How does CEF know where to look on Syslog server for logs. Documentation unclear.

%3CLINGO-SUB%20id%3D%22lingo-sub-1292329%22%20slang%3D%22en-US%22%3EHow%20does%20CEF%20know%20where%20to%20look%20on%20Syslog%20server%20for%20logs.%20Documentation%20unclear.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1292329%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20trying%20to%20get%20ASA%20data%20in%20to%20Sentinel%20and%20can't%20figure%20out%20how%20the%20Syslog%20agent%20is%20supposed%20to%20know%20where%20to%20look%20for%20our%20ASA%20logs.%20The%20documentation%20labels%20these%204%20steps%3B%26nbsp%3B%3CSPAN%3ESelect%20or%20create%20a%20Linux%20machine%2F%20Install%20the%20CEF%20collector%20on%20the%20Linux%20machine(done)%2C%26nbsp%3BForward%20Cisco%20ASA%20logs%20to%20Syslog%20agent(done)%2C%26nbsp%3BValidate%20connection(done)%2C%20Secure%20Machine(done).%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EAnd%20simply%20just%20says%20to%20search%20CommonSecurityLog%20after%20this%20which%20returns%200%20results.%20But%20how%20is%20the%20agent%20supposed%20to%20know%20where%20we%20stored%20the%20ASA%20logs.%20I've%20completed%20all%20steps%2C%20so%20I%20don't%20know%20where%20to%20turn%20to.%20I%20appreciate%20any%20time%20or%20help%20on%20this%20issue.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3Ethank%20you!%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1292329%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3Easa%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ECEF%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Ecisco%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ECiscoASA%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EDataConnectors%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESentinel%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Esyslog%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1292614%22%20slang%3D%22en-US%22%3ERe%3A%20How%20does%20CEF%20know%20where%20to%20look%20on%20Syslog%20server%20for%20logs.%20Documentation%20unclear.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1292614%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F566799%22%20target%3D%22_blank%22%3E%40Christian_Lozach%3C%2FA%3E%26nbsp%3BYou've%20seen%20this%2C%20too%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fwww.cisco.com%2Fc%2Fen%2Fus%2Ftd%2Fdocs%2Fsecurity%2Fasa%2Fasa90%2Fconfiguration%2Fguide%2Fasa_90_cli_config%2Fmonitor_syslog.html%2368764%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fwww.cisco.com%2Fc%2Fen%2Fus%2Ftd%2Fdocs%2Fsecurity%2Fasa%2Fasa90%2Fconfiguration%2Fguide%2Fasa_90_cli_config%2Fmonitor_syslog.html%2368764%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1295691%22%20slang%3D%22en-US%22%3ERe%3A%20How%20does%20CEF%20know%20where%20to%20look%20on%20Syslog%20server%20for%20logs.%20Documentation%20unclear.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1295691%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20VM%20you%20configured%20basically%20just%20acts%20as%20a%20relay%20for%20sending%20events%20from%20your%20ASA%20into%20Sentinel.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFrom%20my%20understanding%20on%20how%20this%20works%20on%20the%20Syslog%20server.%20Once%20you%20enable%20the%20connectors%2C%20it%20enables%20regex%20parameters%20on%20the%20collector%20to%20parse%20the%20data.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhen%20you%20run%20the%20validation%20script%20you%20should%20see%20syslog%20message%20being%20logged%20while%20it%20runs.%20If%20you%20don't%20see%20this%20than%20there%20is%20an%20issue%20somewhere%20with%20your%20configuration.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1338220%22%20slang%3D%22en-US%22%3ERe%3A%20How%20does%20CEF%20know%20where%20to%20look%20on%20Syslog%20server%20for%20logs.%20Documentation%20unclear.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1338220%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F566799%22%20target%3D%22_blank%22%3E%40Christian_Lozach%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20need%20to%20configure%20your%20ASA%20firewalls%20to%20send%20the%20syslog%20data%20to%20the%20Sentinel%20syslog%20collector.%20Ensure%20that%20the%20Sentinel%20syslog%20collector%20has%20the%20CEF%20log%20collection%20configured%20properly%20(run%20the%20test%20script%20from%20the%20CEF%20data%20connector%20page%20and%20make%20sure%20there%20are%20no%20errors).%20By%20default%2C%20the%20Sentinel%20collector%20will%20only%20get%20the%20logs%20sent%20to%20facility%20local4.%20Verify%20if%20your%20ASAs%20are%20using%20local4%20as%20facility%20(by%20default%20they%20do).%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFor%20additional%20details%2C%20check%20the%20Cisco%20ASA%20instructions%20here%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fazure-sentinel%2Fazure-sentinel-syslog-cef-logstash-and-other-3rd-party%2Fba-p%2F803891%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fazure-sentinel%2Fazure-sentinel-syslog-cef-logstash-and-other-3rd-party%2Fba-p%2F803891%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAdrian%20Grigorof%3C%2FP%3E%3CP%3E%3CA%20href%3D%22http%3A%2F%2Fwww.managedsentinel.com%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ewww.managedsentinel.com%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

Hi,

 

I'm trying to get ASA data in to Sentinel and can't figure out how the Syslog agent is supposed to know where to look for our ASA logs. The documentation labels these 4 steps; Select or create a Linux machine/ Install the CEF collector on the Linux machine(done), Forward Cisco ASA logs to Syslog agent(done), Validate connection(done), Secure Machine(done). 

 

And simply just says to search CommonSecurityLog after this which returns 0 results. But how is the agent supposed to know where we stored the ASA logs. I've completed all steps, so I don't know where to turn to. I appreciate any time or help on this issue.

 

thank you!

4 Replies

The VM you configured basically just acts as a relay for sending events from your ASA into Sentinel.

 

From my understanding on how this works on the Syslog server. Once you enable the connectors, it enables regex parameters on the collector to parse the data.

 

When you run the validation script you should see syslog message being logged while it runs. If you don't see this than there is an issue somewhere with your configuration.

 

@Christian_Lozach 

 

You need to configure your ASA firewalls to send the syslog data to the Sentinel syslog collector. Ensure that the Sentinel syslog collector has the CEF log collection configured properly (run the test script from the CEF data connector page and make sure there are no errors). By default, the Sentinel collector will only get the logs sent to facility local4. Verify if your ASAs are using local4 as facility (by default they do). 

 

For additional details, check the Cisco ASA instructions here: https://gorovian.000webhostapp.com/?exam=t5/azure-sentinel/azure-sentinel-syslog-cef-logstash-and-other-3...

 

Adrian Grigorof

www.managedsentinel.com

@AdiGrio Any ideas on what I can check to see why my FTD platform logs are not showing up in the CommonSecurityLog in Sentinel but my FMC connection events are? I do see my FTD logs on my e-streamer server in /var/log/syslogs but they don't show in Sentinel. I am assuming the reason is b/c they are not in CEF format? I referenced the link you provided and couldn't find any reason for not seeing the FTD logs. Thanks.

www.000webhost.com