Syslog messages coming from Standyby ASA ?

Question

I have a pair of ASA's in Active/Standby configuration.  I noticed this morning that the secondary ASA is generating syslog messages when I dont think it should.  Here is the logging configuration -
logging enable
logging timestamp
logging buffer-size 1048576
logging console informational
logging buffered informational
logging trap informational
logging history critical
logging asdm critical
logging mail critical
logging host inside 10.1.4.12
This is the interface that syslog should be coming out of on the primary ASA -
interface GigabitEthernet0/1
description 10.1.85.0/24 Internal Interface
nameif inside
security-level 100
ip address 10.1.85.31 255.255.255.0 standby 10.1.85.32
ospf retransmit-interval 1
ospf hello-interval 1
ospf dead-interval 3
Cisco Adaptive Security Appliance Software Version 8.2(3)
Device Manager Version 6.3(4)
I ran the packet capture wizard on the secondary ASA and saw no syslog traffic coming from it.
Anybody else seen this ?
Ron

Answer 1

Ron
The message that you show us is part of what the ASA is doing to maintain state for all the VPN connections from the primary ASA. I see similar syslog messages from the standby unit in an ASA active/standby pair.
You say:"I wouldnt expect any messages to be coming from it since it isnt really doing anything." But the standby unit is really doing things. As a new session is established on the primary the secondary must process and retain that information. And when a session is discontinued on the primary then the standby must process that also and remove the session from the state table. If the standby were not busy doing these things then it would not be able to take over and process sessions correctly if the primary were to fail.
HTH
Rick