cisco asa firewall logs

[cyberhack255]

Can anyone help me how to collect access log from cisco ASA 5505 firewall.Thanks

[dondky]

How we do it is configure syslog forwarding on the ASA to point to a centralized syslog collector. We then forward the data off using a Splunk forwarder to an indexer. I am sure you can skip this step and just go straight to the indexer with Syslog as well. The main thing is configuring syslog to forward on the asa and there are plenty of resources online for doing this.

[eallanjr]

Agreed - we also send to a centralized syslog server running a heavy forwarder. This allows us to do per-event filtering, since our network admins want to keep way more firewall logs than we actually wanted to index in Splunk (or have the licensing for!)