Cisco pix logging to linux

sapient used Ask the Experts™
I have cisco pix firewall and RH 7.2 linux. I need to configure syslog on linux. Everything I did in pix but logging is not working
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Top Expert 2005

Setting up the PIX is half of the solution. You also need to create syslog.conf entries to recieve and process the data. I'm not at work now and can't look at my PIX and syslog setup, but I'll do that tomorrow and tell you how mine is configured.
Top Expert 2005

Okay, I'm back...

My setup for logging PIX data to a RedHat server is as follows:

1. The server is at and I have:

      logging on
      logging monitor debugging
      logging buffered debugging
      logging trap debugging
      logging host inside

    in my PIX configuration.

2. On the RedHat box I have the following in my syslogd.conf:

   # PIX additions
   local4.emerg                      /dev/console
   local4.alert                      /dev/console
   local4.crit                       /dev/console
   local4.err                        /dev/console
   local4.debug                      /var/pix/activity

   You way want to direct some of those to to different
   places or files.

3. To get syslogd to listen on a network socket you need to include the '-r' option. I run mine as 'syslogd -r -m 0'.

If you have a busy PIX you'll want to have plenty of room for the log file and you'll want to rotate it regularly. I roll my PIX log daily.
SR Manager Operation
jlevie is right.

In RH 7.2 - U need to change syslog option in /etc/sysconfig/syslog put -r and in /etc/syslog.conf
local4.*                  /var/log/pixlog(or whatever file)

in the last and then restart the syslog daemon /etc/rc.d/init.d/syslog restart.

Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Top Expert 2005


Before any one else fusses at you you should know that you ought not to propose an answer unless what you have entered  as the answer hasn't already been touched on in a previous comment and you are certain that the comment will solve the problem. In this case your proposed answer is just a slight variation of my previous comment. I'm not overly concerned about in this case but other experts consider actions like this to be extremely rude and will complain, and rightly so.
arvindSR Manager Operation

Sorry for I'd forget to click on comments -How do i withdraw ???
arvindSR Manager Operation

Sorry for I'd forget to click on comments -How do i withdraw ???


jlevie - I'd already fix all the pix command, but I'm doing wrong in syslog start file. Finally arvind suggest in /etc/sysconfig/syslog. previously I did on /etc/rc.d/init.d/syslog.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial