ASA5520 - Syslog user login attempts

Pash

Good Evening,

I have found and read the ASA 7.2 command refence logging commands here:-

Cisco Security Appliance Command Reference, Version 7.2 - logging asdm through logout message Commands [Cisco ASA 5500 Series Adaptive Security Appliances] - Cisco Systems

Does anyone know a way of syslogging user logging attempts, whether by console/terminal login?

These are the commands I am running on my ASA thus far:-

logging enable
logging timestamp
logging standby
logging monitor warnings
logging buffered warnings
logging trap debugging
logging asdm informational
logging facility xx
logging host xxxxxx xxx.xxx.xxx.xxx
logging host xxxxxx xxx.xxx.xxx.xxx

Please let me know if anyone has set this up before or if it is even possible because my searches have not returned any results yet.

Cheers,

Pash

Ahriakin

I have a link to the complete Cisco syslog message list for the ASA/PIX at work, I'll post it up tomorrow. It shouldn't be hard to isolate the authentication messages and set them to a higher (well lower, you know what I mean) syslog level so they can stand out.
If you want a live feed you can also create a filtered view from the ASDM for the correct message types.

Edit found it.
http://www.cisco.com/en/US/docs/security/asa/asa72/system/message/logmsgs.html

There are a few different messages based on the authentication method so have a search through and take note of the numbers you think you'll need, then use 'logging message xxxxxx level yyyyyy' to raise it above the informational level noise, or filter your Syslog viewer for them (I highly recommend Splunk).