Cisco PIX 500 Series Configuration Manual page 952

Configuring and Managing Logs
You customize these criteria by creating a message list that you can specify when you set the output
destination in the
configure the adaptive security appliance to send a particular message class to each type of output
destination independently of the message list.
For example, you could configure the security appliance to send to the internal log buffer all system log
messages with severity levels of 1, 2 and 3, send all system log messages in the "ha" class to a particular
syslog server, or create a list of messages that you name "high-priority" that are sent to an e-mail address
to notify system administrators of a possible problem.
Filtering System Log Messages by Class
The system log message class provides a method of categorizing system log messages by type,
equivalent to a feature or function of the adaptive security appliance. For example, the "vpnc" class
denotes the VPN client.
This section includes the following topics:
•
•
Message Class Overview
With logging classes, you can specify an output location for an entire category of system log messages
with a single command.
You can use system log message classes in two ways:
•
•
All system log messages in a particular class share the same initial three digits in their system log
message ID numbers. For example, all system log message IDs that begin with the digits 611 are
associated with the vpnc (VPN client) class. System log messages associated with the VPN client feature
range from 611101 to 611323.
Sending All Messages in a Class to a Specified Output Destination
When you configure all messages in a class to go to a type of output destination, this configuration
overrides the configuration in the specific output destination command. For example, if you specify that
messages at level 7 should go to the log buffer, and you also specify that ha class messages at level 3
should go to the buffer, then the latter configuration takes precedence.
To configure the adaptive security appliance to send an entire system log message class to a configured
output destination, enter the following command:
hostname(config)# logging class
monitor | trap} [
Where the message_class argument specifies a class of system log messages to be sent to the specified
output destination. See
Cisco Security Appliance Command Line Configuration Guide
42-16
"Configuring Log Output Destinations" section on page
Message Class Overview, page 42-16
Sending All Messages in a Class to a Specified Output Destination, page 42-16
Issue the logging class command to specify an output location for an entire category of system log
messages.
Create a message list using the logging list command that specifies the message class. See the
"Filtering System Log Messages with Custom Message Lists" section on page 42-18
method.
severity_level
Table 42-2
message_class
{buffered | console | history | mail |
]
for a list of system log message classes.
Chapter 42 Monitoring the Security Appliance
42-7. Alternatively, you can
for this
OL-12172-03