The alerts need to be from ossec, not the cisco device directly. You can run 
the asa logs through logtest to get this format.


-----Original Message-----
From: Kai
Sent:  01/26/2011 5:20:45 AM
Subject:  [ossec-list] Generating Cisco ASA Reports

Hello,

i'm trying to create a report based on a asa logfile which has the
following format (ip,port replaced):

Jan 19 09:23:47 123.456.789.012 %ASA-1-123456: TCP access denied by
ACL from 999.123.456.123/3240 to outside:123.142.432.23/65

This is what i get:
cat /tmp/log | /tmp/ossec-hids-2.5.1/src/monitord/ossec-reportd -n
"Daily Log Test"
2011/01/26 11:11:51 ossec-reportd: INFO: Started (pid: 52310).
2011/01/26 11:11:58 ossec-reportd: INFO: Report 'Daily Log Test'
completed and zero alerts post-filter.

The logfile is really big, and i don't believe that there are no
alerts at all.

regards,
Kai

Reply via email to