Filter
Top Products
76-25
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter 76 Configuring Logging
Monitoring the Logs
b. Enter a valid severity level in the Severity field. Alternatively, click the Edit icon on the right of the
Severity field. In the Severity dialog box, click the severity levels in the list on which you want to
filter. To include severity levels 1-7, click All. Click OK to display these settings in the Build Filter
dialog box. For additional information about the correct input format to use, click the Info icon on
the right of the Severity field.
c. Enter a valid syslog ID in the Syslog ID field. Alternatively, click the Edit icon on the right of the
Syslog ID field. In the Syslog ID dialog box, choose a condition on which to filter from the
drop-down list, then click Add. Click OK to display these settings in the Build Filter dialog box.
Click Delete to remove these settings and enter new ones. For additional information about the
correct input format to use, click the Info icon on the right of the Syslog ID field.
d. Enter a valid source IP address in the Source IP Address field, or click the Edit icon on the right of
the Source IP Address field. In the Source IP Address dialog box, choose a single IP address or a
specified range of IP addresses, then click Add. To exclude a specific IP address or range of IP
addresses, check the Do not include (exclude) this address or range check box. Click OK to
display these settings in the Build Filter dialog box. Click Delete to remove these settings and enter
new ones. For additional information about the correct input format to use, click the Info icon on
the right of the Source IP Address field.
e. Enter a valid source port in the Source Port field, or click the Edit icon on the right of the Source
Port field. In the Source Port dialog box, choose a condition on which to filter from the drop-down
list, then click Add. Click OK to display these settings in the Build Filter dialog box. Click Delete
to remove these settings and enter new ones. For additional information about the correct input
format to use, click the Info icon on the right of the Source Port field.
f. Enter a valid destination IP address in the Destination IP Address field, or click the Edit icon on the
right of the Destination IP Address field. In the Destination IP Address dialog box, choose a single
IP address or a specified range of IP addresses, then click Add. To exclude a specific IP address or
range of IP addresses, check the Do not include (exclude) this address or range check box. Click
OK to display these settings in the Build Filter dialog box. Click Delete to remove these settings
and enter new ones. For additional information about the correct input format to use, click the Info
icon on the right of the Destination IP Address field.
g. Enter a valid destination port in the Destination Port field, or click the Edit icon on the right of the
Destination Port field. In the Destination Port dialog box, choose a condition on which to filter from
the drop-down list, then click Add. Click OK to display these settings in the Build Filter dialog box.
Click Delete to remove these settings and enter new ones. For additional information about the
correct input format to use, click the Info icon on the right of the Destination Port field.
h. Enter filtering text for the Description field. The text may be any string of one or more characters,
including a regular expression. However, semicolons are not valid characters, and this setting is
case-sensitive. Multiple entries must be separated by commas.
i. Click OK to add the filter settings you have just specified to the Filter By drop-down list in the log
viewers. The filter strings follow a specific format. The prefix FILTER: designates all custom filters
that appear in the Filter By drop-down list. You may still type random text into this field.
The following table shows examples of the format used.
Build Filter Example Filter String Format
Source IP = 192.168.1.1 or 0.0.0.0
Source Port = 67
FILTER: srcIP=192.168.1.1,0.0.0.0;srcPort=67;
Severity = Informational
Destination IP = 1.1.1.1 through 1.1.1.10
FILTER: sev=6;dstIP=1.1.1.1-1.1.1.10;