0

I would like to have some help with sending syslogs from a Cisco ASA 5555-X to a syslog server, graylog 3.2.1. When running the following settings I could see a lot of information in the buffer with the command show logging.

logging enable
logging timestamp
logging emblem
logging buffer-size 52428800
logging buffered informational
logging trap informational
logging asdm debugging
logging device-id hostname
logging host INTERFACE 172.23.35.40 17/1514
logging permit-hostdown

But not in my syslog server. For example I'm not able to see the following:

<164>:Mar 25 13:57:05 CEST: %ASA-session-4-106023: Deny udp src UTB:172.22.44.54/51156 dst outside:216.58.207.226/443 by access-group "UTB_access_in" [0x0, 0x0]
<164>:Mar 25 13:57:05 CEST: %ASA-session-4-106023: Deny udp src UTB:172.22.36.51/59611 dst outside:172.217.21.142/443 by access-group "UTB_access_in" [0x0, 0x0]
<164>:Mar 25 13:57:05 CEST: %ASA-session-4-106023: Deny udp src UTB:172.22.44.54/60177 dst outside:172.217.21.130/443 by access-group "UTB_access_in" [0x0, 0x0]
<164>:Mar 25 13:57:05 CEST: %ASA-session-4-106023: Deny udp src UTB:172.22.37.45/60442 dst outside:217.115.45.205/443 by access-group "UTB_access_in" [0x0, 0x0]
<164>:Mar 25 13:57:05 CEST: %ASA-session-4-106023: Deny udp src UTB:172.22.41.83/61641 dst outside:216.58.207.200/443 by access-group "UTB_access_in" [0x0, 0x0]
<164>:Mar 25 13:57:05 CEST: %ASA--4-434002: SFR requested to drop TCP packet from outside:23.21.154.58/443 to GUEST:X.X.X.X/37703
<164>:Mar 25 13:57:05 CEST: %ASA--4-434002: SFR requested to drop TCP packet from outside:23.21.154.58/443 to GUEST:X.X.X.X/37703
<164>:Mar 25 13:57:44 CEST: %ASA--4-733100: [ Scanning] drop rate-1 exceeded. Current burst rate is 39 per second, max configured rate is 10; Current average rate is 65 per second, max configured rate is 5; Cumulative total count is 39313

I'm only able to see for example the following on my syslog server:

Mar 25 2020 13:57:44 ASA-INET : %ASA-4-733100: [ Scanning] drop rate-1 exceeded. Current burst rate is 39 per second, max configured rate is 10; Current average rate is 65 per second, max configured rate is 5; Cumulative total count is 39313

What about all the other 106023 and 434002 syslog messages? Is it not possible to send these syslog messages to a syslog server or is it something with my graylog server?

I have made a tcpdump between my firewall and the graylog server and it seems that all syslog messages are not hitting the firewall, how come? I'm using informational on both trap and buffered but yet they are different.

root@graylog01:/etc/elasticsearch# tcpdump -i ens32 port 1514 -v
tcpdump: listening on ens32, link-type EN10MB (Ethernet), capture size 262144 bytes
12:21:55.746278 IP (tos 0x0, ttl 254, id 23460, offset 0, flags [none], proto UDP (17), length 279)
    172.28.30.6.syslog > graylog01.1514: SYSLOG, length: 251
        Facility local4 (20), Severity warning (4)
        Msg: Mar 26 2020 13:21:55 ASA-INET : %ASA-4-733100: [ Scanning] drop rate-1 exceeded. Current burst rate is 39 per second, max configured rate is 10; Current average rate is 78 per second, max configured rate is 5; Cumulative total count is 47104\0x0a
12:22:05.377095 IP (tos 0x0, ttl 254, id 13258, offset 0, flags [none], proto UDP (17), length 189)
    172.28.30.6.syslog > graylog01.1514: SYSLOG, length: 161
        Facility local4 (20), Severity notice (5)
        Msg: Mar 26 2020 13:22:05 ASA-INET : %ASA-5-737003: IPAA: Session=0x0fd2c000, DHCP configured, no viable servers found for tunnel-group 'SSLVPN-Tunnelgroup'\0x0a
12:22:05.377164 IP (tos 0x0, ttl 254, id 1287, offset 0, flags [none], proto UDP (17), length 156)
    172.28.30.6.syslog > graylog01.1514: SYSLOG, length: 128
        Facility local4 (20), Severity info (6)
        Msg: Mar 26 2020 13:22:05 ASA-INET : %ASA-6-737026: IPAA: Session=0x0fd2c000, Client assigned 172.21.11.211 from local pool\0x0a
12:22:05.377168 IP (tos 0x0, ttl 254, id 16293, offset 0, flags [none], proto UDP (17), length 177)
    172.28.30.6.syslog > graylog01.1514: SYSLOG, length: 149
        Facility local4 (20), Severity info (6)
        Msg: Mar 26 2020 13:22:05 ASA-INET : %ASA-6-737006: IPAA: Session=0x0fd2c000, Local pool request succeeded for tunnel-group 'SSLVPN-Tunnelgroup'\0x0a
  • I'd bet it's just a server issue. Your logging level for trap is more than sufficient for those entries, so maybe your server is just filtering out or trying to categorize things incorrectly. – Jesse P. Mar 25 at 16:17
  • Hi @JesseP. I have updated my post with a tcpdump which is evidence of that all syslog messages are not forwarded to my syslog server. – Muffe Mar 26 at 12:32
  • Can you provide the output from show logging queue to see if some messages are being discarded? – Jesse P. Mar 26 at 14:48
  • @JesseP. ASA-INET/pri/act# show logging queue Logging Queue length limit : 512 msg(s) 205615 msg(s) discarded due to queue overflow 0 msg(s) discarded due to memory allocation failure Current 0 msg on queue, 512 msgs most on queue It's been the same number for an hour, I think the errors are from some old stuff. – Muffe Mar 26 at 16:19
  • What's the 17/1514 after your logging host statement? That's normally where you defined a protocol and port but not in that format. – Jesse P. Mar 26 at 21:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.