[c-nsp] ASA is not sending syslog

[Farooq Razzaque]

Hi Ryan
 
Thanks for the reply. 
 
Have u faced the issue with ASA syslog ? If so, what issue you faced.  Did it fix by reboot

Can you elaborate the following
 
Sniff it and look for the counters to increment. 


 


 


> From: rwest at zyedge.com
> To: farooq_mcp at hotmail.com; cisco-nsp at puck.nether.net
> Subject: RE: [c-nsp] ASA is not sending syslog
> Date: Tue, 25 Dec 2012 19:35:39 +0000
> 
> On Tue, Dec 25, 2012 at 13:51:24, Farooq Razzaque wrote:
> > Subject: [c-nsp] ASA is not sending syslog
> > 
> > 
> > 
> > 
> > 
> > 
> > Hi All,
> > 
> > I have ASA 5510 running on version 8.0(5)27.
> > 
> > 
> > The ASA is not sending logs to syslog server 2. Previously it was 
> > sending logs to syslog server 2 (2.x.x.2). I changed the order in the 
> > config i.e i put the config of syslog server 3(3.x.x.3) at second 
> > number and then put the config of syslog server 2 (2.x.x.2) at third 
> > number after that ASA is not sending logs to syslog server 3 (3.x.x.3) 
> > which is at second number and syslog server 2 which is at third number
> > 
> > I also remove the config of syslog (logging host mgmt 2.x.x.2 ---> 
> > Syslog server 2) which was at third number. But still ASA is not 
> > seding logs to syslog at second number
> > 
> > How can we check that ASA is sending syslogs out .
> > 
> 
> Sniff it and look for the counters to increment. 
> 
> > 
> > logging enable
> > logging list VPN_Monitor level informational class abc logging list 
> > VPN_Monitor level informational class abcfo logging buffered 
> > informational logging trap informational logging asdm informational 
> > logging host mgmt
> > 1.x.x.1 ---> Syslog server 1 logging host mgmt 2.x.x.2 ---> Syslog 
> > server 2 logging host inside 3.x.x.3 ---> Syslog server 3 logging 
> > permit-hostdown logging class abc history informational logging class 
> > abcfo history informational #
> > 
> 
> Others may have different experiences, but I've found that a reboot is the only fix sometimes. Removing all logging and adding it will not fix it when a configuration change is made. The logging feature is a little flaky.
> 
> -ryan