Cisco Cisco ASA 5520 Adaptive Security Appliance Fehlerbehebungsanleitung
The number of destinations possible is a real advantage. If chosen carefully, and as illustrated here, they can
be broadly classified into two main categories based on the purpose they serve:
be broadly classified into two main categories based on the purpose they serve:
Archival
•
Real−time Debugging/Troubleshooting
•
In most networks, it is sufficient to have just the archival destinations enabled unless one or more of the
debugging destinations are necessary. At the same time, and quite often, problems result from enabling
multiple syslog destinations simultaneously at high logging levels such as informational (Level 6) or above.
debugging destinations are necessary. At the same time, and quite often, problems result from enabling
multiple syslog destinations simultaneously at high logging levels such as informational (Level 6) or above.
Troubleshooting Methodology
Whenever issues occur where there is a loss of syslog information at one or more destinations, there are two
things that you should check:
things that you should check:
Review the syslogging configuration (output of show run logging).
•
Look at the output of show logging queue.
•
Data Analysis
Review the Syslogging Configuration
Complete these steps:
Make sure that the syslog message you are looking for is not disabled by the no logging message
<ID> command.
<ID> command.
1.
Once confirmed, look at the number of syslog destinations enabled and the level at which each log is
sent to each. This is an example of such a configuration:
sent to each. This is an example of such a configuration:
logging enable
logging timestamp
logging standby
logging console informational
logging buffered informational
logging trap informational
logging asdm informational
logging device−id hostname
logging host inside 172.16.110.32
2.
In this example, the ASA is sending syslogs to 4 different destinations at the informational level (Level 6).