About mamborn

mamborn · ‎01-04-2022

Did you ever find if there is a upgrade/replacement for the Cisco Security Suite for support on 8.x ?

mamborn · ‎03-16-2012

they are not coming in as sourcetype cisco_asa, and the field extractions are not showing.

mamborn · ‎03-15-2012

I have two ASA firewalls logging to the splunk server. The older version 8.0.3 logs correctly and the sourcetype gets set to cisco_asa. The newer version 8.4.2 the sourcetype gets set to udp:514. I modified the eventtypes and that didn't seem to change it either. [root@linux2 local]# more eventtypes.conf [cisco_firewall] search = %ASA OR %PIX OR %FWSM OR :%ASA So the reports etc that are pre-canned don't find the data.

mamborn · ‎03-15-2012

It looks like with 8.3 of Cisco ASA software the logging format has changed some. Old Version: Mar 15 13:39:13 192.168.1.1 %ASA-6-302015: Built inbound UDP connection 80311398 for External:192.168.2.29/64493 (192.168.2.29/64493) to Internal:192.168.100.1/53 (192.168.100.1/53) (RobinM) New Format Mar 15 13:39:15 192.168.100.100 :%ASA-session-6-302021: Teardown ICMP connection for faddr 172.16.49.19/768 gaddr 192.168.162.2/0 laddr 192.168.162.2/0 The ":%ASA-session" is what has changed. Is there a easy way to fix/modify the inputs. The pre-canned reports don't find the new log entries, and the field extractions are not correct. You can still search manually through splunk though.

Posts	4
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎07-25-2011

Online Status	Offline
Date Last Visited	‎01-04-2022 09:22 AM

Cisco ASA logging format change

Re: Cisco Security Suite for Splunk 8.x

Re: Cisco ASA logging format change

Re: Cisco ASA logging format change

Cisco ASA logging format change