Cisco ASA

Receives syslog that a Cisco ASA (Adaptive Security Appliance) forwards to the collector over TCP or UDP, and parses the messages into structured logs. The collector binds a listen address and port; the ASA must be configured to export its syslog to that address.

Supported Telemetry Types

Platform	Metrics	Logs	Traces
Linux		✓
Windows		✓
macOS		✓

Prerequisites

• A Cisco ASA appliance that is reachable from the collector and configured to forward syslog to the collector's IP and listen port. For the ASA-side setup (enabling logging and adding the collector as a syslog server), follow Cisco's official documentation: Configure logging on the Cisco Secure Firewall ASA (CLI) or Configure ASA syslog using ASDM.
• The collector's listen port must be open in any host or cloud firewalls between the ASA and the collector.
• The ASA only permits syslog server destination ports in the range 1025–65535. The collector's default listen port (5140) is within this range. If you choose a different port, keep it in that range.
• Binding to a port below 1024 requires running the collector with root (Linux/macOS) or Administrator (Windows) privileges. The default port 5140 does not require elevated privileges.

Configuration

Logs

Parameter	Type	Required	Default	Description
Listen Address	String	No	0.0.0.0	An IP address for the collector to bind. Typically 0.0.0.0 for most configurations.
Listen Port	Integer	No	5140	A TCP port which the collector will listen for syslog messages.

Advanced

Parameter	Type	Required	Default	Description
Parse	Boolean	No	true	Parses the log fields into structured data.

Examples

Receive ASA syslog on a non-default port

Bind the collector to all interfaces and listen on port 5514 for syslog forwarded by the ASA, parsing the messages into structured fields.

- name: listen_ip
  value: "0.0.0.0"
- name: listen_port
  value: 5514
- name: parse
  value: true

Configuration Tips

• Set Listen Address to 0.0.0.0 to accept syslog on all interfaces, or to a specific interface IP to restrict where the collector accepts traffic.
• Keep the listen port in the 1025–65535 range so the ASA can target it; the ASA rejects destination ports outside that range.
• Leave Parse enabled to get structured fields. Disable it only if you need the raw syslog message preserved without field extraction.

Troubleshooting

No logs arriving

Symptoms: the source is deployed but no Cisco ASA logs reach the pipeline.

Solutions:

1. Confirm the ASA is configured to send syslog to the collector's IP and listen port, and that logging is enabled on the device.
2. Verify the listen port is open in any host or cloud firewall between the ASA and the collector.
3. Confirm the ASA's destination port is in the 1025–65535 range; the ASA will not send to a port outside it.

Permission denied binding the listen port

Symptoms: the collector fails to start or bind, with a permission or address error.

Solutions:

1. If the listen port is below 1024, run the collector with root (Linux/macOS) or Administrator (Windows) privileges, or use a higher port such as the default 5140.
2. Confirm no other process is already bound to the listen address and port.

Standalone Source

apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: cisco-asa
spec:
  type: ciscoasa
  parameters:
    - name: listen_ip
      value: "0.0.0.0"
    - name: listen_port
      value: 5140
    - name: parse
      value: true

Related Resources

• Configure logging on the Cisco Secure Firewall ASA (CLI)
• Configure ASA syslog using ASDM