e ASA itself. To send logs to a syslog host, you must configure a trap destination level, the syslog facility, and the host to receive the logs: logging trap debugging logging facility 22 logging host inside 192.168.1.200 On the syslog server, you then need to configure syslog to receive these alerts. Detailed syslog configuration is outside the scope of this book, SO I'll just include the /etc/sy- slog.conf entries from my Ubuntu server: # Configuration for ASA logging local6.debug /var/log/ASA This will capture the ASA syslog entries and place them into the/var/log/ASA file. Notice that the ASA is configured for facility 22, but the server is configured for local6.debug The facilities are mapped as 16(LOCAL0)-23(LOCAL7). The default is 20(LOCAL4). Once you've begun collecting syslog entries into a file, you can use the server to view and parse the logfile without affecting your CLI window. On Unix systems, you can use commands like tail -f /var/log/ASA to view the log in real time. You can also add Chapter 28: ASA Firewall Configuration filters. For example, if you only want to see log entries containing the URL /lab/in- dex.html/, you can use the command tail -f /var/log/ASA grep /lab/ index.html/' For more information on logging, type help logging in ASA configura- tion mode. On a Unix system, you can learn more about syslog with the man syslog and man syslogd commands. Troubleshooting If you change an access list, change NAT, or do anything else that can alter which packets are allowed to flow through the firewall, you may not see the results until you execute the clear xlate command. Xlate is short for translation. A translation is created for every conversation that is active on the ASA. To see which xlates are active on your ASA, use the show xlate command: SA-5540# show xlate 4 in use, 4 most used Global 10.0.0.10 Local 192.168.1.10 Global 10.0.0.11 Local 192.168.1.11 PAT Global 10.0.0.6(80) Local 192.168.1.6(80) PAT Global 10.0.0.6(443) Local 192.168.1.7(443) The PAT Global entries are live connections 