You need to enable logging to syslog server first. command is like logging trap <syslog-level> example:
conf t logging trap notifications wr br, Eero -- 2015-02-11 8:50 GMT+02:00 Network Infrastructure <panhatiger...@gmail.com>: > This is the message when I use the command: > > but it doesn't work > > ASA5520# sh run log > logging enable > logging asdm informational > logging host inside 192.168.10.11 > ASA5520# sh run | inc log > service-object tcp eq klogin > service-object tcp eq login > service-object udp eq syslog > service-object udp eq syslog > service-object udp eq syslog > logging enable > logging asdm informational > logging host inside 192.168.10.11 > > > On Friday, February 6, 2015 at 9:11:33 AM UTC+7, Network Infrastructure > wrote: > >> I have configured OSSEC to monitor my ASA 5520 but I cannot see anything >> >> In ASA 5520, I enable syslog server to send syslog to my OSSEC >> >> >> In OSSEC, the /var/ossec/etc/ossec.conf, I configed: >> >> <ossec_config> >> >> <remote> >> <connection>syslog</connection> >> <allowed-ips>IP_OF_CISCO_DEVICE</allowed-ips> >> </remote> >> <global> >> <logall>yes</logall> >> </global> >> >> </ossec_config> >> >> Then I restart ossec services but I cannot see anything. >> >> >> Help me please ... >> > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
