Getting Data In

Cisco ASA Logging of Bad Password Attempts

New Member

I am trying to log "Bad Passwords" or "Access Denied" attempts on the ASA and alert on them with Splunk:

I have the Cisco ASA 5510 Syslog setup and pointed to Splunk and I am getting data into Splunk but cannot search and see find the bad password attempts. I am running Cisco 8.2.1 I have changed the logging trap warnings to notifications with no effect.

logging enable
logging console notifications
logging trap warnings
logging device-id hostname
logging host inside 10.1.100.110

Tags (2)
0 Karma

Communicator

You should be looking for:

%ASA-6-605004: Login denied from source-address/source-port to interface:destination/service for user “username”

%ASA-6-605005: Login permitted from source-address/source-port to interface:destination/service for user “username”~

Log level has to be set to informational. Event ID is 605004.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!