Cisco Security Appliance Logging Configuration and System Log Messages

454 Pages·2005·4.35 MB·English

Cisco Security Appliance Logging
Configuration and System Log Messages
For the Cisco PIX 500 Series and Cisco ASA Series Security Appliance
Software Version 7.1
Corporate Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Text Part Number: OL-6721-02
THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED ORIMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
CCSP, the Cisco Square Bridge logo, Follow Me Browsing, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and
iQuick Study are service marks of Cisco Systems, Inc.; and Access Registrar, Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco
Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Empowering the Internet Generation,
Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, FormShare, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo,
iQ Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing,
Pre-Routing, ProConnect, RateMUX, ScriptShare, SlideCast, SMARTnet, StrataView Plus, SwitchProbe, TeleRouter, The Fastest Way to Increase Your Internet Quotient,
TransPath, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship
between Cisco and any other company. (0501R)
Copyright © 2005 Cisco Systems, Inc. All rights reserved.
C O N T E N T S
Preface xxxiii
Document Objectives xxxiii
Audience xxxiii
Document Organization xxxiv
Document Conventions xxxiv
Related Documentation xxxiv
Obtaining Documentation xxxiv
Cisco.com xxxv
Documentation DVD xxxv
Ordering Documentation xxxv
Documentation Feedback xxxvi
Cisco Product Security Overview xxxvi
Reporting Security Problems in Cisco Products xxxvi
Obtaining Technical Assistance xxxvii
Cisco Technical Support Website xxxvii
Submitting a Service Request xxxvii
Definitions of Service Request Severity xxxviii
Obtaining Additional Publications and Information xxxviii
CHAPTER 1 Configuring Logging and SNMP 1-1
Configuring SNMP 1-1
SNMP Overview 1-1
Enabling SNMP 1-3
Configuring and Managing Logs 1-4
Logging Overview 1-4
Logging in Multiple Context Mode 1-5
Enabling and Disabling Logging 1-5
Enabling Logging to All Configured Output Destinations 1-6
Disabling Logging to All Configured Output Destinations 1-6
Viewing the Log Configuration 1-6
Configuring Log Output Destinations 1-7
Log Output Destination Overview 1-8
Designating a Syslog Server as an Output Destination 1-8
Designating an E-mail Address as an Output Destination 1-10
Cisco Security Appliance Logging Configuration and System Log Messages
OL-6721-02 iii
Contents
Designating ASDM as an Output Destination 1-11
Viewing Logs Using a Telnet Session 1-12
hostname(config)# no logging monitorDesignating the Log Buffer as an Output
Destination 1-13
Filtering System Log Messages to be Sent to an Output Destination 1-15
Message Filtering Overview 1-15
Filtering System Log Messages by Class 1-16
Filtering System Log Messages with Custom Message Lists 1-17
Customizing the Log Configuration 1-19
Configuring the Logging Queue 1-19
Including the Date and Time in System Log Messages 1-19
Including the Device ID in System Log Messages 1-19
PIX|ASA Generating System Log Messages in EMBLEM Format 1-20
Disabling a System Log Message 1-21
Changing the Severity Level of a System Log Message 1-21
Changing the Amount of Internal Flash Memory Available for Logs 1-22
Understanding System Log Messages 1-23
System Log Message Format 1-23
Severity Levels 1-24
Variables Used in System Log Messages 1-24
CHAPTER 2 System Log Messages 2-1
Messages 101001 to 199009 2-1
101001 2-1
101002 2-2
101003, 101004 2-2
101005 2-2
102001 2-2
103001 2-3
103002 2-3
103003 2-3
103004 2-4
103005 2-4
104001, 104002 2-4
104003 2-5
104004 2-5
105001 2-5
105002 2-5
105003 2-6
105004 2-6
Cisco Security Appliance Logging Configuration and System Log Messages
iv OL-6721-02
Contents
105005 2-6
105006, 105007 2-7
105008 2-7
105009 2-7
105010 2-8
105011 2-8
105020 2-8
105021 2-8
105031 2-9
105032 2-9
105034 2-9
105035 2-9
105036 2-9
105037 2-10
105038 2-10
105039 2-10
105040 2-11
105042 2-11
105043 2-11
105044 2-11
105045 2-12
105046 2-12
105047 2-12
106001 2-13
106002 2-13
106006 2-13
106007 2-14
106010 2-14
106011 2-14
106012 2-14
106013 2-15
106014 2-15
106015 2-15
106016 2-15
106017 2-16
106018 2-16
106020 2-16
106021 2-17
106022 2-17
106023 2-18
Cisco Security Appliance Logging Configuration and System Log Messages
OL-6721-02 v
Contents
106024 2-18
106025, 106026 2-18
106027 2-19
106100 2-19
106101 2-20
107001 2-20
107002 2-20
108002 2-21
108003 2-21
109001 2-21
109002 2-21
109003 2-22
109005 2-22
109006 2-22
109007 2-22
109008 2-23
109010 2-23
109011 2-23
109012 2-23
109013 2-24
109014 2-24
109016 2-24
109017 2-24
109018 2-25
109019 2-25
109020 2-25
109021 2-25
109022 2-26
109023 2-26
109024 2-26
109025 2-26
109026 2-27
109027 2-27
109028 2-27
109029 2-28
109030 2-28
109031 2-28
109032 2-29
110001 2-29
111001 2-29
Cisco Security Appliance Logging Configuration and System Log Messages
vi OL-6721-02
Contents
111002 2-30
111003 2-30
111004 2-30
111005 2-30
111007 2-31
111008 2-31
111009 2-31
111111 2-31
112001 2-31
113001 2-32
113003 2-32
113004 2-32
113005 2-33
113006 2-33
113007 2-33
113008 2-33
113009 2-34
113010 2-34
113011 2-34
113012 2-34
113013 2-35
113014 2-35
113015 2-35
113016 2-35
113017 2-36
113018 2-36
113019 2-36
113020 2-37
114001 2-37
114002 2-38
114003 2-38
114004 2-39
114005 2-39
114006 2-39
114007 2-40
114008 2-41
114009 2-41
114010 2-42
114011 2-43
114012 2-44
Cisco Security Appliance Logging Configuration and System Log Messages
OL-6721-02 vii
Contents
114013 2-44
114014 2-45
114015 2-46
114016 2-46
114017 2-47
114018 2-48
114019 2-48
114020 2-49
199001 2-49
199002 2-50
199003 2-50
199005 2-50
199006 2-50
199907 2-51
199908 2-51
199909 2-51
Messages 201002 to 217001 2-51
201002 2-52
201003 2-52
201004 2-52
201005 2-53
201006 2-53
201008 2-53
201009 2-53
201010 2-54
201012 2-54
201013 2-55
202001 2-55
202005 2-55
202011 2-56
208005 2-56
209003 2-56
209004 2-57
209005 2-57
210001 2-57
210002 2-58
210003 2-58
210005 2-58
210006 2-58
210007 2-59
Cisco Security Appliance Logging Configuration and System Log Messages
viii OL-6721-02
Contents
210008 2-59
210010 2-59
210020 2-59
210021 2-60
210022 2-60
211001 2-60
211003 2-60
212001 2-61
212002 2-61
212003 2-62
212004 2-62
212005 2-62
212006 2-62
213001 2-63
213002 2-63
213003 2-63
213004 2-63
214001 2-64
215001 2-64
217001 2-64
216001 2-64
216002 2-65
216003 2-65
Messages 302003 to 326028 2-66
302003 2-66
302004 2-66
302009 2-67
302010 2-67
302012 2-67
302013 2-67
302014 2-68
302015 2-70
302016 2-70
302017 2-71
302018 2-71
302019 2-72
302020 2-72
302021 2-72
302302 2-73
303002 2-73
Cisco Security Appliance Logging Configuration and System Log Messages
OL-6721-02 ix
Contents
303003 2-73
303004 2-73
304001 2-74
304002 2-74
304003 2-74
304004 2-74
304005 2-75
304006 2-75
304007 2-75
304008 2-75
304009 2-76
305005 2-76
305006 2-76
305007 2-77
305008 2-77
305009 2-78
305010 2-78
305011 2-78
305012 2-78
308001 2-79
308002 2-79
311001 2-79
311002 2-79
311003 2-80
311004 2-80
312001 2-80
313001 2-80
313003 2-81
313004 2-81
314001 2-81
315004 2-81
315011 2-82
316001 2-83
317001 2-83
317002 2-84
317003 2-84
317004 2-84
317005 2-84
318001 2-84
318002 2-85
Cisco Security Appliance Logging Configuration and System Log Messages
x OL-6721-02