| 12.6 |  | Syslog Configuration on the PIX |
| 12.6.2 |  | Syslog messages |

| Syslog messages are sent from the PIX to the Syslog server to document the following four types of events:

1. Security events - Tracking security events consists of tracking dropped UDP packets and denied TCP connections. These messages provide administrators with important information, such as how often network attacks are taking place, and where the attacks are coming from.
2. Resources events - These events keep track of notifications of connection and translation slot depletion. This information is useful to the administrator because it helps determine whether network resources are sufficient to handle network traffic. The information also can help identify possible DoS attacks.
3. System events - By keeping a record of system events, the network administrator is able to track items such as when Console and Telnet logins and logouts occurred and when the PIX Security Appliance has been rebooted.
4. Accounting events - Accounting messages simply record the number of bytes that are transferred each time a connection is made.

Keep in mind that these four types of events can be sent to the Syslog server, or the PIX Security Appliance buffer. The buffer is very limited in space, so it is recommended that a dedicated Syslog server be used. Additionally, logging to the PIX buffer can degrade the performance of the PIX.

The Command Reference gives more information about how to configure logging of Syslog events to both the PIX Security Appliance buffer and a dedicated Syslog server.

| Lab Activity e-Lab Activity: Configuring Message output to the Cisco Syslog Server In this activity, the student will demonstrate how to configure message output to a Syslog server.

| Web Links http://www.cisco.com/en/US/products/sw/ secursw/ps2120/products_system_message _guide_chapter09186a00800891c4.html#1020397