Considering someone can make configuration changes via ASDM, SSH, etc. and the syslog messages logged differ, I assume everyone uses a couple of different triggers to capture "all ASA changes". I'm curious what everyone is using.
SSH/Telnet/Console:
I am triggering on "111005", which contains "end configuration: ok", as this is logged when you are connected via SSH (or telnet, console) and someone exits config mode. However, this doesn't capture changes made via ASDM.
ASDM:
I am triggering on "111001", which contains "console writing to memory", as this is logged when you WRITE MEM in ASDM. However, that doesn't capture changes made via ASDM but are only applied to the running configuration. I've considered triggering on "111008", which contains "executed '(whatever)' command" - but I'm thinking triggering on "111007", which contains "Begin configuration: <ip> reading from http [POST]" would be a better idea.
What does everyone else use?
