מחשבים
ossim - setup asa logs
03/03/2014 13:23:39
מאת: luchy
This manual will help to setup the asa logs on an ossim server
1
- go to /etc/ossim/agent/plugins/
edit cisco-asa.cfg
add the next line
location=/var/log/cisco-asa.log
- go to /etc/rsyslog.d/cisco_asa.conf
and add the next lines :
if $fromhost-ip == '192.168.100.1' then /var/log/cisco-asa.log
if $fromhost-ip == '192.168.100.1' then
- restart the service
service rsyslog restart
- configure the log rotation on
/etc/logrotate.conf
- on alienvault menu go to
configure sensor
select data sources
select cisco-asa
apply changes
- ssh the asa firewall and on conf t set
no names
apply and save.