I'm getting syslog logs from CISCO ASA where the ip addresses are coming in what I would call a non-standard format: The IP with port is being logged as 'd.d.d.d/port' (e.g.') so it looks more like a url/CIDR address instead of the more usual d.d.d.d:port.

Two questions really,

  1. Is there a formal standard for this naming, as I couldn't find much (e.g. https://en.wikipedia.org/wiki/Network_socket) as I'm just intersted to know this.
  2. Is there a way to change the output format of ASA syslogs to use a more normal format because our log parsers are picking these up as URLs not IP:port.
  • 1. No, there is not.
    – Zac67
    May 13 at 10:06
  • Because there is no standard, there is no "normal" format. You're probably better off changing your log parser.
    – Ron Trunk
    May 13 at 10:32
  • Cheers. I was hoping there was a way to change ASA as in this format there is a risk of mixing up ip address with url depending on the regex I use I course. May 13 at 10:40


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.