Getting Data In

How do I get Splunk to log Cisco ASA Bad Password Attempts?

bihslogging
New Member

I am trying to log "Bad Passwords" or "Access Denied" attempts on the ASA and alert on them with Splunk:

I have the Cisco ASA 5510 Syslog setup and pointed to Splunk and I am getting data into Splunk but cannot search and see find the bad password attempts. I am running Cisco 8.2.1 I have changed the logging trap warnings to notifications with no effect.

logging enable
logging console notifications
logging trap warnings
logging device-id hostname
logging host inside 10.1.100.110

ASAXO# show logging
Syslog logging: enabled
Facility: 20
Timestamp logging: disabled
Standby logging: disabled
Debug-trace logging: disabled
Console logging: level notifications, 5513 messages logged
Monitor logging: disabled
Buffer logging: disabled
Trap logging: level warnings, facility 20, 5704731 messages logged
Logging to inside 10.1.100.110
History logging: disabled
Device ID: hostname "ProPathASAXO"
Mail logging: disabled
ASDM logging: disabled
ASAXO#
ASAXO#

Tags (2)
0 Karma
1 Solution

krugger
Communicator

You should be looking for:

%ASA-6-605004: Login denied from source-address/source-port to interface:destination/service for user “username”

%ASA-6-605005: Login permitted from source-address/source-port to interface:destination/service for user “username”

Log level has to be set to informational. Event ID is 605004.

View solution in original post

0 Karma

krugger
Communicator

You should be looking for:

%ASA-6-605004: Login denied from source-address/source-port to interface:destination/service for user “username”

%ASA-6-605005: Login permitted from source-address/source-port to interface:destination/service for user “username”

Log level has to be set to informational. Event ID is 605004.

View solution in original post

0 Karma

bihslogging
New Member

Thanks that is the information i needed.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.