ASA log viewer

Sun Nov 20 22:33:52 UTC 2011

On Sun, Nov 20, 2011 at 6:42 AM, Joe Happe <Joe.Happe at archlearning.com> wrote:
>udp for syslog the ASA won't be in this mode, and you won't block traffic if syslog fails.  With that said, there may be a command I'm unaware of that allows a tcp syslog to fail and not block traffic.

Yes.
logging permit-hostdown

However,  if you don't need to refuse connections when TCP syslog
fails, then you don't need 100% of your syslog messages,   you should
use UDP syslog for performance.

TCP just makes sure you will get all syslog messages between time A
and time B     or none of them.
If there are WAN issues,  there are many cases where one would prefer
SOME syslog messages, with an understanding that the network
bottleneck means messages are being lost,  rather than  few/no syslog
messages to help  debug the issue

--
-JH