Are there any cisco:asa logs that experts would recommend as unnecessary to log?

[ashari]

Hi,

I am working in shared network environment where data is comming from firewalls windows, antivirus etc. What are the cisco:asa logs that are recommended by experts not to log onto the splunk because they are unnecessary?
Quick answer would be appreciated.

Thanks

[chanfoli]

You might find different opinions on what is unnecessary but you could start by looking at your logs, or indexing everything then looking at stats on message numbers then applying a null-queue transform to the messages you want to avoid. Here is a starting point which is dated but links to some newer info:

http://answers.splunk.com/answers/39916/need-help-filtering-cisco-asa-logs-at-index-time

Hope this helps,
Sean