Support for Cisco ASA

Graylog Central (peer support)
1

Hi all,

i want to ask about ASA support graylog or not? could you guide me how to config it?

Thanks

2

You can try using a Syslog UDP input with your Cisco ASA appliances or, if that fails, a Raw/Plaintext UDP input and some extractors.

There are also some content packs on the Graylog Marketplace related to Cisco ASA appliances:

3

We use the syslog/UDP option on our ASA’s, works great.

Warning: Beware enabling Syslog/TCP on the ASA’s without poking around in the manual. I think the default settings tell the ASA “stop routing traffic for everything” if it can’t reach the logging destination.

4

AFAIK you need todo something like

clock timezone UTC 0 0 
no clock summer-time
ntp server 0.0.0.0 prefer source management
logging timestamp
logging trap 6 
logging enable 
logging host management 1.2.3.4 tcp/8514

to enable that - but for sure, change the NTP Server to some reachable/internal and the host IP and Port to the Graylog server and Input.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.