Cisco ASA Syslog Analysis

This skill teaches you how to read, parse, and interpret log messages generated by Cisco ASA firewalls. All ASA logs are delivered via the syslog protocol, so understanding syslog is foundational before working with ASA-specific content.

Part 1: Syslog Protocol Foundation

All Cisco ASA log messages are transported and formatted using the syslog standard (RFC 3164 / RFC 5424). You must understand syslog before interpreting ASA messages.

Severity Levels

Every syslog message carries a numeric severity (0 = most critical, 7 = least critical):

Facility Codes

Facility codes indicate the source subsystem (0-23). Cisco ASA uses local4 (code 20) by default, but this is configurable on the device.

PRI Value

The PRI header encodes both facility and severity:

PRI = (Facility x 8) + Severity

Example: local4 (20) + Informational (6) -> (20 x 8) + 6 = 166, shown as \x3C166> in the log header. This is the most common PRI value seen in ASA logs.

RFC 3164 Format (Traditional)

\x3CPRI>TIMESTAMP HOSTNAME TAG: MESSAGE

Example: \x3C166>Jan 15 10:22:01 fw01 : %ASA-6-302013: Built outbound TCP connection...

RFC 5424 Format (ASA 9.10+)

Enabled via "logging timestamp rfc5424". Uses ISO 8601 UTC timestamps:

\x3CPRI>VERSION TIMESTAMP HOSTNAME APP-NAME PROCID MSGID STRUCTURED-DATA MSG

Example: \x3C166>1 2018-06-27T12:17:46Z asa - - - %ASA-6-110002: Failed to locate egress interface...

Part 2: Cisco ASA Log Format

Core Message Structure

Every ASA event message follows this pattern, regardless of syslog envelope:

%ASA-severity-message_id: message_text

Full Log Line with Syslog Envelope

\x3CPRI> TIMESTAMP HOSTNAME : %ASA-severity-message_id: message_text

Real example (RFC 3164): \x3C166>Jan 15 10:22:01 fw01 : %ASA-6-302013: Built outbound TCP connection 12345 for outside:203.0.113.1/443 (203.0.113.1/443) to inside:192.168.1.100/54321 (192.168.1.100/54321)

Real example (RFC 5424): \x3C166>1 2024-01-15T10:22:01Z fw01 - - - %ASA-6-302013: Built outbound TCP connection...

Message ID Numbering and Categories

The 6-digit message ID encodes the functional category in its first 3 digits:

Common Variable Tokens

ASA message text uses descriptive named placeholders:

Parsing Regex

Extract the core ASA fields from any log line:

%ASA-(?P\x3Cseverity>\d)-(?P\x3Cmessage_id>\d{6}):\s+(?P\x3Cmessage_text>.+)

Full line including syslog envelope:

^(?P\x3Ctimestamp>\S+\s+\S+\s+\S+|\S+T\S+Z)\s+(?P\x3Chostname>\S+)\s+:\s+%ASA-(?P\x3Cseverity>\d)-(?P\x3Cmessage_id>\d{6}):\s+(?P\x3Cmessage_text>.+)$

Guidelines

• Always extract the message_id first -- it uniquely identifies the event type
• Check severity immediately: levels 1-3 indicate critical/error conditions requiring attention; 6-7 are routine
• Use the first 3 digits of the message_id to identify the functional area before looking up details
• ASA logs are interface-aware -- always note which interface (inside, outside, dmz) events occur on, as it provides essential network direction context
• Watch for paired messages: ASA often emits build/teardown pairs (e.g., 302013 "Built" + 302014 "Teardown") that together describe the full lifecycle of a connection
• For detailed per-message-ID definitions (message text templates, variable meanings, recommended actions), consult the reference files indexed below

Reference Files

Detailed documentation for each message ID is maintained in separate files organized by range, matching Cisco's official documentation structure:

For serverity levels, refer to references/Messages Listed by Severity Level.md

For overall information of Cisco ASA syslog messages, refer to references/About Cisco Secure Firewall ASA.md

Official Cisco source: https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/asa-syslog.html