Solved

Fine-tuning cisco syslog messages generated by Cisco ASAs

Posted on 2013-01-19
4
1,776 Views
Last Modified: 2014-10-17
Hello,

I have been desperately trying to find the Cisco article, but back when ASA v.8.2 was around, I found an article written by Cisco which outlined the most common syslog messages, and which ones were safe to disable ("no logging message .."). It was really great at explaining the common messages and ones that were not technically duplicates but essentially the same. With that article I had safely disabled the following :

no logging message 106015
no logging message 313001
no logging message 313008
no logging message 419002
no logging message 106023
no logging message 710003
no logging message 106100
no logging message 302015
no logging message 302014
no logging message 302013
no logging message 302018
no logging message 302017
no logging message 302016
no logging message 302021
no logging message 302020

Open in new window


So we upgrade to 8.4 after getting the required RAM upgrade, and find out that we were getting practically no syslog messages at all. I had to remove these lines and am back with full informational logging, I really liked the number of messages generated before as it was enough to manage. Without those messages removed I'm getting about 600MB of logs per day, which is too much.

I know there must be a Cisco expert out there who has experience with tuning these! I really wish I could find that old article again... I suppose I could try looking up each syslog message in the 8.2 document and find the comparable one in 8.4+
0
Comment
Question by:RHarper-Ottawa
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 10

Accepted Solution

by:
rscottvan earned 500 total points
ID: 38796694
This may be the article you're referring to:
Cisco Syslog Article

Rather than limit quantity of logs, I rotate and compress them daily, then retain them for a month.  That way I can look in detail at the messages if I'm troubleshooting something strange.  The compressed logs are usually less than 5% of the original size so they don't eat up too much disk.

Then I just run a script each day to dump what I want and email it to myself.  There's a pretty extensive list of stuff I exclude, you can see it in the first grep command.  The second couple greps are for events that show failed VPN logins.  

For daily review, this gets me a pretty meaningful look.

#!/bin/bash
#script to send mail for syslog review

#create log file
LogFile=/opt/sadm/<directory>/daily-syslog.log

#create temp file
TempFile=`mktemp`
echo 'about to attempt temp file creation'
echo 'created temp file ' $TempFile >$LogFile
echo 'created temp file ' $TempFile

#determine log file name
FileToParse=<fw-name>-a-priv.<company>.net-$(date +%m-%d-%Y -d "yesterday").log
echo 'Preparing to parse ' $FileToParse >>$LogFile
echo 'Preparing to parse ' $FileToParse

grep -v -P '.*ASA-6.*|.*ASA-7.*|.*Deny.*|.*CRYPTO.*|.*rancid.*|.*711004.*Dispatch Unit.*|.*TCP access denied by ACL.*|.*No matching connection.*|.*Group = .*|.*IKE.*|.*ARP.*collision.*|.*User.*executed.*|.*Denied ICMP.*|.*type 3, code.*|.*Begin configuration.*|.*last message repeated.*|.*Idle Timeout|.*SIP Parameter.*|.*Accessed URL 69.64.233.141.*|.*722012.*|.*722033.*|.*722041.*|.*722037.*|.*722051.*|.*722032.*|.*722028.*|.*500004.*|.*713904.*|.*717037.*|.*713257.*|.*431001.*Out of range sequence.*|.*722034.*|.*713201.*|.*722010.*' /var/log/remote/full/<fw-name>.<company>.net/$FileToParse >$TempFile

echo 'finished first log parse' >>$LogFile
echo 'finished first log parse'

grep 113015 /var/log/remote/full/<fw-name>-a-priv.<company>.net/$FileToParse >>$TempFile
grep 716039 /var/log/remote/full/<fw-name>-a-priv.<company>.net/$FileToParse >>$TempFile

echo 'finished second log parse, about to send email' >>$LogFile
echo 'finished second log parse, about to send email'

#email subject
SUBJECT="Daily Syslog Review - Site x"

#recipient
EMAIL="<me>@<company>.net"


#send the email
cat $TempFile | /bin/mail -s "$SUBJECT" "$EMAIL"

echo 'sent mail to ' $EMAIL ' with subject ' $SUBJECT >>$LogFile
echo 'sent mail to ' $EMAIL ' with subject ' $SUBJECT

rm -f $TempFile

Open in new window

0
 

Author Comment

by:RHarper-Ottawa
ID: 38796705
rscottvan,

Thanks for the info! You have a great procedure and I should definitely implement something similar. The reason I am trying to reduce messages at the source is because I am using Splunk Free as my syslog server, and the free version has a 500MB daily limit. With full informational logging on I'm getting about 530MB/day of logs, and I recall I had it around 100MB/day when tweaked.

Also, I think that was the article indeed, although from reading it, it seems obvious why I wasn't getting important messages (106015, 106023 etc).. I'm not sure why i had those excluded..

What syslog software are you using? And what does that script run on?

Thanks again
0
 
LVL 10

Expert Comment

by:rscottvan
ID: 38797004
Scientific Linux and rsyslog.  So, the server and syslog daemon are open (free).

The script is just a Linux shell script.
0
 
LVL 1

Expert Comment

by:Sean Hull CCIE 2052
ID: 40387240
Actually in ADSM if you click on the Configure Then the gears to the right of the home syslog page then click on syslog servers "logging destination" you can change the logging levels to ADSM and your syslog server. By changing the syslog server logging filters you can change the severity to critical or errors for syslog that will reduce the amount of syslog messages..

Enjoy!
0

Featured Post

When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Is your computer hacked? learn how to detect and delete malware in your PC
WARNING:   If you follow the instructions here, you will wipe out your VTP and VLAN configurations.  Make sure you have backed up your switch!!! I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
In this brief tutorial Pawel from AdRem Software explains how you can quickly find out which services are running on your network, or what are the IP addresses of servers responsible for each service. Software used is freeware NetCrunch Tools (https…
Monitoring a network: how to monitor network services and why? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the philosophy behind service monitoring and why a handshake validation is critical in network monitoring. Software utilized …
Suggested Courses
Course of the Month6 days, 5 hours left to enroll

627 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question