Filter
Top Products
CHAPTER
17-1
Cisco ASDM User Guide
OL-16647-01
17
Configuring Logging
The logging feature lets you enable logging and specify how log information is handled. The Log
viewing feature lets you view syslog messages in real-time. For a description of the log viewing feature,
see Chapter 45, “Monitoring Logging.”
About Logging
The security appliance supports the generation of an audit trail of syslog messages that describes its
activities (for example, what types of network traffic has been allowed and denied) and enables you to
configure system logging.
All syslog messages have a default severity level. You can reassign a message to a new severity level, if
necessary. When you choose a severity level, logging messages from that level and lower levels are
generated. Messages from a higher level are not included. The higher the severity level, the more
messages are included. For more information about logging and syslog messages, see the Cisco Security
Appliance Logging Configuration and System Log Messages.
Security Contexts in Logging
Each security context includes its own logging configuration and generates its own messages. If you log
in to the system or admin context, and then change to another context, messages that you view in your
session are only those that are related to the current context.
Syslog messages that are generated in the system execution space, including failover messages, are
viewed in the admin context along with messages generated in the admin context. You cannot configure
logging or view any logging information in the system execution space.
You can configure the security appliance to include the context name with each message, which helps
you differentiate context messages that are sent to a single syslog server. This feature also helps you to
determine which messages are from the admin context and which are from the system; messages that
originate in the system execution space use a device ID of system, and messages that originate in the
admin context use the name of the admin context as the device ID. To use the device ID, see Advanced
Syslog Configuration, page 17-6.