https://www.dannoprojects.com/tags/syslog/Recent content in Syslog on Danno ProjectsHugo -- gohugo.ioenTue, 14 Apr 2026 09:00:00 -0700https://www.dannoprojects.com/posts/networking/asa-syslog-to-cloudwatch/Tue, 14 Apr 2026 09:00:00 -0700https://www.dannoprojects.com/posts/networking/asa-syslog-to-cloudwatch/<h2 id="overview">Overview</h2> <p>In an <a href="https://www.dannoprojects.com/posts/networking/cisco-firepower-saml-mfa/">earlier post</a> I set up SAML and MFA for VPN on a Cisco Firepower 1120 running ASA. Once that was in place, the next question was obvious: <strong>how do I know when something is wrong with the firewall without logging into ASDM every morning?</strong></p> <p>We already ran most of our infrastructure in AWS, so Amazon CloudWatch was the natural place to land firewall logs. The first attempt worked, and it also sent <em>everything</em>. The log volume was noisy, expensive to keep, and useless for alerting. This post covers the version I ended up with: a small Linux syslog relay, a trimmed log stream, and a handful of metric filters that drive alarms and a dashboard.</p>