Cisco Certified Expert

Generating Logging Messages

The firewall uses logging to send system messages to one or more logging destinations, where they can be collected, archived, and reviewed.

Messages are generated according to a severity level, specified by a number (0 through 7) or a keyword, as shown in Table 10-1.

Table 10-1. System Message Severity Levels
Severity Level	Description
0: emergencies	The system is unusable
1: alerts	Immediate action is required
2: critical	A critical condition exists
3: errors	Error message
4: warnings	Warning message

Table 10-1. System Message Severity Levels

Severity Level	Description
5: notifications	A normal but significant condition
6: informational	Information message
7: debugging	Debug output and very detailed logs

Logging messages can be sent to any of the following destinations:

• The firewall console

• Telnet or SSH sessions to the firewall

• A temporary buffer internal to the firewall

• SNMP management stations

• Syslog servers

• Firewall management applications such as Cisco Adaptive Security Device Manager (ASDM) and Cisco PIX Device Manager (PDM)

• E-mail addresses (ASA 7.0 and above, FWSM 3.1[1] and above)

• An FTP server (ASA 7.0 and above, FWSM 3.1[1] and above)

• Firewall flash (ASA 7.0 and above, FWSM 3.1[1] and above)

The logging level can be set to determine which messages should be sent to each of the destinations. When you set a severity level for a destination, all messages with a lower severity level are also sent.

Alternatively, you can adjust the severity level for the logging destination so that a lower value is used. This reduces the number and type of messages produced but also reduces the amount of useful information that can be collected and analyzed.

You should always add time stamps to Syslog messages to help in real-time debugging and management. The firewall can add time stamps as messages are generated, or a Syslog server can add time stamps as messages are received.

You should have all your network devices use a common time reference point so that all the time stamps on all logging messages are synchronized. You can do this by configuring firewalls, routers, and switches to use one or more authoritative NTP servers as a time source.

If you have some NTP servers inside your network, each network device can synchronize time with them. However, if you intend to use NTP servers on the public Internet, you should use a hierarchical approach. Select two routers within your network to synchronize time with the

Internet servers. Optimally, each router should peer with three unique time sources so that none of them are duplicated.

Then point all your inside devices to synchronize time with the routers. The idea is to contain the bulk of NTP synchronizations within your network rather than have a multitude of hosts peering with the Internet servers.

You can configure a unique "device ID" so that logging messages from a firewall can be readily identified. This becomes important when one Syslog server collects messages from many different firewalls, routers, and switches.

Figure 10-1 shows each of the logging severity levels, along with a general list of the types of messages generated. Each level also includes every level below it. The higher the severity level, the more types of messages that are included.

Figure 10-1. Syslog Severity Levels and Their Messages [View full size image]

* Faiiover

* Denied Panels/Connections

Alter ea&t Ciiecks »URL Filter Server Problems

Address Verification

* Authenticate rv'Authorizaflon Failures

* Mate Failures

* CPU & Memory Resource Issues •Tunnel Problems

* Faiiover

* Denied Panels/Connections

Alter ea&t Ciiecks »URL Filter Server Problems

Address Verification

• Denied Connections Based on ACL

• Fragmentation Errors

• Invalid Addresses -Sriun & IDS Events •Tunnel Errors

• Aulo Update Errors

* Debug Messages ■ Uaulh Events

* Aulhenlkatkin AultKirizaliDn Everts

• Denied Connections Based on ACL

• Fragmentation Errors

• Invalid Addresses -Sriun & IDS Events •Tunnel Errors

• Aulo Update Errors

Commands Executed by Users Configuration Events User and Session Activity

* Debug Messages ■ Uaulh Events

* Aulhenlkatkin AultKirizaliDn Everts

■ TCP/UDP Request Handling

Firewall Startup

TCP/UDP Connects ButWreandowii

* Xlate Activity

Tunnel Activity DHCP Activity FiXup Activity

System messages are logged in either the default or EMBLEM format. Figure 10-2 shows the default message format. Each message has the following fields:

• Time stamp— The date and time from the firewall clock. The default is no time stamp.

• Device ID— Added to uniquely identify the firewall generating the message. Can be the firewall's host name, an interface IP address, or an arbitrary text string. The default is no device-id.

• Message ID— Always begins with %PIX-, %ASA-, or %FWSM-, followed by the severity level and the six-digit message number.

• Message text— A description of the event or condition that triggered the message.

Figure 10-2. Firewall Logging Message Format [View full size image]

Figure 10-2. Firewall Logging Message Format [View full size image]

DiVbet-ld:

DiVbet-ld:

The EMBLEM format is used primarily for the CiscoWorks Resource Manager Essentials (RME) Syslog analyzer. This format matches the Cisco IOS Software Syslog format produced by routers and switches. It is available only to UDP Syslog servers.

Note

By default, logging to a Syslog server uses UDP port 514. You can also select TCP along with a specific port number for reliable logging. Sending logging messages via SNMP traps uses UDP port 162. UDP is usually used as an efficient, "best-effort" method. TCP can be used when Syslog collection is a vital part of enterprise security, because its delivery is reliable.

The six-digit message numbers are arbitrarily defined by Cisco and uniquely identify each logging message. You can look up message numbers and their meanings in Appendix B, "Security Appliance Logging Messages."

0 0