You can configure the ASA to send messages to IPv4 or IPv6 syslog servers.

logging host interface_name syslog_ip [tcp[/port] | udp [/port] [format emblem]]

The format emblem keyword enables EMBLEM format logging for the syslog server with UDP only. The interface_name argument specifies the interface through which you access the syslog server. The syslog_ip argument specifies the IP address of the syslog server. The tcp[/port] or udp[/port] keyword-argument pair specify that the ASA should use TCP or UDP to send syslog messages to the syslog server.

You can configure the ASA to send data to a syslog server using either UDP or TCP, but not both. The default protocol is UDP if you do not specify a protocol.

If you specify UDP, the ASA continues to allow new connections whether or not the syslog server is operational. Valid port values for either protocol are 1025 through 65535. The default UDP port is 514. The default TCP port is 1470.

logging trap {severity_level | message_list}

You can specify the severity level number (1 through 7) or name. For example, if you set the severity level to 3, then the ASA sends syslog messages for severity levels 3, 2, and 1. You can specify a custom message list that identifies the syslog messages to send to the syslog server.

logging permit-hostdown

When the ASA is configured to send syslog messages to a TCP-based syslog server, and if either the syslog server is down or the log queue is full, then new connections to ASA are blocked. New connections are allowed again after the syslog server is back up and the log queue is no longer full. Using this command, you can permit new connections even if the syslog server is not operational.

logging facility number

logging buffered {severity_level | message_list}

New messages are appended to the end of the list. When the buffer is full, that is, when the buffer wraps, old messages are overwritten as new messages are generated, unless you configure the ASA to save the full buffer to another location. To empty the internal log buffer, enter the clear logging buffer command.

logging buffer-size bytes

• Save new messages to the internal log buffer and save the full log buffer content to the internal flash memory.

  logging flash-bufferwrap

  Example:

  
  ciscoasa(config)# logging flash-bufferwrap
  
  

  Note	If the buffer-size is over 2 MB, this command will stop writing data in flash, without any warning.

• Save new messages to the internal log buffer and save the full log buffer content to an FTP server.

  logging ftp-bufferwrap

  Example:

  
  ciscoasa(config)# logging ftp-bufferwrap
  
  

  When saving the buffer content to another location, the ASA create log files with names that use the following time-stamp format:

  
  LOG-YYYY-MM-DD-HHMMSS.TXT
  
  

  where YYYY is the year, MM is the month, DD is the day of the month, and HHMMSS is the time in hours, minutes, and seconds.

• Identify the FTP server on which you want to store log buffer content.

  logging ftp-server server pathusername password

  Example:

  
  ciscoasa(config)# logging ftp-server 10.1.1.1 /syslogs logsupervisor 1luvMy10gs
  
  

  The server argument specifies the IP address of the external FTP server. The path argument specifies the directory path on the FTP server where the log buffer data is to be saved. This path is relative to the FTP root directory. The username argument specifies a username that is valid for logging into the FTP server. The password argument indicates the password for the username specified.

• Save the current log buffer content to the internal flash memory.

  logging savelog [savefile]

  Example:

  
  ciscoasa(config)# logging savelog latest-logfile.txt
  
  

logging mail {severity_level | message_list}

When sent by e-mail, a syslog message appears in the subject line of the e-mail message. For this reason, we recommend configuring this option to notify administrators of syslog messages with high severity levels, such as critical, alert, and emergency.

logging from-address email_address

logging recipient-address e-mail_address[severity_level]

smtp-server [primary-interface] primary-smpt-server-ip-address [[backup-interface ]backup-smpt-server-ip-address]

logging asdm {severity_level | message_list}

The ASA sets aside a buffer area for syslog messages waiting to be sent to ASDM and saves messages in the buffer as they occur. The ASDM log buffer is a different buffer than the internal log buffer. When the ASDM log buffer is full, the ASA deletes the oldest syslog message to make room in the buffer for new ones. Deletion of the oldest syslog message to make room for new ones is the default setting in ASDM. To control the number of syslog messages retained in the ASDM log buffer, you can change the size of the buffer.

logging asdm-buffer-size num_of_msgs

Enter the clear logging asdm command to empty the current content of the ASDM log buffer.

logging console { severity_level | message_list}

If you set global rate limiting using the logging rate-limit command, that command takes precendence over the rate-limit keyword in this command.

logging monitor {severity_level | message_list}

terminal monitor

If you log out and then log in again, you need to reenter this command. Enter the terminal no monitor command to disable logging to the current session.