Cisco ASA 5505 Configuration Manual page 1632

Log Monitoring
i.
To filter syslog messages, choose one of the settings in the Filter By drop-down list, then click Filter in
Step 4
the toolbar. This setting also applies to all future syslog messages. To clear all filters, click Show All in
the toolbar.
Note
Editing Filtering Settings
To edit filtering settings that you created using the Build Filter dialog box, perform the following steps:
Choose one of the following:
•
•
•
Cisco ASA 5500 Series Configuration Guide using ASDM
71-24
Click OK to add the filter settings you have just specified to the Filter By drop-down list in the log
viewers. The filter strings follow a specific format. The prefix FILTER: designates all custom filters
that appear in the Filter By drop-down list. You may still type random text into this field.
The following table shows examples of the format used.
Build Filter Example
Source IP = 192.168.1.1 or 0.0.0.0
Source Port = 67
Severity = Informational
Destination IP = 1.1.1.1 through 1.1.1.10
Syslog ID not in the range 725001 through
725003
Source IP = 1.1.1.1
Description = Built outbound
You cannot save filters that you have specified with the Build Filter dialog box. These filters are
valid only for the ASDM session during which they were created.
Revise a filter directly by entering the changes in the Filter By drop-down list.
Choose a filter in the Filter By drop-down list, then click Build Filter to display the Build Filter
dialog box. To remove the current filter settings and enter new ones, click Clear Filter. Otherwise,
change the settings that appear, and click OK.
Note These filter settings apply only to those defined in the Build Filter dialog box.
To stop filtering and show all syslog messages, click Show All in the toolbar.
Chapter 71
Filter String Format
FILTER: srcIP=192.168.1.1,0.0.0.0;srcPort=67;
FILTER: sev=6;dstIP=1.1.1.1-1.1.1.10;
FILTER: sysID=!725001-725003;
FILTER: srcIP=1.1.1.1;descr=Built outbound
Configuring Logging
OL-20339-01