Cisco ASA Series Cli Configuration Manual page 1974

Configuring Logging
Sending Syslog Messages to an External Syslog Server
You can archive messages according to the available disk space on the external syslog server, and
manipulate logging data after it is saved. For example, you could specify actions to be executed when
certain types of syslog messages are logged, extract data from the log and save the records to another
file for reporting, or track statistics using a site-specific script.
To send syslog messages to an external syslog server, perform the following steps:
Command
Step 1
logging host interface_name syslog_ip
[tcp[/port] | udp[/port] [format emblem]]
Example:
hostname(config)# logging host dmz1
192.168.1.5 udp 1026 format emblem
Step 2
logging trap {severity_level | message_list}
Example:
hostname(config)# logging trap errors
Cisco ASA Series CLI Configuration Guide
1-8
Purpose
Configures the ASA and ASASM to send messages to a
syslog server.
The format emblem keyword enables EMBLEM format
logging for the syslog server with UDP only. The
interface_name argument specifies the interface through
which you access the syslog server. The syslog_ip argument
specifies the IP address of the syslog server. The tcp[/port] or
udp[/port] keyword and argument pair specify that the ASA
and ASASM should use TCP or UDP to send syslog messages
to the syslog server.
You can configure the ASA to send data to a syslog server
using either UDP or TCP, but not both. The default protocol is
UDP if you do not specify a protocol.
If you specify TCP, the ASA and ASASM discover when the
syslog server fails and as a security protection, new
connections through the ASA and ASA Services Module are
blocked. To allow new connections regardless of connectivity
to a TCP syslog server, see Step 3. If you specify UDP, the
ASA and ASASM continue to allow new connections whether
or not the syslog server is operational. Valid port values for
either protocol are 1025 through 65535. The default UDP port
is 514. The default TCP port is 1470.
Specifies which syslog messages should be sent to the syslog
server. You can specify the severity level number (1 through
7) or name. For example, if you set the severity level to 3, then
the ASA and ASASM send syslog messages for severity
levels 3, 2, and 1. You can specify a custom message list that
identifies the syslog messages to send to the syslog server.
Chapter 1 Configuring Logging