Syslog: logging specific traffic only to syslog server

remote site is accessing onsite servers and need to lock them down based on host ip's and ports.
remote site connects to onsite network thru 6509 L3. want to capture remote traffic to syslog server. (only want to capture remote site traffic, no other traffic).
in order to "see" all traffic passing
"ip any any" required to determine what servers / services remote site is accessing for now. will "lock down" acl once all servers / services are identified.
how to direct only the remote site traffic to my syslog server?
acl 130 permit ip 172.16.3.0 range 1 65535 any
thx

Assuming your remote site is using IP addresses in the 172.16.3.0 subnet with a 255.255.255.0 subnet mask, and you apply your access-list 130 to inbound traffic on the VLAN interface that services them...
...just add the word "log" at the end of your ACL 130 commands. Also, make sure you have "logging x.x.x.x" in your config, where x.x.x.x is the IP address of your syslog server. It would look like this:
access-list 130 permit tcp 172.16.3.0 0.0.0.255 range 1 65535 any log
access-list 130 permit udp 172.16.3.0 0.0.0.255 range 1 65535 any log
access-list 130 permit icmp 172.16.3.0 0.0.0.255 any log
access-list 130 permit ip 172.16.3.0 0.0.0.255 any log
logging x.x.x.x
interface VLAN 163 (assuming that's your VLAN number)
ip access-group 130 in
Any hits on these lines including port numbers will show up in the syslog. You will probably get a lot of entries at first. You may want to fine-tune the ACL as you identify known services early on, so that access to them is still permitted but you don't necessarily log messages for it.

Similar Messages

How to configure IPS 4240 - K9 to send log file to syslog server

I am looking for the commands in how to configure IPS 4240-k9 to send log file to SYSLOG server. If anybody has or came across similer issue please advice.
Thanks in advanced.

Ali -
I am sorry to tell you, but the Cisco IPS Sensors do not send Syslog messages. Your only options for sending signature event information are:
SDEE (an TLS Encrypted XML formatted message) the sensor is the SDEE Host and your event receiver (MARS, IME, Intelitactics, etc) is the client.
SNMP Traps - You need to set the "Action" on each signature you want the sensor to send a trap.
- Bob

Logging of commands on syslog server (Cisco Nexus 7010)

Please help.
How to set up logging of commands on syslog server ? (cisco nexus 7010)

Hi Igor
Nexus has internal accounting log: sh accouting log
But it can be sent only to the accounting server, not to a syslog server.
If you want - you man manually export it to some log.
HTH,
Alex

ASA - log successful and failed logons to syslog server?

Hello,
How can I log successful and failed SSH and ADSM logons to our syslog server?
Thanks

Hi,
I haven't really touched the default logging configurations much but some firewalls that I manage have "logging trap informational" which sends messages of users connecting to the firewall.
The messages shows which username was used and if it was rejected or accepted. These messages all seem to be of the "informational" / "level 6" syslog messages.
The syslog IDs for them are:
ASA-6-113008
ASA-6-113012
ASA-6-113015
Though these messages only show information about the AAA not which type of connection was used (I tried both SSH and ASDM to see)
I'm sure there are more messages that will show additional information about the connection and also what the logged user did on the firewall during the management connection.
- Jouni

How to log successful logins to a syslog server in NX-OS

Does anyone know how to do this in NX-OS? I do it in IOS with the following commands:
login on-failure log
login on-success log
logging x.x.x.x
With that I get a syslog message that I can then log to a file to track who has logged into which device and when. But I can't find the syntax to do the same thing in the Nexus switches that we have. Does anyone know what the equivalent commands are?
Thanks,
Ben

Hi Ben,
By default, failed logins are logged.
You can checked the log using:
show logging logfile | last 15
and for every logging failed (by default) you will get something like this:
2012 Dec 18 14:51:08 Nexus5010-B %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authentication
failed for user en from 2.2.2.1 - login
To get the success-login to show up in the logs we need to increase the level of the authpriv to 5 (it is 3 by default), and doing this will add a new log for failed or succesful connections.
Use the following command:
Nexus5010-A(config)# logging level authpriv 5
You can check loggin levels by using:
#show logging level
After you do this with the logging level you will see in the log something like this when a succesful login takes place:
2005 Jan 6 03:29:48 Nexus5010-A %AUTHPRIV-5-SYSTEM_MSG:    admin :TTY=unknown
; PWD=/var/sysmgr/vsh ; USER=root ; COMMAND=/usr/bin/strings/proc/18340/environ
- sudo
Now for a failed login and after increasing the authpriv level you will see the following logs:
2005 Jan 6 03:31:36 Nexus5010-A %AUTHPRIV-4-SYSTEM_MSG: pam_unix(aaa:auth):check pass; user unknown - aaad
2005 Jan 6 03:31:36 Nexus5010-A %AUTHPRIV-5-SYSTEM_MSG: pam_unix(aaa:auth):
aut
hentication failure; logname= uid=0 euid=0 tty= ruser= rhost= - aaad
For logging *****
Nexus7018(config)# logging ?
console           Set console logging
event             Interface events
ip                IP configuration
level             Facility parameter for syslog messages
logfile           Set File logging
message           Interface events
module            Set module(linecard) logging
monitor           Set terminal line(monitor) logging level
origin-id         Enable origin information for Remote Syslog Server
server            Enable forwarding to Remote Syslog Server
source-interface Enable Source-Interface for Remote Syslog Server
timestamp         Set logging timestamp granularity
You can use logging source-interface ....
Thanks-
Afroz
***Ratings Encourages Contributors ****

Logging ACL entry to Syslog server

I have a simple access-list configured on the outside of an ASA
access-list outside_in permit tcp any host x.x.x.x eq 80
access-list outside_in permit tcp any host x.x.x.x eq 443
access-list outside_in deny ip any any
Could someone please post a sample config showing how I can log all entries that hit the deny statement, and send them to a syslog server?
Thanks in advance

Hi,
You just need to add a "log" key word after the ACL and then it would be sent to your syslog server.
access-list outside_in deny ip any any log
Hope that helps,
Thanks,
Varun

Logging of FWSM context logs to two diffrent zone SYSLOG SERVER

Hello Sat Shri Akal,
Can any one help me about logging of FWSM context logs to two diffrent zone SYSLOG SERVER and SYSLOG Collector
in CSM 3.2.2. I am able to have logs from Admin context but not from my other context of FWSM. Otherwise that context is sending syslogs to ONE syslog server in similsr vlan,but why that perticular context is not able to log ay syslog collector of CSM which is having logs from admin context. Please help me in this case.
regards

Pradeep,
All contexts should be able to reach the CSM server's IP address just like the admin context.
The individual contexts should be configured to send logs to the CSM server's IP address.
From CSM go under each context and add management IP address for the particular context.
Once the above is done you will see logs from all the contexts under CSM.
-Kureli

SCOM 2012 collect Windows Audit logs and forward them to a Linux Syslog server

Hello:
1. We have a SCOM 2012 server.
2. We have SNARE agents for PCI systems, but now we want to save money by gathering all events for all Windows servers using its native features.
3. We also have a centralized Linux server running SYSLOG which aggregates the logs to our Dell LogVault retention appliance (for PCI purposes)
Thus, my question:
In effort to remove the SNARE agents from the windows servers, can we implement Audit Collections Services (ACS) in the windows environment so that they collect/forward audit/event logs to the SCOM 2012 server and then SCOM forwards the events to the centralized
syslog Linux server? In which case they are aggregated to the Dell appliance.
We prefer to use the Linux syslog as the centralized log server but would like to know how to go about implementing the solution above.
Many thanks,
Robert Perez-Corona

Hi,
Here is a thread about how to make SCOM 2012 work as a syslog server, hope this can be helpful for you:
https://social.technet.microsoft.com/Forums/en-US/524ea527-c069-40f9-96ef-026a4aa06fe9/make-scom-2012-a-syslog-server?forum=operationsmanagergeneral
Regards,
Yan Li
Regards, Yan Li

Setting up a network syslog server

I am trying to move my syslog server (which captures my router logs) from a Slackware Linux box to my OS X machine. I have had good luck except for one small detail. Every time *periodic daily* runs syslogd stops accepting the UDP syslog packets that the router is sending.
I have updated com.apple.syslogd.plist to be:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.apple.syslogd</string>
<key>ServiceDescription</key>
<string>Apple System Log Daemon</string>
<key>OnDemand</key>
<false/>
<key>ProgramArguments</key>
<array>
<string>/usr/sbin/syslogd</string>
<string>-u</string>
</array>
<key>ServiceIPC</key>
<false/>
</dict>
</plist>
The only thing I changed was to add "<string>-u</string>" to turn on the UDP listener. And it works, too. Except that at 03:14 every morning periodic does a +kill -HUP+ to the daemon and, for some unknown reason, this turns off the UDP listener.
If I do a full kill to syslogd, which results in a new task completely, it starts with the listener running.
If I do a +ps -A|grep syslogd+ I do see the "-u" in the command even if the listener isn't listening.
I think it might be a bug in the -HUP handler in the syslogd code but I don't know the right place to post the question other than here.
For the forum: is anyone else running syslogd and collecting network log traffic? If you are then do you experience the same problem? I know I can work around the problem by putting in a local daily kill and I probably will but I shouldn't have to should I?
Any thoughts would be appreciated.
Bill W

No, but the servers have been hiccuping lately. When that occurs, I usually quit the browser, relaunch it, empty/delete the cache, and log back in. That seems to clear things up.

Problem sending debug output to a syslog server

Hi,
i am having a problem when a tried to send the output from a debug command to my syslog server with the logging debug-trace command.
I already have a syslog server getting all the notification level logs from my ASA cluster.
When i enter the command debug fover fail, i can see on the terminal session all theoputput m,essgaes from that commnad, but when i type debug-trace, the debug messages disappear from monitor and they aren´t redirect to my syslog server. I analyze the traffic arriving to my syslog server with tcpdump, and the messages from the debug command are not being send to the syslog server.
I should say i also have a netflow collector active.
I attached the sh run logging output, maybe it can help:
logging enable
logging timestamp
logging standby
logging buffer-size 8096
logging monitor errors
logging buffered warnings
logging trap notifications
logging asdm errors
logging mail alerts
logging from-address xxxxxxx
logging recipient-address xxxxxxx level alerts
logging facility 16
logging host ADAM-MANAG 192.168.50.8
logging debug-trace
logging permit-hostdown
Could someone help me with this?
Thanks in advance

Hi Gurpreet,
thank you very much for your reply.
When i enter the command logging trap debugging and logging debug-trace , I can see in my syslog server messages with the tag 711001 coming from the debug fover fail command, but I also get a bunch of other information i don´t want (all the debug level messages).
As far as I know, the debug-trace command redirect just the debug output from commands that you specifically enter in order to trace and debug a problem, but this is not the case, in order to make this work i have to enable the debugging trap level.
Is it something I am doing wrong , or I misunderstand?
Regards,

ACS appliance1120 ACS 4.2.1.15 syslog message to syslog server

Hi All ,
I am using ACS 1120 appliance running ACS version 4.2.1.15 , I am pointing out all syslog message to my external syslog server (passed authentication , failed authentication , database replication , administration aduit ,tacacs accounting ) , but i could recieve only passed authentication log message to my external log server , no other log message except passed authentication is pushed to my external log server , But i could see failed attempts , database replication,administrtation audit log message locally on my acs appliance as CSV file ,
Syslog server configuration is configured under all logging (passed , failed , administration , tacacs accounting ) , but i am surprise to see only passed authentication logg is sent out from acs appliance , Is there any patch to be installed for logg message scripting ?? , please advise ..

Refer the link : https://supportforums.cisco.com/discussion/11513026/migrating-acs-420-421
you can directly upgrade from 4.2.0.124 to 5.6 : http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-6/user/guide/acsuserguide/migrate.html#98379

Cisco ISE and external syslog server

Hi Security Experts,
We are starting with deploying cisco ISE (Identity Services Engine) in our network. We have allocated 250GB space for (Admin+Monitor) ISE node.
I want to know if we can send the logs from monitoring node to external syslog server after a defined time interval.
For example, logs which are more than 10 days old should be sent to external syslog server. So basically our monitoring node will have logs which are at the max 9 days old. Is it possible? Could you point me to some doc which explains configuration of the same?
Thanks,
Kashish

No this isnt possible via syslog. What you are looking for is database purging, so that the monitoring database is purged after a specific time interval. Here is a guide that will help shed some light on this:
http://www.cisco.com/en/US/docs/security/ise/1.1/user_guide/ise_mnt.html#wp1054328
Tarik Admani
*Please rate helpful posts*

Configuration required in Cat 4006 to forward errors to syslog server

Hi,
I have setup a Kiwi syslog server. I want to configure in my Cat 4006 switch to forward the following messages to my syslog server
1. configuration changes
2. Vlan creation /modification
3. Power supply failures/module failures/temperature
4. When the processor utlization exceeds more than 75% , it should send a alert message to syslog server
5. Switch restart
6. Trap for any changes in Uplink ports only. There are 4 uplinks to other Switches from 4006. If any problem with these ports (uplink), it should send message to syslog server , not for all ports
Thanks in advance
Raju

Hi
I feel this link will be of some help to u in configuring different severity levels for different facilities available.
http://www.cisco.com/en/US/partner/products/hw/switches/ps663/products_configuration_guide_chapter09186a00800d81c8.html
By default for abnormal temp conditions u will get logs in the syslog server if u have already pointed the logs to the syslog server..
regds

Syslog Server Disk Space with ASA5510

Hi,
i'm about to configure a syslog server to receive syslog messages from a Cisco ASA5510 and being it a one week test I was wondering how much space should I allocate on the machine hosting the tool (kiwi syslog).
I see that the ASA fills the internal syslog buffer to 4MB and then it overrides it. How many messages would those 4MB be?
Thanks for your help.

Hello,
I copied 30 messages off my firewall into a text file and it's a little over 3 KB in size (which averages out to about 100 bytes per message). That means that 4 MB would be about 40,000 messages. As a side note, the ASA's maximum local buffer size is about 1 MB, rather than 4 MB.
How much disk space you should allocate for log storage will depend greatly on what level of syslogging you're doing, how much traffic the firewall sees, and how long you want to keep the logs for. Hopefully the above numbers will give you a rough idea of a baseline that you can expand on to meet your requirements.
Hope that helps.
-Mike

Syslog Server setup ???

Hello all my good friends,
I intend to setup a syslog server to log important inofrmation traffic through my router, but I don't konw how to do that. Please tell what software I have to install on my Linux box to turn it into syslog server, and brief expalnation of setting/configuring it, in addition, what commands I have to add in my router configuration file ? Could you explain me as much as possible if you don't mind ?
I never forget my gratitude to all of answer me.
Tu from Vietnam

With Linux I am not sure, but with Solaris you usually just have to make sure that loghost resolves to the host you wish to log to.
Alex

Syslog: logging specific traffic only to syslog server

Similar Messages

Maybe you are looking for