I've got a Cisco ASA forwarding syslog messages to a remote server (which is working great). However, after reviewing the logs, I've noticed a lot of 302013 and 302014 events with one particular destination IP address. I guess that, for whatever reason, many machines are making connections to that host. And while I'm interested in these 302013/302014 messages generally, I'm not interested in traffic to this particular destination.

An example event would look like:

%ASA-6-302014: Teardown TCP connection 494106862 for outside: to inside: duration 0:00:00 bytes 6754 TCP FINs

Is there any way to not generate these events given a particular source or destination IP address?

I've seen options for disabling messages of a particular type or limiting the rate of a particular message but nothing specifically for filtering.

Edit: Yes, I realize that one could possibly(?) filter on the receiving end, however at approximately 2 million messages per hour, it's a lot of noise to be filtering out on that side.

  • The real way to do this is with the application you use to view the logs.
    – Ron Maupin
    Jul 7, 2016 at 7:48
  • Ah, forgot to mention in my original question (since updated) – at the rate the messages are being transmitted, even receiving the events to throw them away is having a performance impact.
    – fission
    Jul 7, 2016 at 7:51
  • Then I think you are out of luck.
    – Ron Maupin
    Jul 7, 2016 at 7:53

2 Answers 2


The ASA can only filter messages by severity, or by log message class, or by individual log message.

Unfortunately, there is no way for the ASA to filter on a specific attribute or value within a particular log message.

As was pointed out, this type of filtering is best done on the receiving end. I know you mentioned there is already a performance hit, but there would be the same (if not worse) performance hit on the Firewall, and the Firewall is typically passing traffic beyond just syslog, so would be more risky.


You could write your firewall rules so that the "noisy" communication falls into a dedicated "Allow" rule and turn off logging for such rule.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.