To get information about the traffic (the "allow" mentioned in your email)
you need at least level 6 (informational). Oddly enough, you can get the
URLs accessed (but no other traffic info) with level 5 (Notification). If
you are only interested in denials you can keep the logging to level 4

If storage is an issue, you can simply zip the logs (some log analyzers -
see - can do that or you can script it). The information in
Pix logs is highly compressible - a 100 MB log can be compressed to a 7-8 MB
file or even less, depending on what syslog server you are using.


Adrian Grigorof
Altair Technologies

----- Original Message -----
From: "Ravdal, Stig"
Sent: Friday, April 07, 2006 11:31
Subject: [fw-wiz] Appropriate PIX logging level

Hi guys,

I'm having a discussion with some of our network engineers about the
appropriate level of logging on a Cisco PIX firewall. The major
complaint I get for increasing the logging level is because of lack of
storage. Are there standard or best practice references that I can
bring to the table?

I'm expecting to get some variation in responses from this post. What
may be helpful to me is to understand what information is being lost by
going to the next lower level.

At a minimum I think we should be logging and analyzing: date/time,
interface(s), src/dst IP, src/dst port, proto, allow/deny, rule applied
(, other?). Does that seem right? What about SYN/ACK and so on?

Based on the information I believe we should be logging what does the
logging level on a PIX have to be set to?


Stig Ravdal
firewall-wizards mailing list

firewall-wizards mailing list