Cisco ASA syslog filtering

Question

I've got a Cisco ASA forwarding syslog messages to a remote server (which is working great). However, after reviewing the logs, I've noticed a lot of 302013 and 302014 events with one particular destination IP address. I guess that, for whatever reason, many machines are making connections to that host. And while I'm interested in these 302013/302014 messages generally, I'm not interested in traffic to this particular destination.

An example event would look like:

%ASA-6-302014: Teardown TCP connection 494106862 for outside:198.51.100.83/443 to inside:192.0.2.170/47599 duration 0:00:00 bytes 6754 TCP FINs

Is there any way to not generate these events given a particular source or destination IP address?

I've seen options for disabling messages of a particular type or limiting the rate of a particular message but nothing specifically for filtering.

Edit: Yes, I realize that one could possibly(?) filter on the receiving end, however at approximately 2 million messages per hour, it's a lot of noise to be filtering out on that side.

Answer 1

The ASA can only filter messages by severity, or by log message class, or by individual log message.

Unfortunately, there is no way for the ASA to filter on a specific attribute or value within a particular log message.

As was pointed out, this type of filtering is best done on the receiving end. I know you mentioned there is already a performance hit, but there would be the same (if not worse) performance hit on the Firewall, and the Firewall is typically passing traffic beyond just syslog, so would be more risky.

Answer 2

You could write your firewall rules so that the "noisy" communication falls into a dedicated "Allow" rule and turn off logging for such rule.