https://community.splunk.com/t5/Getting-Data-In/Cisco-ASA-Logging-of-Bad-Password-Attempts/m-p/68123#M13790 <P>You should be looking for:</P> <P>%ASA-6-605004: Login denied from source-address/source-port to interface:destination/service for user “username”</P> <P>%ASA-6-605005: Login permitted from source-address/source-port to interface:destination/service for user “username”~</P> <P>Log level has to be set to informational. Event ID is 605004.</P> Wed, 20 Mar 2013 16:59:03 GMT krugger 2013-03-20T16:59:03Z https://community.splunk.com/t5/Getting-Data-In/Cisco-ASA-Logging-of-Bad-Password-Attempts/m-p/68122#M13789 <P>I am trying to log "Bad Passwords" or "Access Denied" attempts on the ASA and alert on them with Splunk:</P> <P>I have the Cisco ASA 5510 Syslog setup and pointed to Splunk and I am getting data into Splunk but cannot search and see find the bad password attempts. I am running Cisco 8.2.1 I have changed the logging trap warnings to notifications with no effect. </P> <P>logging enable<BR /> logging console notifications<BR /> logging trap warnings<BR /> logging device-id hostname<BR /> logging host inside 10.1.100.110</P> Wed, 20 Mar 2013 16:41:07 GMT https://community.splunk.com/t5/Getting-Data-In/Cisco-ASA-Logging-of-Bad-Password-Attempts/m-p/68122#M13789 prosyspath 2013-03-20T16:41:07Z https://community.splunk.com/t5/Getting-Data-In/Cisco-ASA-Logging-of-Bad-Password-Attempts/m-p/68123#M13790 <P>You should be looking for:</P> <P>%ASA-6-605004: Login denied from source-address/source-port to interface:destination/service for user “username”</P> <P>%ASA-6-605005: Login permitted from source-address/source-port to interface:destination/service for user “username”~</P> <P>Log level has to be set to informational. Event ID is 605004.</P> Wed, 20 Mar 2013 16:59:03 GMT https://community.splunk.com/t5/Getting-Data-In/Cisco-ASA-Logging-of-Bad-Password-Attempts/m-p/68123#M13790 krugger 2013-03-20T16:59:03Z