level (info, warn, error, crit, etc.), or better, turn off the messages you don't want to see: no logging message 715036 (disables: %PIX-7-715036 messages)
- or -
logging message 715036 level 5 (moves id 715036 to 5 (notif)) (yes, at 7 (debug), it wouldn't be logged at 6 (info) anyway, but you get the idea.)

Answer 3

My suggestion would be to try to partition the problem between:

• ASA not sending
• Packets not getting there
• Graylog not listening

My usual method is to aim the device's syslog at some laptop, without running any kind of logging software, just tcpdump on the appropriate ports. That will tell you if the devices is sending. Then send some syslog manually to the target loghost, see if they arrive. That should partition the problem and you'll know where the problem lies.