3

I have Cisco ASA and i have setup graylog logging server and i am seeing no logs coming on remote syslog so this is what i did..

Current config:

asa-fw1-010101-2-7/pri/act(config)# show run logging
logging enable
logging timestamp
logging buffer-size 16384
logging monitor debugging
logging buffered debugging
logging asdm errors
logging device-id hostname
logging host inside 10.30.0.91

If i run this command to see how many logs generated by ASA

asa-fw1-010101-2-7/pri/act(config)# show logging
Syslog logging: enabled
    Facility: 20
    Timestamp logging: enabled
    Hide Username logging: enabled
    Standby logging: disabled
    Debug-trace logging: disabled
    Console logging: disabled
    Monitor logging: level debugging, 467629 messages logged
    Buffer logging: level debugging, 3108298794 messages logged
    Trap logging: disabled
    Permit-hostdown logging: disabled
    History logging: disabled
    Device ID: hostname "asa-fw1-010101-2-7"
    Mail logging: disabled
    ASDM logging: level errors, 298891 messages logged

If you noticed in following two line from above output, this number growing faster, look like thousands of logs getting logs..

Monitor logging: level debugging, 467629 messages logged
Buffer logging: level debugging, 3108298794 messages logged

Is it safe to that ASA generating that many logs.. look like every single packet getting log in buffer..

I have set logging buffered debugging because before it was informational

If i set logging trap debugging in its flooding syslog mesg and i am seeing 192k/s logs coming on my graylog server...

What is the best practice on ASA for logging? my conn count is following..

20776 in use, 248156 most used
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 10:29
  • Give me a day or two, soon i will implement these changes and accept the answer! just haven't get time because of holidays.. – Satish Dec 28 '18 at 4:43
  • OK. I was just doing year-end cleanup. I have negelected this for a while. – Ron Maupin Dec 28 '18 at 4:54
3

The "debugging" level is way too detailed for most uses. As you can see, it generates a lot of messages; most are not helpful. Also, it puts a heavy load on the ASA. You can try

logging trap info

or

logging trap warning

to see which one gives you the information you need.

  • I have tired logging trap info & logging trap warning and they are also flooding lots – Satish Dec 20 '18 at 19:07
  • You can log at a higher level, but you may not get the information you need. Your ASA is busy, and it generates lots of log messages. You either have to live with incomplete information or get more storage for your logs. – Ron Trunk Dec 20 '18 at 19:17
  • How about logging buffered debugging ? should i move it to informational? – Satish Dec 20 '18 at 21:05
  • Yes or info. Same for console – Ron Trunk Dec 21 '18 at 0:59
3

Trap logging: disabled

That's the first problem. "trap" is the mechanism that sends to syslog hosts. logging trap informational will start messages flowing, but on an active firewall, there will a lot of messages. You can cut down the spew by increasing the logging level (info, warn, error, crit, etc.), or better, turn off the messages you don't want to see: no logging message 715036 (disables: %PIX-7-715036 messages)
- or -
logging message 715036 level 5 (moves id 715036 to 5 (notif)) (yes, at 7 (debug), it wouldn't be logged at 6 (info) anyway, but you get the idea.)

0

My suggestion would be to try to partition the problem between:

  • ASA not sending
  • Packets not getting there
  • Graylog not listening

My usual method is to aim the device's syslog at some laptop, without running any kind of logging software, just tcpdump on the appropriate ports. That will tell you if the devices is sending. Then send some syslog manually to the target loghost, see if they arrive. That should partition the problem and you'll know where the problem lies.

  • Graylog working fine, i have many host sending logs so its functional also if i run this command on ASA i am seeing 100,000/s logs per second on graylog coming from ASA logging trap debugging may be my question title is wrong let me change it.. I want to understand is it safe to send 100k logs to syslog and if you see my show logging output you will notice its generating lots of logs so does it OK for ASA to generate that many logs for every single packet or connection? – Satish Dec 20 '18 at 18:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.