Cisco ASA 系統日誌格式說明

在哪裡可以找到 Cisco ASA 系統日誌格式說明？日誌範例：

Dec 11 08:01:24 <IP> %ASA-6-302015: Built outbound UDP connection 447235 for outside:NTP_Server_2/<port> (NTP_Server_2/<port>) to identity:<IP>/<port> (<IP>/<port>)
Dec 11 08:01:24 <IP> %ASA-6-302015: Built outbound UDP connection 447235 for outside:NTP_Server_2/<port> (NTP_Server_2/<port>) to identity:<IP>/<port> (<IP>/<port>)
Dec 11 08:01:24 <IP> %ASA-4-106023: Deny udp src dmz:OCSP_Server/<port> dst outside:DNS_Server_DO/<port> by access-group "dmz" [0x123a465e, 0x4c7bf613]
Dec 11 08:01:24 <IP> %ASA-4-106023: Deny udp src dmz:OCSP_Server/<port> dst outside:DNS_Server_DO/<port> by access-group "dmz" [0x123a465e, 0x4c7bf613]
Dec 11 08:01:31 <IP> %ASA-6-302013: Built outbound TCP connection 447236 for outside:KAV_Update_Server/<port> (KAV_Update_Server/<port>) to dmz:OCSP_Server/<port> (OCSP_Server/<port>)
Dec 11 08:01:31 <IP> %ASA-6-302013: Built outbound TCP connection 447236 for outside:KAV_Update_Server/<port> (KAV_Update_Server/<port>) to dmz:OCSP_Server/<port> (OCSP_Server/<port>)
Dec 11 08:01:31 <IP> %ASA-6-302014: Teardown TCP connection 447236 for outside:KAV_Update_Server/<port> to dmz:OCSP_Server/<port> duration 0:00:00 bytes 14804 TCP FINs
Dec 11 08:01:38 <IP> %ASA-6-302014: Teardown TCP connection 447234 for outside:KAV_Update_Server/<port> to dmz:TSP_Server/<port> duration 0:01:08 bytes 134781 TCP FINs
Dec 11 08:01:38 <IP> %ASA-6-302014: Teardown TCP connection 447234 for outside:KAV_Update_Server/<port> to dmz:TSP_Server/<port> duration 0:01:08 bytes 134781 TCP FINs
Dec 11 08:01:38 <IP> %ASA-6-106015: Deny TCP (no connection) from KAV_Update_Server/<port> to TSP_Server/<port> flags RST  on interface outside
Dec 11 08:01:38 <IP> %ASA-6-106015: Deny TCP (no connection) from KAV_Update_Server/<port> to TSP_Server/<port> flags RST  on interface outside
Dec 11 08:01:39 <IP> %ASA-4-106023: Deny udp src dmz:TSP_Server/<port> dst outside:DNS_Server_DO/<port> by access-group "dmz" [0x123a465e, 0x8c20f21]
Dec 11 08:01:53  %ASA-4-106023: last message repeated 9 times
Dec 11 08:01:53 <IP> %ASA-6-302013: Built outbound TCP connection 447237 for outside:KAV_Update_Server/<port> (KAV_Update_Server/<port>) to dmz:TSP_Server/<port> (TSP_Server/<port>)
Dec 11 08:01:53 <IP> %ASA-6-302013: Built outbound TCP connection 447237 for outside:KAV_Update_Server/<port> (KAV_Update_Server/<port>) to dmz:TSP_Server/<port> (TSP_Server/<port>)
Dec 11 08:01:53 <IP> %ASA-6-302014: Teardown TCP connection 447237 for outside:KAV_Update_Server/<port> to dmz:TSP_Server/<port> duration 0:00:00 bytes 11420 TCP FINs

我只找到了來自 Cisco 的這個文件，其中沒有任何關於“Message_text”欄位的解釋。

看看這個，使案例如 %ASA-4-106023 作為索引： http ://www.cisco.com/en/US/docs/security/asa/asa80/system/message/logmsgs.html

錯誤消息 %PIX|ASA-4-106023: Deny protocol src

$$ interface_name:source_address/source_port $$目標介面名稱：目標地址/目標埠$$ type {string}, code {code} $$通過 access_group acl_ID 解釋 ACL 拒絕了一個真實 IP 數據包。即使您沒有為 ACL 啟用日誌選項，也會顯示此消息。

建議的操作：如果消息從同一源地址持續存在，則消息可能指示足跡或埠掃描嘗試。聯繫遠端主機管理員。

引用自：https://serverfault.com/questions/563545