Management of PIX/ASA Message Codes

Use the PIX/ASA Message Codes tab to categorize each incoming message based on the PIX/ASA severity and message code combination. The tab is available only on LogLogic LX Appliances and LogLogic MX Appliances.

For example, each incoming message of severity 2 with a 106006 message code is by default stored in the deny table. You can use the PIX/ASA Message Codes tab to change the category for the message.

Messages marked as Off on PIX/ASA Messages Codes tab are inserted into RawSyslog and stored. Disabled radio buttons indicate that the category is not applicable for the particular message type.

Note: The PIX/ASA Messages feature is available only on LogLogic LX Appliances and LogLogic MX Appliances. Only those appliances parse each PIX or ASA message.

Each Cisco message has a corresponding Cisco PIX/ASA message code. Your appliance uses this message code to help determine the message type for an incoming message.

The first number in the message code is the PIX/ASA severity level and the second number is the message code. For example, 1-101002, means the severity level is 1 and the message code is 101002.

The categories to define each PIX/ASA message include:

Category Description
Off Ignores the message
System Categorizes the message in the System table
Security Categorizes the message in the Security table
Parsed Categorizes the message in the Parsed table

Each supported message code is listed in the Message Code column on the Administration > PIX/ASA Messages Codes tab.

To view the definition for each message code, click the hyperlinked message code. Use the Reset button for resetting the codes to default installation settings.

The appliance automatically sets the message code to the default setting. However, you can click any active radio button to change the setting. .

Warning: Changing default message code settings can result in a large amount of disk space consumption that can shorten your log retention cycles.

The following codes are disabled (off) by default because they are redundant, though you can enable any of them if you want:

7-109014 7-109021 7-111009 7-199009 7-304005
7-701001 7-701002 7-702301 7-702303 7-703001
7-703002 7-709001 7-709002 7-710006 6-305001
6-305002 6-305003 6-305004 6-305009 6-305010
6-305011 6-305012 6-611301 6-611302 6-611303
6-611304 6-611305 6-611306 6-611307 6-611308
6-611309 6-611312 6-611314 6-611315 6-611316
6-611317 6-611318 6-611319 6-611320 6-611321
6-611322 6-611323 6-613002 6-614001 6-614002
3-106014 3-305005 3-305006