CCNP BCMSN Exam Certification Guide (3rd Edition)

Appendix B. Security Appliance Logging Messages

This appendix covers all the possible messages a firewall can generate. It can serve as a quick reference so that you can look up messages that are associated with the different severity levels.

Cisco firewall logging messages are listed in this section grouped according to their default severity level (1 to 7):

• 1 Alerts

• 2 Critical messages

• 3 Errors

• 4 Warnings

• 5 Notifications

• 6 Informational messages

• 7 Debugging messages

Severity level 0, Emergencies, exists but is never used by Cisco firewalls. Historically, these messages have been associated with UNIX systems and are sent only when a system is unstable and can no longer operate properly. That extreme condition is not applicable with a firewall platform.

All syslog messages have a default severity level, which is listed in the following tables. You can reassign each message to a new severity level if needed.

The logging messages listed here are based on PIX OS releases 6.3 and 7.0, as well as FWSM 2.3. Logging messages for Cisco IOS software firewalls are listed in Chapter 12, "Cisco IOS Firewall: Managing Activity," in section 12-2, "Configuring IOS Firewall Logging."

You can use the information presented in this appendix when you want to choose a severity level for a logging destination. Make sure the level you choose will generate the messages you need to see.

NOTE

When you choose a severity level, remember that logging messages from that level and all lower-numbered levels are sent. Only the messages from a higher-numbered level are not sent.

Figure B-1 shows each of the logging severity levels, along with a general list of the types of messages generated. Notice that each level also includes every level below it. The higher the severity level, the more types of messages that are included.

NOTE

In the tables in this appendix, the six-digit logging messages are listed in numerical order. Each message identifier also includes a prefix that indicates the hardware plat-form that can generate the message. For example, %PIX denotes the PIX Security Appliance platform, %FWSM denotes the Firewall Service Module (FWSM), and %ASA denotes the Adaptive Security Appliance (ASA).

If a message is common to all platforms, it is shown only with the %PIX prefix. Otherwise, the message is platform-specific as indicated.

Logging messages that are introduced with PIX 7.x have (7.0) at the end of the message text.