Cisco 6500 - Catalyst Series 10 Gigabit EN Interface Module Expansion, Configuration Manual, Page: 571 / 742

25-5
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
Chapter 25 Monitoring the Firewall Services Module
Configuring and Managing Syslog Messages
Note To start logging to a syslog server you define in this procedure, be sure to enable logging for all output
locations. See the
“Enabling Logging to All Configured Output Destinations” section on page 25-2 . To
disable logging, see the “Disabling Logging to All Configured Output Destinations” section on
page 25-3 .
To configure the FWSM to send syslog messages to a syslog server, perform the following steps:
Step 1
To designate a syslog server to receive the syslog messages, enter the following command:
hostname(config)# logging host interface_name ip_address [ tcp [ / port ] | udp [ /port ]]
[ format emblem ]
Where the format emblem keyword enables EMBLEM format logging for the syslog server (UDP only).
The interface_name argument specifies the interface through which you access the syslog server.
The ip_address argument specifies the IP address of the syslog server.
The tcp [ / port ] or udp [ / port ] argument specifies that the FWSM should use TCP or UDP to send syslog
messages to the syslog server. The default protocol is UDP. You can configure the FWSM to send data
to a syslog server using either UDP or TCP, but not both. If you specify TCP, the FWSM discovers when
the syslog server fails and discontinues sending syslog messages. If you specify UDP, the FWSM
continues to send syslog messages regardless of whether the syslog server is operational. The
port
argument specifies the port that the syslog server listens to for syslog messages. Valid port values are
1025 through 65535, for either protocol. The default UDP port is 514. The default TCP port is 1470.
For example:
hostname(config)#
logging host dmz1 192.168.1.5
If you want to designate more than one syslog server as an output destination, enter a new command for
each syslog server.
Step 2
To specify which syslog messages should be sent to the syslog server, enter the following command:
hostname(config)#
logging trap
{ severity_level | message_list }
Where the severity_level argument specifies the severity levels of messages to be sent to the syslog
server. You can specify the severity level number (0 through 7) or name. For severity level names, see
the
“Severity Levels” section on page 25-20 . For example, if you set the severity level to 3, then the
FWSM sends syslog messages for severity levels 3, 2, 1, and 0.
The message_list argument specifies a customized message list that identifies the syslog messages to
send to the syslog server. For information about creating custom message lists, see the “Filtering Syslog
Messages with Custom Message Lists” section on page 25-14 .
The following example specifies that the FWSM should send to the syslog server all syslog messages
with a severity level of 3 (errors) and higher. The FWSM will send messages with the severity level of
3, 2, and 1.
hostname(config)# logging trap errors
Step 3
(Optional) If needed, set the logging facility to a value other than its default of 20 by entering the
following command:
hostname(config)#
logging facility
number
Most UNIX systems expect the syslog messages to arrive at facility 20.
hostname(config)# logging