[c-nsp] ASA is not sending syslog

[Ryan West]

On Tue, Dec 25, 2012 at 13:51:24, Farooq Razzaque wrote:
> Subject: [c-nsp] ASA is not sending syslog
> 
> 
> 
> 
> 
> 
> Hi All,
> 
> I have ASA 5510 running on version 8.0(5)27.
> 
> 
> The ASA is not sending logs to syslog server 2. Previously it was 
> sending logs to syslog server 2 (2.x.x.2). I changed the order in the 
> config i.e i put the config of syslog server 3(3.x.x.3) at second 
> number and then put the config of syslog server 2 (2.x.x.2) at third 
> number after that ASA is not sending logs to syslog server 3 (3.x.x.3) 
> which is at second number and syslog server 2 which is at third number
> 
> I also remove the config of syslog (logging host mgmt 2.x.x.2  ---> 
> Syslog server 2) which was at third number. But still ASA is not 
> seding logs to syslog at second number
> 
> How can we check that ASA is sending syslogs out .
> 

Sniff it and look for the counters to increment. 

> 
> logging enable
> logging list VPN_Monitor level informational class abc logging list 
> VPN_Monitor level informational class abcfo logging buffered 
> informational logging trap informational logging asdm informational 
> logging host mgmt
> 1.x.x.1 ---> Syslog server 1 logging host mgmt 2.x.x.2  ---> Syslog 
> server 2 logging host inside 3.x.x.3  ---> Syslog server 3 logging 
> permit-hostdown logging class abc history informational logging class 
> abcfo history informational #
> 

Others may have different experiences, but I've found that a reboot is the only fix sometimes.  Removing all logging and adding it will not fix it when a configuration change is made.  The logging feature is a little flaky.

-ryan