• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 353
  • Last Modified:

Enabling syslog informational logging without seeing VPN teardowns

Is there a way to setup syslogging on a pix or asa, so that my syslog server doesn't get flooded with VPN information?  Right now it is set to emergencies. Because when I use the informational type of logging, I get all of the VPN info.

I just want to see log ins, log outs, user changes etc etc.

Thanks in advance
0
dissolved
Asked:
dissolved
  • 2
1 Solution
 
stsonlineCommented:
The easiest way would be to configure the firewall to exclude certain messages by ID - check out this link on Cisco's web site:

http://www.cisco.com/en/US/docs/security/asa/asa80/system/message/logmsgs.html

0
 
dissolvedAuthor Commented:
can you give me an example command?
0
 
stsonlineCommented:
Sure... you enter the message ID you do NOT want to record one line at a time prefixed by the word 'no'. For example, if you don't care about a VPN client with no split-tunneling enabled and don't want to know when a Phase 1 retrans or keep-alive is received, you'd get into configuration mode and create four entries, one each for message ID 611301, 611302, 702204, and 715075:

no logging message 611301
no logging message 611302
no logging message 702204
no logging message 715075

0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now