2

Can anyone tell me all the commands that I need to enable logging on my email, hit count on access control entries that I use in static NAT with port translation, on my ASA 5525-X?

I tried with:

logging enable
logging timestamp
logging mail errors
logging from-address asa@xxx.xxx
logging recipient-address asa@xxx.xxx level errors
smtp-server x.x.x.x
logging message 106100 level errors

and of course at the end of ACEs I added "log"

Hit count is rising, but I don have emails.

Improve this question
11
  • Does that e-mail address actually exist on the mail server? I don't see the level keyword on the recipient address command: logging recipient-address <e-mail_address> [severity_level].
    – Ron Maupin ♦
    Jun 26, 2016 at 15:33
  • logging recipient-address asa@xxx.xxx level errors, yes, when I puted here level informational, I had 1000 emails in few seconds.But I dont need those informations. Only log of ace hits.
    – John
    Jun 26, 2016 at 15:38
  • Now I'm confused. Your comment says you got 1000 emails for informational, but your question says you don't get any for errors. Are you sure that there are what it considers errors happening?
    – Ron Maupin ♦
    Jun 26, 2016 at 15:44
  • Im not sure if the error level is good. For receiving a hit on ACE. I only need information when ACE is hit. I dont need rest of logging informations.
    – John
    Jun 26, 2016 at 15:47
  • 1
    The proper way is to use a syslog server and an application to parse the resulting data. Message 106100 is an information level message, and you can change it to error level, but it will not change for any existing ACE, and all errors will end up in the log, not just the matches. "An optional syslog level (0 - 7) can be specified for the generated syslog messages (106100). If no level is specified, the default level is 6 (informational) for a new ACE. If the ACE already exists, then its current log level remains unchanged."
    – Ron Maupin ♦
    Jun 26, 2016 at 17:00

2 Answers 2

Reset to default
0
+50

The proper way is to use a syslog server and an application to parse the resulting data. Message 106100 is an information level message, and you can change it to error level, but it will not change for any existing ACE, and all errors will end up in the log, not just the matches.

An optional syslog level (0 - 7) can be specified for the generated syslog messages (106100). If no level is specified, the default level is 6 (informational) for a new ACE. If the ACE already exists, then its current log level remains unchanged.

Improve this answer
1

Change what ever rule hit you want to send email to the specified level you want emails sent out this may require you to create a separate access rule if you only want it when it's specific traffic. Change the severity for the new specific rule's severity level and set the email alert configuration to that.

Edit for configuration. it would look something like this:

      access-list Outside_access_in line 12 extended permit tcp host 192.168.1.1 host 172.16.1.26 eq smtp  log 1 interval 300
  access-list Outside_access_in line 13 extended permit tcp any host 172.16.1.26 eq smtp 
  logging from-address asa@place.com
  logging recipient-address alerts@mycomany.com level Errors
  smtp-server 172.16.1.26
Improve this answer
2
  • Can you send me some configuration example, just to make your replay more understandable.
    – John
    Jun 27, 2016 at 6:33
  • You just need to configure the rule you want alerts on at a higher level and then have email alerts sent for that level.
    – Fallacy11
    Jun 27, 2016 at 6:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.