centos 7 configure rsyslog to receive cisco logs

I have not been able to verify that logs are being received on the centos 7 server using rsyslog

firewall has udp 514 open and listening same set on the cisco asa

cannot see why it is not working, I do sh logging and it shows how many TX are being sent via the trigger but cannot find on rsyslog server.

mphillip85Asked: 2017-11-13

Who is Participating?

Experts Exchange Solution brought to you by

Enjoy your complimentary solution view.

Get this solution by purchasing an Individual license! Start your 7-day free trial.

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

LVL 29

Jan SpringerCommented: 2017-11-13

In /etc/rsyslog.conf, uncomment these lines:

$ModLoad imudp
$UDPServerRun 514
$IncludeConfig /etc/rsyslog.d/*.conf

In /etc/rsyslog.d create a file called asa.conf and add these lines where A.B.C.D is the IP of the asa:
if $fromhost-ip startswith 'A.B.C.D' then /var/log/asa.log
& ~

Restart syslog:
systemctl restart rsyslog

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial

LVL 29

Jan SpringerCommented: 2017-11-13

And update logrotate:

/etc/logrotate.d/syslog

Add /var/log/asa.log

mphillip85Author Commented: 2017-11-13

did I give you all the information you needed to review?

because you gave me the only answer that worked, over all the documentation that I have read.

Thank you very much!

LVL 29

Jan SpringerCommented: 2017-11-13

You did. You were very clear.