Getting Data In
Highlighted

Cisco ASA Logging of Bad Password Attempts

New Member

I am trying to log "Bad Passwords" or "Access Denied" attempts on the ASA and alert on them with Splunk:

I have the Cisco ASA 5510 Syslog setup and pointed to Splunk and I am getting data into Splunk but cannot search and see find the bad password attempts. I am running Cisco 8.2.1 I have changed the logging trap warnings to notifications with no effect.

logging enable
logging console notifications
logging trap warnings
logging device-id hostname
logging host inside 10.1.100.110

Tags (2)
0 Karma
Highlighted

Re: Cisco ASA Logging of Bad Password Attempts

Communicator

You should be looking for:

%ASA-6-605004: Login denied from source-address/source-port to interface:destination/service for user “username”

%ASA-6-605005: Login permitted from source-address/source-port to interface:destination/service for user “username”~

Log level has to be set to informational. Event ID is 605004.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.