# Syslog-NG **URL:** \ **Category:** SLES Networking\ **Created:** [November 10, 2014, 4:43pm UTC](https://forums.suse.com/t/syslog-ng/26335 "2014-11-10T16:43:46Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![John\_Gill](https://avatars.discourse-cdn.com/v4/letter/j/9dc877/32.png) [@John\_Gill](https://forums.suse.com/u/John_Gill)\ **Post date:** [November 10, 2014, 4:43pm UTC](https://forums.suse.com/t/syslog-ng/26335/1 "2014-11-10T16:43:46Z")
Hi, Running SLES11sp3 and have enabled syslog-ng. I am trying to log everything from my Cisco ASA (firewall) to my new syslog server. I have fiddled a bit, and I am getting messages into various files in /var/log…so far so good. What I really want is for all the CiscoASA messages to go into one file under /var/log/ciscoasa and then have logrotate zip the files every week and then rotate this every 3 months. I assume that the usual server logging will continue as normal. As usual, any suggestions, comments etc will be appreciated. Regards John ---
**Author:** ![ab1](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@ab1](https://forums.suse.com/u/ab1)\ **Post date:** [November 10, 2014, 5:07pm UTC](https://forums.suse.com/t/syslog-ng/26335/2 "2014-11-10T17:07:04Z")
Can you post a sample of your cisco-sourced events? Filtering is pretty neat in syslog-ng. Another customer tried to do some filtering before, and this may at least get you started: [https://forums.suse.com/showthread.php?4148-syslog-ng-and-filter](https://forums.suse.com/showthread.php?4148-syslog-ng-and-filter) Another post from the Internet with a filtering example: [http://www.syslog.org/forum/syslog-ng/syslog-ng-filter-using-match%28%29-and-value/](http://www.syslog.org/forum/syslog-ng/syslog-ng-filter-using-match%28%29-and-value/) – Good luck. If you find this post helpful and are logged into the web interface, show your appreciation and click on the star below… ---
**Author:** ![John\_Gill](https://avatars.discourse-cdn.com/v4/letter/j/9dc877/32.png) [@John\_Gill](https://forums.suse.com/u/John_Gill)\ **Post date:** [November 11, 2014, 11:31am UTC](https://forums.suse.com/t/syslog-ng/26335/3 "2014-11-11T11:31:03Z")
Hi ab, Below are some samples of the log files in /var/log/localmessages and /var/log/messages coming from the Cisco ASA 10.1.2.1 to my syslog server 10.1.3.42 I am not too concerned about splitting the data into separate logfiles just so long as “logrotate” will zip the file(s) on a weekly basis and store them for 3 to 6 months. * * * \*\*\* localmessages \*\*\* * * * Nov 11 08:10:46 10.1.2.1 %ASA-7-713906: IKE Receiver: Packet received on 10.5.1.2:4500 from 41.13.146.205:46452 Nov 11 08:10:46 10.1.2.1 %ASA-7-713236: IP = 41.13.146.205, IKE\_DECODE RECEIVED Message (msgid=d2b4a40a) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80 Nov 11 08:10:46 10.1.2.1 %ASA-7-715047: Group = cor-ballito-tg, Username = cor\_ballito\_3G, IP = 41.13.146.205, processing hash payload Nov 11 08:10:46 10.1.2.1 %ASA-7-715047: Group = cor-ballito-tg, Username = cor\_ballito\_3G, IP = 41.13.146.205, processing notify payload Nov 11 08:10:46 10.1.2.1 %ASA-7-715075: Group = cor-ballito-tg, Username = cor\_ballito\_3G, IP = 41.13.146.205, Received keep-alive of type DPD R-U-THERE (seq number 0x1c8d7e5d) Nov 11 08:10:46 10.1.2.1 %ASA-7-715036: Group = cor-ballito-tg, Username = cor\_ballito\_3G, IP = 41.13.146.205, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x1c8d7e5d) Nov 11 08:10:46 10.1.2.1 %ASA-7-715046: Group = cor-ballito-tg, Username = cor\_ballito\_3G, IP = 41.13.146.205, constructing blank hash payload Nov 11 08:10:46 10.1.2.1 %ASA-7-715046: Group = cor-ballito-tg, Username = cor\_ballito\_3G, IP = 41.13.146.205, constructing qm hash payload Nov 11 08:10:46 10.1.2.1 %ASA-7-713236: IP = 41.13.146.205, IKE\_DECODE SENDING Message (msgid=8f359a6f) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80 Nov 11 08:10:47 10.1.2.1 %ASA-5-304001: 10.6.5.23 Accessed URL 10.1.3.54:[http://jde2.corobrik.co.za/jde/css/JSGrid.css](http://jde2.corobrik.co.za/jde/css/JSGrid.css) Nov 11 08:10:47 10.1.2.1 %ASA-5-304001: 10.6.5.23 Accessed URL 10.1.3.54:[http://jde2.corobrik.co.za/jde/css/RI.css](http://jde2.corobrik.co.za/jde/css/RI.css) Nov 11 08:10:47 10.1.2.1 %ASA-7-710007: NAT-T keepalive received from 197.87.79.42/4500 to outside:10.5.1.2/4500 Nov 11 08:10:47 10.1.2.1 %ASA-7-710007: NAT-T keepalive received from 41.13.76.85/54060 to outside:10.5.1.2/4500 Nov 11 08:10:47 10.1.2.1 %ASA-5-304001: 10.1.3.15 Accessed URL ZScaler: [http://osce11-ilspn30-p.activeupdate.trendmicro.com:80/activeupdate/pattern/itbldiff\_1463000200\_1463000300.zip](http://osce11-ilspn30-p.activeupdate.trendmicro.com:80/activeupdate/pattern/itbldiff_1463000200_1463000300.zip) * * * \*\*\* EOF \*\*\* * * * * * * \*\*\* messages \*\*\* * * * Nov 11 08:13:44 10.1.2.1 %ASA-5-304001: 10.6.2.22 Accessed URL 10.1.3.54:[http://jde2.corobrik.co.za/jde/share/images/welcome/shuttleleft\_dis.png](http://jde2.corobrik.co.za/jde/share/images/welcome/shuttleleft_dis.png) Nov 11 08:13:44 10.1.2.1 %ASA-5-304001: 10.6.2.22 Accessed URL 10.1.3.54:[http://jde2.corobrik.co.za/jde/share/images/welcome/shuttleleft\_ena.png](http://jde2.corobrik.co.za/jde/share/images/welcome/shuttleleft_ena.png) Nov 11 08:13:44 10.1.2.1 %ASA-5-304001: 10.6.2.22 Accessed URL 10.1.3.54:[http://jde2.corobrik.co.za/jde/share/images/welcome/shuttleright\_dis.png](http://jde2.corobrik.co.za/jde/share/images/welcome/shuttleright_dis.png) Nov 11 08:13:44 10.1.2.1 %ASA-7-609002: Teardown local-host outside:197.78.204.107 duration 1:12:07 Nov 11 08:13:44 10.1.2.1 %ASA-5-304001: 10.6.2.22 Accessed URL 10.1.3.54:[http://jde2.corobrik.co.za/jde/share/images/welcome/splittervc.png](http://jde2.corobrik.co.za/jde/share/images/welcome/splittervc.png) Nov 11 08:13:44 10.1.2.1 %ASA-5-304001: 10.6.2.22 Accessed URL 10.1.3.54:[http://jde2.corobrik.co.za/jde/share/images/welcome/splittervc\_ovr.png](http://jde2.corobrik.co.za/jde/share/images/welcome/splittervc_ovr.png) Nov 11 08:13:44 10.1.2.1 %ASA-5-304001: 10.6.2.22 Accessed URL 10.1.3.54:[http://jde2.corobrik.co.za/jde/share/images/small-go.gif](http://jde2.corobrik.co.za/jde/share/images/small-go.gif) Nov 11 08:22:52 10.1.2.1 %ASA-7-715075: Group = corobrik-vpn, Username = tcm, IP = 197.87.79.42, Received keep-alive of type DPD R-U-THERE (seq number 0x163513d9) Nov 11 08:22:52 10.1.2.1 %ASA-7-715036: Group = corobrik-vpn, Username = tcm, IP = 197.87.79.42, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x163513d9) Nov 11 08:22:52 10.1.2.1 %ASA-7-715046: Group = corobrik-vpn, Username = tcm, IP = 197.87.79.42, constructing blank hash payload Nov 11 08:22:52 10.1.2.1 %ASA-7-715046: Group = corobrik-vpn, Username = tcm, IP = 197.87.79.42, constructing qm hash payload Nov 11 08:22:52 10.1.2.1 %ASA-7-713236: IP = 197.87.79.42, IKE\_DECODE SENDING Message (msgid=25aad8a6) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80 Nov 11 08:22:52 10.1.2.1 %ASA-5-304001: 10.6.17.95 Accessed URL 10.1.3.5:[http://10.1.3.5/proxy.pac](http://10.1.3.5/proxy.pac) Nov 11 08:22:52 10.1.2.1 %ASA-5-304001: 10.6.24.93 Accessed URL 10.1.3.5:[http://10.1.3.5/proxy.pac](http://10.1.3.5/proxy.pac) Nov 11 08:22:52 10.1.2.1 %ASA-5-304001: 10.6.8.24 Accessed URL jde1:[http://jde1.corobrik.co.za/jde/ResourceCanonicalsJS.mafService?e1.namespace=&e1.service=ResourceCanonicalsJS&RENDER\_MAFLET=E1Menu&e1.state=maximized&e1.mode=view](http://jde1.corobrik.co.za/jde/ResourceCanonicalsJS.mafService?e1.namespace=&e1.service=ResourceCanonicalsJS&RENDER_MAFLET=E1Menu&e1.state=maximized&e1.mode=view) Nov 11 08:22:52 10.1.2.1 %ASA-5-304001: 10.6.8.24 Accessed URL jde1:[http://jde1.corobrik.co.za/jde/js/dropdownMenuItem.js](http://jde1.corobrik.co.za/jde/js/dropdownMenuItem.js) Nov 11 08:22:52 10.1.2.1 %ASA-5-304001: 10.6.16.97 Accessed URL webmail1:[http://webmail1.corobrik.co.za/gw/webacc?User.context=17dcd7f699bfec2d3f236482ba7a4a69f4b7f790&action=Folder.List&merge=jfolders&forcedUpdate=1415687173280](http://webmail1.corobrik.co.za/gw/webacc?User.context=17dcd7f699bfec2d3f236482ba7a4a69f4b7f790&action=Folder.List&merge=jfolders&forcedUpdate=1415687173280) Nov 11 08:22:52 10.1.2.1 %ASA-5-304001: 10.6.5.23 Accessed URL 10.1.3.54:[http://jde2.corobrik.co.za/jde/css/RI.css](http://jde2.corobrik.co.za/jde/css/RI.css) Nov 11 08:22:53 10.1.2.1 %ASA-5-304001: 10.6.10.26 Accessed URL 10.1.3.5:[http://10.1.3.5/proxy.pac](http://10.1.3.5/proxy.pac) Nov 11 08:22:53 10.1.2.1 %ASA-5-304001: 10.6.10.26 Accessed URL 10.1.3.5:[http://10.1.3.5/proxy.pac](http://10.1.3.5/proxy.pac) Nov 11 08:22:53 10.1.2.1 %ASA-5-304001: 10.6.22.21 Accessed URL 10.1.3.54:[http://jde2.corobrik.co.za/jde/css/calendar.css](http://jde2.corobrik.co.za/jde/css/calendar.css) Nov 11 08:22:53 10.1.2.1 %ASA-5-304001: 10.6.22.21 Accessed URL 10.1.3.54:[http://jde2.corobrik.co.za/jde/css/SidePanel.css](http://jde2.corobrik.co.za/jde/css/SidePanel.css) * * * \*\*\* EOF \*\*\* * * * Regards John ---
**Author:** ![ab1](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@ab1](https://forums.suse.com/u/ab1)\ **Post date:** [November 11, 2014, 2:39pm UTC](https://forums.suse.com/t/syslog-ng/26335/4 "2014-11-11T14:39:25Z")
Wildly guessing, try adding these to the syslog-ng configuration file, then restart the syslog-ng service: [CODE] destination d\_ciscoasa { file("/var/log/ciscoasa"); }; filter f\_ciscoasa { match(’^ASA-:’); }; log { source(src); filter(f\_ciscoasa); destination(d\_ciscoasa); }; [CODE] – Good luck. If you find this post helpful and are logged into the web interface, show your appreciation and click on the star below… ---
**Author:** ![Jens-U](https://avatars.discourse-cdn.com/v4/letter/j/d78d45/32.png) [@Jens-U](https://forums.suse.com/u/Jens-U)\ **Post date:** [November 11, 2014, 7:16pm UTC](https://forums.suse.com/t/syslog-ng/26335/5 "2014-11-11T19:16:07Z")
Hi John, > [@John\_Gill;24799](#): > > I am not too concerned about splitting the data into separate logfiles just so long as “logrotate” will zip the file(s) on a weekly basis and store them for 3 to 6 months. this then is covered in logrotate’s configuration. See /etc/logrotate.d/syslog for a sample - if you manage to put these messages in a separate log file (see i.e. ab’s reply), then create a new file in /etc/logrotate.d, where you will set up the rotation similar to the entries in /etc/logrotate.d/syslog. If you want weekly rotation, use “weekly” instead of maxage: [QUOTE]weekly Log files are rotated if the current weekday is less than the weekday of the last rotation or if more than a week has passed since the last rotation. This is normally the same as rotating logs on the first day of the week, but it works better if logrotate is not run every night.[/QUOTE] If you want to keep the files for half a year, set “rotate” to 26: Keeping 26 weekly files covers about 6 months. Compression is controlled via “compress” and “compresscmd”. And keep the “postrotate” block, so that syslogd gets restarted. For everything else, see “man logrotate” 😉 Regards, Jens ---
**Author:** ![Jens-U](https://avatars.discourse-cdn.com/v4/letter/j/d78d45/32.png) [@Jens-U](https://forums.suse.com/u/Jens-U)\ **Post date:** [November 11, 2014, 7:30pm UTC](https://forums.suse.com/t/syslog-ng/26335/6 "2014-11-11T19:30:07Z")
Hi \*, another option would be to filter one the message source: ```auto filter f_ciscooasa { host("10.1.2.1"); ); ``` One thing to look out for is if the IP suddenly resolves to a name - then the filter would have to be adjusted (add another condition “… or host( “somenameforASAbox”)…” ). Regards, Jens ---
**Author:** ![John\_Gill](https://avatars.discourse-cdn.com/v4/letter/j/9dc877/32.png) [@John\_Gill](https://forums.suse.com/u/John_Gill)\ **Post date:** [November 12, 2014, 9:08am UTC](https://forums.suse.com/t/syslog-ng/26335/7 "2014-11-12T09:08:08Z")
Hi ab and jmozdzen, Thanks for the information, it has been a great help. I fiddled a bit more and now I am capturing the logs from the Cisco firewall. I will have to see if the logrotate is working. The only issue is that the files /var/log/messages and localmessages are also getting the log entries. Can this be turned off so that the Cisco firewall logs only go to the ciscoasa.log file, otherwise the data is duplicated/triplicated. Regards John ---
**Author:** ![Jens-U](https://avatars.discourse-cdn.com/v4/letter/j/d78d45/32.png) [@Jens-U](https://forums.suse.com/u/Jens-U)\ **Post date:** [November 12, 2014, 12:04pm UTC](https://forums.suse.com/t/syslog-ng/26335/8 "2014-11-12T12:04:49Z")
Hi John, > The only issue is that the files /var/log/messages and localmessages are also getting the log entries. You can change that by adding the inverse filter to the “standard” syslog log entries (those writing to /var/log/messages and localmessages). Regards, Jens