In a basic environment with a Cisco ASA firewall I am logging everything to a syslog-ng server. As there aren’t any reporting tools installed, I am using grep to filter the huge amount of syslog messages in order to get the information I want to know. In this blog post I list a few greps for getting the interesting data.

In my syslog server, every firewall logs into its own folder which is subdivided with folders for every year and month (see here). Inside this month-folder, a new file is created for every day. That is, when parsing through all days of a month, the “cat” command looks like  cat 2013/01/*  while it looks like  cat 2012/*/*  when parsing through the whole year.

Beside of “grep” for filtering the shown values, I am using also “grep -v” to exclude certain lines.

IPsec VPNs (RA and S2S)

The basic syslog message for VPNs is “713120: IKE Phase 2 has completed successfully.” That is, a list with all VPN-Client users that were logged in at a certain time is shown by the following grep. It also includes the names of the VPN groups:

Similar, a concrete username can be requested:

Example output:

Or, users based/filtered on a VPN group (connection profile), with a new line for every login:

Or, a list with all users that were logged in, but only a list of the VPN users (without each login time). This is done via “sort at the position of the name” and then “uniq entries for the position of the name”:

For site-to-site VPNs, all events without the “Username” are relevant (grep -v):

DHCPv4 Server IPv4 Address Granted

To show the MAC-IPv4 address bindings:

Sample output, which also shows the interface:

Sessions initiated from an IP Address

ASA events 302013 “Built {inbound|outbound} TCP connection”, 302015 “Built {inbound|outbound} UDP connection” and 302020 “Built {inbound|outbound} ICMP connection”. Usage of “grep -E” for a regular expression.

Of course, this works similarly for IPv6 addresses:

Configuration Commands

All configuration commands share at least the keyword “executed”:

Sample output:

Further Reading

• Cisco ASA Series Syslog Messages
• grep manual page