Vrftsjtryk

I have Cisco ASA and i have setup graylog logging server and i am seeing no logs coming on remote syslog so this is what i did..

Current config:

asa-fw1-010101-2-7/pri/act(config)# show run logging

logging enable

logging timestamp

logging buffer-size 16384

logging monitor debugging

logging buffered debugging

logging asdm errors

logging device-id hostname

logging host inside 10.30.0.91

If i run this command to see how many logs generated by ASA

asa-fw1-010101-2-7/pri/act(config)# show logging

Syslog logging: enabled

    Facility: 20

    Timestamp logging: enabled

    Hide Username logging: enabled

    Standby logging: disabled

    Debug-trace logging: disabled

    Console logging: disabled

    Monitor logging: level debugging, 467629 messages logged

    Buffer logging: level debugging, 3108298794 messages logged

    Trap logging: disabled

    Permit-hostdown logging: disabled

    History logging: disabled

    Device ID: hostname "asa-fw1-010101-2-7"

    Mail logging: disabled

    ASDM logging: level errors, 298891 messages logged

If you noticed in following two line from above output, this number growing faster, look like thousands of logs getting logs..

Monitor logging: level debugging, 467629 messages logged

Buffer logging: level debugging, 3108298794 messages logged

Is it safe to that ASA generating that many logs.. look like every single packet getting log in buffer..

I have set logging buffered debugging because before it was informational

If i set logging trap debugging in its flooding syslog mesg and i am seeing 192k/s logs coming on my graylog server...

What is the best practice on ASA for logging? my conn count is following..

20776 in use, 248156 most used

The "debugging" level is way too detailed for most uses. As you can see, it generates a lot of messages; most are not helpful. Also, it puts a heavy load on the ASA.
You can try

logging trap info

or

logging trap warning

to see which one gives you the information you need.

Trap logging: disabled

That's the first problem. "trap" is the mechanism that sends to syslog hosts. logging trap informational will start messages flowing, but on an active firewall, there will a lot of messages. You can cut down the spew by increasing the logging level (info, warn, error, crit, etc.), or better, turn off the messages you don't want to see:
no logging message 715036 (disables: %PIX-7-715036 messages)

- or -
logging message 715036 level 5 (moves id 715036 to 5 (notif)) (yes, at 7 (debug), it wouldn't be logged at 6 (info) anyway, but you get the idea.)

My suggestion would be to try to partition the problem between:

• ASA not sending


• Packets not getting there


• Graylog not listening

My usual method is to aim the device's syslog at some laptop, without running any kind of logging software, just tcpdump on the appropriate ports. That will tell you if the devices is sending. Then send some syslog manually to the target loghost, see if they arrive. That should partition the problem and you'll know where the problem lies.