我在哪里可以find思科ASA系统日志格式描述？ 日志示例：
Dec 11 08:01:24 <IP> %ASA-6-302015: Built outbound UDP connection 447235 for outside:NTP_Server_2/<port> (NTP_Server_2/<port>) to identity:<IP>/<port> (<IP>/<port>) Dec 11 08:01:24 <IP> %ASA-6-302015: Built outbound UDP connection 447235 for outside:NTP_Server_2/<port> (NTP_Server_2/<port>) to identity:<IP>/<port> (<IP>/<port>) Dec 11 08:01:24 <IP> %ASA-4-106023: Deny udp src dmz:OCSP_Server/<port> dst outside:DNS_Server_DO/<port> by access-group "dmz" [0x123a465e, 0x4c7bf613] Dec 11 08:01:24 <IP> %ASA-4-106023: Deny udp src dmz:OCSP_Server/<port> dst outside:DNS_Server_DO/<port> by access-group "dmz" [0x123a465e, 0x4c7bf613] Dec 11 08:01:31 <IP> %ASA-6-302013: Built outbound TCP connection 447236 for outside:KAV_Update_Server/<port> (KAV_Update_Server/<port>) to dmz:OCSP_Server/<port> (OCSP_Server/<port>) Dec 11 08:01:31 <IP> %ASA-6-302013: Built outbound TCP connection 447236 for outside:KAV_Update_Server/<port> (KAV_Update_Server/<port>) to dmz:OCSP_Server/<port> (OCSP_Server/<port>) Dec 11 08:01:31 <IP> %ASA-6-302014: Teardown TCP connection 447236 for outside:KAV_Update_Server/<port> to dmz:OCSP_Server/<port> duration 0:00:00 bytes 14804 TCP FINs Dec 11 08:01:38 <IP> %ASA-6-302014: Teardown TCP connection 447234 for outside:KAV_Update_Server/<port> to dmz:TSP_Server/<port> duration 0:01:08 bytes 134781 TCP FINs Dec 11 08:01:38 <IP> %ASA-6-302014: Teardown TCP connection 447234 for outside:KAV_Update_Server/<port> to dmz:TSP_Server/<port> duration 0:01:08 bytes 134781 TCP FINs Dec 11 08:01:38 <IP> %ASA-6-106015: Deny TCP (no connection) from KAV_Update_Server/<port> to TSP_Server/<port> flags RST on interface outside Dec 11 08:01:38 <IP> %ASA-6-106015: Deny TCP (no connection) from KAV_Update_Server/<port> to TSP_Server/<port> flags RST on interface outside Dec 11 08:01:39 <IP> %ASA-4-106023: Deny udp src dmz:TSP_Server/<port> dst outside:DNS_Server_DO/<port> by access-group "dmz" [0x123a465e, 0x8c20f21] Dec 11 08:01:53 %ASA-4-106023: last message repeated 9 times Dec 11 08:01:53 <IP> %ASA-6-302013: Built outbound TCP connection 447237 for outside:KAV_Update_Server/<port> (KAV_Update_Server/<port>) to dmz:TSP_Server/<port> (TSP_Server/<port>) Dec 11 08:01:53 <IP> %ASA-6-302013: Built outbound TCP connection 447237 for outside:KAV_Update_Server/<port> (KAV_Update_Server/<port>) to dmz:TSP_Server/<port> (TSP_Server/<port>) Dec 11 08:01:53 <IP> %ASA-6-302014: Teardown TCP connection 447237 for outside:KAV_Update_Server/<port> to dmz:TSP_Server/<port> duration 0:00:00 bytes 11420 TCP FINs 我发现只有思科没有解释有关“Message_text”字段的文档 。
看看这个，使用如％ASA-4-106023作为索引： http : //www.cisco.com/en/US/docs/security/asa/asa80/system/message/logmsgs.html
错误消息％PIX | ASA-4-106023：拒绝协议src [interface_name：source_address / source_port] dst接口名称：dest_address / dest_port [type {string}，code {code}] by access_group acl_ID
说明真正的IP数据包被ACL拒绝。 即使您没有为ACL启用日志选项，也会显示此消息。
build议的操作如果消息从相同的源地址持续存在，消息可能指示脚印或端口扫描尝试。 联系远程主机pipe理员。
如果你在问什么是助记符，这里有一个解释。