1

I've got a Cisco ASA forwarding syslog messages to a remote server (which is working great). However, after reviewing the logs, I've noticed a lot of 302013 and 302014 events with one particular destination IP address. I guess that, for whatever reason, many machines are making connections to that host. And while I'm interested in these 302013/302014 messages generally, I'm not interested in traffic to this particular destination.

An example event would look like:

%ASA-6-302014: Teardown TCP connection 494106862 for outside:198.51.100.83/443 to inside:192.0.2.170/47599 duration 0:00:00 bytes 6754 TCP FINs

Is there any way to not generate these events given a particular source or destination IP address?

I've seen options for disabling messages of a particular type or limiting the rate of a particular message but nothing specifically for filtering.

Edit: Yes, I realize that one could possibly(?) filter on the receiving end, however at approximately 2 million messages per hour, it's a lot of noise to be filtering out on that side.

  • The real way to do this is with the application you use to view the logs. – Ron Maupin Jul 7 '16 at 7:48
  • Ah, forgot to mention in my original question (since updated) – at the rate the messages are being transmitted, even receiving the events to throw them away is having a performance impact. – fission Jul 7 '16 at 7:51
  • Then I think you are out of luck. – Ron Maupin Jul 7 '16 at 7:53
1

The ASA can only filter messages by severity, or by log message class, or by individual log message.

Unfortunately, there is no way for the ASA to filter on a specific attribute or value within a particular log message.

As was pointed out, this type of filtering is best done on the receiving end. I know you mentioned there is already a performance hit, but there would be the same (if not worse) performance hit on the Firewall, and the Firewall is typically passing traffic beyond just syslog, so would be more risky.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.