OpenClaw

cisco-asa-syslog

Parse, interpret, and analyze Cisco ASA (Adaptive Security Appliance) firewall syslog messages. Use this skill whenever working with Cisco ASA log files, syslog streams from ASA devices, firewall event analysis, or security investigations involving ASA-generated events. Covers the syslog protocol foundation and the ASA-specific message format with message ID categorization.

gangtao0 来源安装数☆ 0 仓库 Stars

查看来源 ↗安装与使用 SKILL.md ↗

安装与使用

请根据来源仓库和你的 AI 工具说明安装此技能。先阅读技能文件和依赖要求，再添加到工作流。

SkillHub CLI

skillhub install gangtao/cisco-asa-syslog

打开来源仓库，查看说明和兼容环境后，按来源提供的命令或步骤安装。

将来源链接提供给你的 Agent，让它先读取说明、核对依赖，并向你说明将执行的安装步骤。

查看来源 ↗使用指南

技能说明

Cisco ASA Syslog Analysis

This skill teaches you how to read, parse, and interpret log messages generated by Cisco ASA firewalls. All ASA logs are delivered via the syslog protocol, so understanding syslog is foundational before working with ASA-specific content.

Part 1: Syslog Protocol Foundation

All Cisco ASA log messages are transported and formatted using the syslog standard (RFC 3164 / RFC 5424). You must understand syslog before interpreting ASA messages.

Severity Levels

Every syslog message carries a numeric severity (0 = most critical, 7 = least critical):

Level	Keyword	Meaning
0	Emergency	System is unusable
1	Alert	Immediate action required
2	Critical	Critical conditions
3	Error	Error conditions
4	Warning	Warning conditions
5	Notice	Normal but significant events
6	Informational	Routine informational messages
7	Debug	Verbose diagnostic output

Facility Codes

Facility codes indicate the source subsystem (0-23). Cisco ASA uses local4 (code 20) by default, but this is configurable on the device.

PRI Value

The PRI header encodes both facility and severity:

PRI = (Facility x 8) + Severity

Example: local4 (20) + Informational (6) -> (20 x 8) + 6 = 166, shown as <166> in the log header. This is the most common PRI value seen in ASA logs.

RFC 3164 Format (Traditional)

<PRI>TIMESTAMP HOSTNAME TAG: MESSAGE

Example: <166>Jan 15 10:22:01 fw01 : %ASA-6-302013: Built outbound TCP connection...

RFC 5424 Format (ASA 9.10+)

Enabled via "logging timestamp rfc5424". Uses ISO 8601 UTC timestamps:

<PRI>VERSION TIMESTAMP HOSTNAME APP-N...

来源信息

Source: github
Repository: openclaw/skills
Path: skills/gangtao/cisco-asa-syslog
Version: —
Commit: 80bb477a44b505a6d32e162f5615e54c7ba8a0d3
分类来源: rules
状态: active
可见性: public

这些信息来自收录时的来源分析，可能滞后；使用前请核对最新来源文件。

来源内容

SKILL.md

# Cisco ASA Syslog Analysis

This skill teaches you how to read, parse, and interpret log messages generated by Cisco ASA firewalls. All ASA logs are delivered via the syslog protocol, so understanding syslog is foundational before working with ASA-specific content.

---

## Part 1: Syslog Protocol Foundation

All Cisco ASA log messages are transported and formatted using the syslog standard (RFC 3164 / RFC 5424). You must understand syslog before interpreting ASA messages.

### Severity Levels

Every syslog message carries a numeric severity (0 = most critical, 7 = least critical):

| Level | Keyword       | Meaning                                  |
|-------|---------------|------------------------------------------|
| 0     | Emergency     | System is unusable                       |
| 1     | Alert         | Immediate action required                |
| 2     | Critical      | Critical conditions                      |
| 3     | Error         | Error conditions                         |
| 4     | Warning       | Warning conditions                       |
| 5     | Notice        | Normal but significant events            |
| 6     | Informational | Routine informational messages           |
| 7     | Debug         | Verbose diagnostic output                |

### Facility Codes

Facility codes indicate the source subsystem (0-23). Cisco ASA uses local4 (code 20) by default, but this is configurable on the device.

### PRI Value

The PRI header encodes both facility and severity:

  PRI = (Facility x 8) + Severity

Example: local4 (20) + Informational (6) -> (20 x 8) + 6 = 166, shown as <166> in the log header. This is the most common PRI value seen in ASA logs.

### RFC 3164 Format (Traditional)

  <PRI>TIMESTAMP HOSTNAME TAG: MESSAGE

Example:
  <166>Jan 15 10:22:01 fw01 : %ASA-6-302013: Built outbound TCP connection...

### RFC 5424 Format (ASA 9.10+)

Enabled via "logging timestamp rfc5424". Uses ISO 8601 UTC timestamps:

  <PRI>VERSION TIMESTAMP HOSTNAME APP-N...

搜索