On Fri, Feb 13, 2015 at 10:43 AM, Network Infrastructure <[email protected]> wrote: > I don't see anything but I think I config my ASA working properly.
Did you verify that there were log messages created while running tcpdump? Maybe try running the tcpdump command on the manager and login to the ASA. > Sir, can you show me how to config my ASA to send syslog to Ossec manager > and also show me how to configure access list (ACL) > Any configuration help I give you would be gathered from google. There was already some help provided earlier in the thread. I don't think I have anything further to add. > On Friday, February 6, 2015 at 9:11:33 AM UTC+7, Network Infrastructure > wrote: >> >> I have configured OSSEC to monitor my ASA 5520 but I cannot see anything >> >> In ASA 5520, I enable syslog server to send syslog to my OSSEC >> >> >> In OSSEC, the /var/ossec/etc/ossec.conf, I configed: >> >> <ossec_config> >> >> <remote> >> <connection>syslog</connection> >> <allowed-ips>IP_OF_CISCO_DEVICE</allowed-ips> >> </remote> >> <global> >> <logall>yes</logall> >> </global> >> >> </ossec_config> >> >> Then I restart ossec services but I cannot see anything. >> >> >> Help me please ... > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
