cisco asa firewall logs

cyberhack255 · ‎06-21-2012

Can anyone help me how to collect access log from cisco ASA 5505 firewall.Thanks

dondky · ‎06-21-2012

How we do it is configure syslog forwarding on the ASA to point to a centralized syslog collector. We then forward the data off using a Splunk forwarder to an indexer. I am sure you can skip this step and just go straight to the indexer with Syslog as well. The main thing is configuring syslog to forward on the asa and there are plenty of resources online for doing this.

eallanjr · ‎06-21-2012

Agreed - we also send to a centralized syslog server running a heavy forwarder. This allows us to do per-event filtering, since our network admins want to keep way more firewall logs than we actually wanted to index in Splunk (or have the licensing for!)

cisco asa firewall logs

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation

cisco asa firewall logs

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...