topic Re: How do I get Splunk to log Cisco ASA Bad Password Attempts? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-Splunk-to-log-Cisco-ASA-Bad-Password-Attempts/m-p/68333#M13832 <P>Thanks that is the information i needed.</P> Wed, 20 Mar 2013 20:13:15 GMT bihslogging 2013-03-20T20:13:15Z How do I get Splunk to log Cisco ASA Bad Password Attempts? https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-Splunk-to-log-Cisco-ASA-Bad-Password-Attempts/m-p/68331#M13830 <P>I am trying to log "Bad Passwords" or "Access Denied" attempts on the ASA and alert on them with Splunk:</P> <P>I have the <STRONG>Cisco ASA 5510 Syslog</STRONG> setup and pointed to Splunk and I am getting data into Splunk but cannot search and see find the bad password attempts. I am running Cisco 8.2.1 I have changed the logging trap warnings to notifications with no effect. </P> <P>logging enable<BR /> logging console notifications<BR /> logging trap warnings<BR /> logging device-id hostname<BR /> logging host inside 10.1.100.110</P> <P>ASAXO# <STRONG>show logging</STRONG><BR /> Syslog logging: enabled<BR /> Facility: 20<BR /> Timestamp logging: disabled<BR /> Standby logging: disabled<BR /> Debug-trace logging: disabled<BR /> Console logging: level notifications, 5513 messages logged<BR /> Monitor logging: disabled<BR /> Buffer logging: disabled<BR /> Trap logging: level warnings, facility 20, 5704731 messages logged<BR /> Logging to inside 10.1.100.110<BR /> History logging: disabled<BR /> Device ID: hostname "ProPathASAXO"<BR /> Mail logging: disabled<BR /> ASDM logging: disabled<BR /> ASAXO#<BR /> ASAXO#</P> Wed, 20 Mar 2013 17:24:23 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-Splunk-to-log-Cisco-ASA-Bad-Password-Attempts/m-p/68331#M13830 bihslogging 2013-03-20T17:24:23Z Re: How do I get Splunk to log Cisco ASA Bad Password Attempts? https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-Splunk-to-log-Cisco-ASA-Bad-Password-Attempts/m-p/68332#M13831 <P>You should be looking for:</P> <P>%ASA-6-605004: Login denied from source-address/source-port to interface:destination/service for user “username”</P> <P>%ASA-6-605005: Login permitted from source-address/source-port to interface:destination/service for user “username”</P> <P>Log level has to be set to informational. Event ID is 605004.</P> Wed, 20 Mar 2013 17:48:48 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-Splunk-to-log-Cisco-ASA-Bad-Password-Attempts/m-p/68332#M13831 krugger 2013-03-20T17:48:48Z Re: How do I get Splunk to log Cisco ASA Bad Password Attempts? https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-Splunk-to-log-Cisco-ASA-Bad-Password-Attempts/m-p/68333#M13832 <P>Thanks that is the information i needed.</P> Wed, 20 Mar 2013 20:13:15 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-Splunk-to-log-Cisco-ASA-Bad-Password-Attempts/m-p/68333#M13832 bihslogging 2013-03-20T20:13:15Z