Parsed ASA Syslog Events
Parsed syslog events contain more event attributes than other syslog events and let you search on any specific parsed field. The SEC forwards all ASA events you specify to the Cisco cloud but only the syslog messages in the table below are parsed. All parsed Syslogs events are shown with their EvenTypes italicised to help you identify.
For detailed explanations of syslogs see, Cisco ASA Series Syslog Messages.
|
Syslog ID |
Syslog Category |
Purpose of syslog messge |
|---|---|---|
|
106015 |
Firewall |
Represents out of state TCP Deny |
|
106023 |
Firewall |
A real IP packet was denied by the ACL. This message appears even if you do not have the log option enabled for an ACL. |
|
106100 |
Access Lists/User Session |
Packet was permitted or denied by an ACL. |
|
113019 |
User Authentication |
Critical AnyConnect |
|
302013, 302015, 302017, 302020 |
User Session |
Connection start and end syslogs for TCP, UDP, GRE, and ICMP connection creation. |
|
302014, 302016, 302018, 302021 |
User Session |
Connection start and end syslogs for TCP, UDP, GRE, and ICMP connection creation. |
|
302020 - 302021 |
User Session |
ICMP session establishment and teardown. |
|
305006 |
User Session/NAT and PAT |
NAT connection failure |
|
305011-305014 |
User Session/NAT and PAT |
NAT Build/Teardown related |
|
313001, 313008 |
IP Stack |
Represents denied connections to the box. |
|
414004 |
System |
Critical AnyConnect |
|
609001 - 609002 |
Firewall |
A network state container was reserved/removed for host ip-address connected to a zone. |
|
710002,710004 710005 |
User Session |
To the box connections failures |
|
710003 |
User Session |
Represents denied connections to the box. |
|
746012, 746013 |
User Session |
Critical AnyConnect |