Why am I unable to collect ASA syslog data using the Splunk Add-on for Cisco ASA?

[machiasiaweb]

Hello,

I am running with Splunk 6.3.2 and added Splunk Add-on for Cisco ASA to collect syslog.

http://docs.splunk.com/Documentation/AddOns/latest/CiscoASA/Description

However, I have no idea why I cannot search any log .

ASA end should be configured correctly as I can see data coming by tcpdump.

I checked some others ticket saying I need to manually add transforms.conf and props.conf. However, I have no idea to collect confirm howto.

Also, what should be input data type? syslog or cisco:asa ?

Please advise where I should start to trace.

Thank You!

[jkat54]

So you're sending ASA data to Splunk using ASA SYSLOG feature.

I assume this means its using UDP port 512.

So now you would configure your UDP port 512 input on your forwarder or indexer. Note if you're using linux and followed best practices and installed splunk as a non-privileged user (didnt install as root) then splunk will not be able to bind to ports lower than 1024. That's a linux only security feature.

http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports

As for what sourcetype to use, cisco:asa seems the most appropriate but it all depends on what your cisco team is doing related to logging practices. If they're using out of box logging configs... cisco:asa should be fine. If they're using custom logging settings, you might have to create your own sourcetype, but you'll still probably be best starting with the cisco:asa and then modifying and using the data preview.