Forum Discussion
ioncannon23_529
Nimbostratus
NimbostratusFirepass 4300 Logging
Hello all, my group at work has the honor of gathering security device logs from all devices for ArcSight to parse and normalize. Our organization has Firepass 4300's and unfortunately we do not have access to the devices to look at their logging setup. They are sending us the logs via syslog but we are receiving very little data. It's almost like they have turned on the lowest level of logging available. Can anyone explain how the firepass logging is configured so we can recommend a logging setting to the device group? Also, does anyone have a good Firepass FlexConnector for Arcsight in their organization that they wouldn't mind sharing? Thanks for any help.
-kevin
Mike_61719Cirrus
Each logging addition adds load onto the Firepass, this is not a regular server. I would recommend turning on app logging if you want application logs. Basically FTP the app logs off once it reaches a certain size or date.
ioncannon23_529Mike, thanks for the message. Right now we are receiving syslog from the firepass directly and it seems to be working fine save for the fact Arcsight cannot properly parse the logs. So what exactly will the application level logging show?
-kevin- Mike_61719Links clicked on by the user, you will have to log the data differently. Syslog is not meant to capture user or admin data.