Chapter9.Firewall Logging

Chapter 9. Firewall Logging

Refer to the following sections for information about these topics:

• 9-1: Managing the Firewall Clock Discusses ways to set and maintain the firewall's internal clock so that events and messages can have accurate time stamps.

• 9-2: Generating Logging Messages Explains how firewalls generate logging messages and how you can configure them to do that.

• 9-3: Fine-Tuning Logging Message Generation Covers the configuration steps that can be used to enable or disable specific logging messages or change their severity levels. This section also discusses how to configure access list activity logging.

• 9-4: Analyzing Firewall Logs Provides an overview of how you can approach collecting and analyzing the logging messages that firewalls produce.

Cisco firewalls and security appliances can be configured to generate an audit trail of messages describing their activities. Firewall logs can be collected and analyzed to determine what types of traffic have been permitted or denied, what users have accessed various resources, and so on.

This chapter presents the tasks that are necessary to begin generating and collecting logging messages.