topic cisco asa firewall logs in Getting Data In

cisco asa firewall logs

cyberhack255 — Thu, 21 Jun 2012 13:31:26 GMT

Can anyone help me how to collect access log from cisco ASA 5505 firewall.Thanks

Re: cisco asa firewall logs

dondky — Thu, 21 Jun 2012 13:54:36 GMT

How we do it is configure syslog forwarding on the ASA to point to a centralized syslog collector. We then forward the data off using a Splunk forwarder to an indexer. I am sure you can skip this step and just go straight to the indexer with Syslog as well. The main thing is configuring syslog to forward on the asa and there are plenty of resources online for doing this.

Re: cisco asa firewall logs

eallanjr — Thu, 21 Jun 2012 15:22:15 GMT

Agreed - we also send to a centralized syslog server running a heavy forwarder. This allows us to do per-event filtering, since our network admins want to keep way more firewall logs than we actually wanted to index in Splunk (or have the licensing for!)