Sending syslog to FileBeat from Cisco Asa

[jsandri]

Hi everyone!
I am a new user of elk and beats and I am trying to send logs from a Cisco Asa to a virtual machine with filebeat 7.1.1 using UDP. Logs are received but I encountered the following error message:

2019-06-11T16:13:33.168+0700 ERROR [syslog] syslog/input.go:131 can't parse event as syslog rfc3164 {"message": "<166>%ASA-6-106100: access-list mpls_access_in denied icmp mpls/X.X.X.219(11) -> SG_Office/X.X.X.10(0) hit-cnt 8 300-second interval [0x7c6ff586, 0x1f024755]\n"}

Here is more explication about the log message.

filebeat.yml looks like this:

filebeat.inputs:
- type: syslog
  protocol.udp:
    host: ":9000"
  enabled: true
output.console:
  pretty: true

For the time being, I am just trying to have something stable on the filebeat side. If anyone can help me

[adrisr (Adrian Serrano)]

@jsandri

<166>%ASA-6-106100: access-list mpls_access_in denied icmp mpls/X.X.X.219(11) -> SG_Office/X.X.X.10(0) hit-cnt 8 300-second interval [0x7c6ff586, 0x1f024755]

Hi.

This message doesn't look like proper Syslog. It's missing the timestamp and hostname.

It works when I manually add them:

<166>Jun 13 01:23:45 localhost %ASA-6-106100: access-list mpls_access_in denied icmp mpls/X.X.X.219(11) -> SG_Office/X.X.X.10(0) hit-cnt 8 300-second interval [0x7c6ff586, 0x1f024755]

You need to configure your Cisco ASA device to include the hostname and timestamp.

Here you can find instructions on how to add the timestamp:

Configure Adaptive Security Appliance (ASA) Syslog

Here explains how to add a hostname or "device ID":
https://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/monitor_syslog.html#wp1065641

FYI, the next version of Filebeat, 7.2.0, will include a module to parse Cisco ASA logs.

[jsandri]

Thanks for your answer but unfortunately even after having added the timestamp and hostname I have the same error.

2019-06-14T13:44:39.829+0700 ERROR [syslog] syslog/input.go:131 can't parse event as syslog rfc3164 {"message": "<166>Jun 14 2019 14:44:39 SGP-FWA-01 : %ASA-6-106015: Deny TCP (no connection) from X.X.X.145/58050 to X.X.X.55/443 flags RST on interface SG_Office\n"}

However, I have checked on Kibana and it seems to miss nothing but I don't really like keeping an error in my files. By the way, do you know when the new version will be released?

[jsandri]

Any ideas?