Syslog Message Pattern for a Cisco ASA

kevsch

I'm trying to create a rule to detect changes on my ASA. I thought I had it nailed down by using

*executed*

for the pattern, but I'm getting change reports when no changes have been made. They usually detect

<--- More --->

as a change to the config. Has anyone else seen this? If so, how did you get around it?

Find more posts tagged with

asa_change_detection

Accepted answers

All comments

tplier

I'm trying to do the same thing. Have you had any luck figuring it out yet?

Thanks!

kevsch

Yes, more or less. In the Orion configuration manager on the server, edit the ASA node and change the "Template" from Auto Determine to Cisco ASA version 7. I'm running 8.x but this seems to work fine.

Next, in the syslog viewer, create a new task for the ASA change detection. In the Message tab, change the Syslog Message Pattern to *executed* and in the Trigger Threshold tab, I defined a trigger to supress the alert until at least 2 syslog messages matching this rule are received in 1 hour and suspend further alert actions for 1 minute. I'm still playing with these settings, but so far these are working for me.

Finally I had to create another rule to discard syslog messages because my database was growing by about 4 GB a day with all the ASA entries. There might be a way in the ASA to limit what it sends but I haven't figured that out yet.