Software Secure Firewall Threat Defense
Platform Secure Firewall Threat Defense Virtual
Activity Onboard

Limit the Rate of Syslog Message Generation

You can limit the rate at which syslog messages are generated by severity level or message ID. You can specify individual limits for each logging level and each Syslog message ID. If the settings conflict, the Syslog message ID limits take precedence.


 

If you are configuring devices to send syslog messages about security events (such as connection and intrusion events), most Firewall Threat Defense platform settings do not apply to these messages. See Firewall Threat Defense Platform Settings That Apply to Security Event Syslog Messages.

Procedure

1

Choose Devices > Platform Settings and create or edit the Firewall Threat Defense policy.

2

Select Syslog > Rate Limit.

3

To limit message generation by severity level, click Logging Level > Add and configure the following options:

  • Logging Level—The severity level you are rate limiting. For information on the levels, see Severity Levels.
  • Number of messages—The maximum number of messages of the specified type allowed in the specified time period.
  • Interval—The number of seconds before the rate limit counter resets.
4

Click OK.

5

To limit message generation by syslog message ID, click Syslog Level > Add and configure the following options:

  • Syslog ID—The syslog message ID you are rate limiting. For specific message numbers, see Cisco ASA Series Syslog Messages .
  • Number of messages—The maximum number of messages of the specified type allowed in the specified time period.
  • Interval—The number of seconds before the rate limit counter resets.
6

Click OK.

7

Click Save.

You can now go to Deploy > Deployment and deploy the policy to assigned devices. The changes are not active until you deploy them.