| 12.6 |  | Syslog Configuration on the PIX |
| 12.6.1 |  | Configure Syslog output to a Syslog server |

| This section discusses how to configure the PIX Security Appliance to successfully interface with Syslog servers. Syslog servers are designed to provide a central location to collect and store messages produced by the PIX Security Appliance, such as IDS alarms, alerts, resource depletion warnings, and system events. These messages may then be used to create e-mail alerts and log files, or may be displayed on the console of a designated Syslog host. Using Syslog enables an administrator to gain information about PIX traffic and performance, analyze logs for suspicious activity, and troubleshoot problems.

The PIX Security Appliance can send Syslog messages to any Syslog server. In the event that all Syslog servers or hosts are offline, the PIX Security Appliance stores up to 100 messages in its memory. Subsequent messages that arrive overwrite the buffer starting from the first line.

Syslog can run on a number of operating system platforms, including UNIX and Windows-based platforms. Syslog servers can be downloaded, free of charge, from the Cisco Connection Online (CCO) Web site.