Configure Syslog for ASA via ASDM

The Security Manager Data Collector acts as a syslog server for Cisco devices, collecting messages that you can analyze using Security Manager’s Rule Usage Analysis feature.

This section describes the three procedures for configuring your Cisco ASA to send these syslog messages to Security Manager. These three procedures should be completed for every ASA that you want to monitor with Security Manager.

Prerequisites
• Make sure that you have added the keyword “log” to every ACE that you want to log.
• You must have administrator credentials to access privileged mode on the device.

Step 1: Enable Syslog Server Logging

In this step, you will enable logging on the Cisco security appliance.

  1. Open the ASDM connected to the appliance.
  2. Click Configuration, and then click the Device Management button.
  3. Expand the Logging folder and click Logging Setup.
  4. Make sure that the Enable Logging check box is selected.
  5. Click Apply.

Step 2: Define Logging Filters

In this step, you will create a filter that allows level 6 severity, or informational syslog messages only.

  1. In ASDM, click Configuration, and then click the Device Management button.
  2. Expand the Logging folder and click Logging Filters.
  3. Click Syslog Servers, and then click Edit.
  4. Select Filter on severity and select Informational from the drop-down menu.
  5. Click OK to close the window, and then click Apply.

Step 3: Configure Syslog Servers

In this step, you will add the Security Manager Data Collector as a syslog server for your ASA.

  1. In ASDM, click Configuration, and then click the Device Management button.
  2. Expand the Logging folder and click Syslog Servers.
  3. Click Add.
  4. In the IP Address box, type the IP address of your Security Manager Data Collector.
  5. Select UDP as the Protocol.
  6. Enter 514 as the Port.
  7. Click OK to close the window, and then click Apply.