topic Re: Estreamer vs syslog from ASA firewalls in All Apps and Add-ons

Estreamer vs syslog from ASA firewalls

kevinmanson — Fri, 27 Apr 2018 20:42:16 GMT

Do Cisco ASA NGFWs aka X-series and firepower series sending logs to FMC and collecting via estreamer provide equal or greater logging within Splunk over syslog from the ASA?

Meaning everything event visible in syslog can be seen in the estreamer feed in some way.

One of the other concerning issues is the size of the events syslog is 200bytes/event while estreamer is 2000bytes for connection events.

Re: Estreamer vs syslog from ASA firewalls

Richfez — Sat, 28 Apr 2018 21:54:49 GMT

Hi, kevinmanson,

Is there a question here that needs answering?

Re: Estreamer vs syslog from ASA firewalls

kevinmanson — Mon, 30 Apr 2018 14:42:54 GMT

Reformatted sentence into question.

Re: Estreamer vs syslog from ASA firewalls

koshyk — Mon, 30 Apr 2018 16:25:59 GMT

I've a table comparing syslog vs estreamer options. But not sure if I can paste that into splunk answers. Let me try finding a place I can put it or a screenshot

Re: Estreamer vs syslog from ASA firewalls

kevinmanson — Tue, 01 May 2018 12:54:16 GMT

Koshyk,

Any luck on being able to send over that table?

Re: Estreamer vs syslog from ASA firewalls

Richfez — Tue, 01 May 2018 13:07:39 GMT

Thx. I sort of figured that was the question, but wanted to make sure.

I'm not an expert, and my memory might be foggy, but IIRC the new firewalls we deployed at $job-1 we still collected both data - there were some pieces of estreamer that weren't there even though generally it's a better, higher quality data stream.

I've love to reinvestigate - as I was leaving there we were finally getting the rest of the new FW infrastructure into place, so we'd have ISE, AMP, all NGFWs and a lot of other things. I may ping some folks back there to find out how that went, or maybe give them a hand getting it sorted out.

Re: Estreamer vs syslog from ASA firewalls

koshyk — Wed, 02 May 2018 08:30:03 GMT

hi Kevin,
I've put a screenshot here. Also put into github with details. Please note, this is from my experience and may have changed

Re: Estreamer vs syslog from ASA firewalls

koshyk — Wed, 02 May 2018 13:17:10 GMT

i've attached below