Cisco Firepower 4110 Preparative Procedures & Operational User Manual page 27

Cisco Preparative Procedures & Operational User Guide
7) Specify the name of the file in which the messages are logged. Up to 16 characters are allowed in
the file name.
Firepower-chassis /monitoring # set syslog file name filename
8) (Optional) Select the lowest message level that you want stored to a file. If the file state is
enabled, the system stores that level and above in the syslog file. The level options are listed in
order of decreasing urgency. The default level is Critical.
Firepower-chassis /monitoring # set syslog file level {emergencies |
alerts | critical | errors | warnings | notifications | information |
debugging}
9) (Optional) Specify the maximum file size, in bytes, before the system begins to write over the
oldest messages with the newest ones. The range is 4096 to 4194304 bytes.
Firepower-chassis /monitoring # set syslog file size filesize
10) Configure sending of syslog messages to up to three external syslog servers:
a) Enable or disable the sending of syslog messages to up to three external syslog servers:
Firepower-chassis /monitoring # {enable | disable} syslog remote-
destination {server-1
b) (Optional) Select the lowest message level that you want stored to the external log. If the
remote-destination is enabled, the system sends that level and above to the external server.
The level options are listed in order of decreasing urgency. The default level is Critical.
Firepower-chassis /monitoring # set syslog remote-destination
{server-1 | server-2 | server-3} level{emergencies | alerts |
critical | errors | warnings | notifications | information |
debugging}
c) Specify the hostname or IP address of the specified remote syslog server. Up to 256
characters are allowed in the hostname. In the evaluated configuration, follow the instructions
in "Configure IPsec Secure Channel" section to secure the syslog traffic.
Firepower-chassis /monitoring # set syslog remote-destination
{server-1 | server-2 | server-3} hostname hostname
d) (Optional) Specify the facility level contained in the syslog messages sent to the specified
remote syslog server.
Firepower-chassis /monitoring # set syslog remote-destination
{server-1 | server-2 | server-3} facility {local0 | local1 | local2
| local3 | local4 | local5 | local6 | local7}
11) Configure the local sources. Enter the following command for each of the local sources you want
to enable or disable:
Firepower-chassis /monitoring # {enable | disable} syslog source
{audits | events | faults}
This can be one of the following:
© 2016 Cisco Systems, Inc. All rights reserved.
server-2 | server-3}