Menu

#4 Issues with wflogs on ASA output

open
nobody
None
5
2008-07-29
2008-07-29
No

A Cisco ASA configured with the statement:
logging device-id hostname

Generates logs which result in multiple warnings of:
warning: line format matches none of the specified module(s): cisco_pix

Probable fix is to check for the text and also allow %ASA in addition to %PIX.

Example below:

neteng-test:/usr/share/doc/wflogs/examples/test# head -2 logs_cisco_pix1
Aug 30 17:38:52 10.0.0.1 Aug 30 2002 10:56:30: %PIX-4-106023: Deny udp src outside:10.10.0.30/3825 dst inside:10.20.0.2/37852 by access-group "outside"
Aug 30 17:38:52 10.0.0.1 Aug 30 2002 10:56:30: %PIX-4-400014: IDS:2004 ICMP echo request from 10.10.0.30 to 10.20.0.2 on interface outside
neteng-test:/usr/share/doc/wflogs/examples/test# head -2 /var/log/cisco/cisco2.log
Jul 29 09:50:29 10.1.50.2 Jul 29 2008 09:56:16 myfirewall : %ASA-6-305012: Teardown dynamic TCP translation from inside:10.2.4.82/53982 to outside:X.X.X.X/54862 duration 0:00:30
Jul 29 09:50:29 10.1.50.2 Jul 29 2008 09:56:16 myfirewall : %ASA-6-302014: Teardown TCP connection 103879231 for outside:X.X.X.X/80 to inside:10.2.4.82/54118 duration 0:00:00 bytes 1518 TCP FINs

Discussion


Log in to post a comment.

MongoDB Logo MongoDB