#

filter f_SOC {
         host("nderr230*" type(glob)) or
         host("nderr231*" type(glob)) or
         host("nderr992*" type(glob)) or
         host("ndevr5*" type(glob)) or
         host("ndevr6*" type(glob)) or
         host("ncnrr004*" type(glob)) or
         host("nsgvr953*" type(glob)) or
         host("ndevr360*" type(glob)) or
         host("ndevr361*" type(glob)) or
         host("ndevr362*" type(glob)) or
         host("ndevr363*" type(glob)) or
         host("nusrr053*" type(glob)) or
         host("nusrr953*" type(glob)) or
         host("nbrrr053*" type(glob)) or 
         host("nbrrr953*" type(glob)) or 
         host("nfrvr360*" type(glob)) or
         host("nfrvr361*" type(glob)) or
         host("nfrvr362*" type(glob)) or
         host("nfrvr363*" type(glob)) or
         host("NDERR992*" type(glob)) or
	 host("ndeacs*" type(glob)) or
         match ("%SEC-6-IPACCESSLOGP" value ("MESSAGE"))
};

filter f_ASA {
          match ("%ASA-4-113019" value ("MESSAGE"));
};


destination df_ASA {
        file(
                "/DATA/logging/ASA/$HOST"
                perm(644)
                create_dirs(yes)
                dir_owner("splunk")
                dir_group("splunk")
                dir_perm(0770)
                owner("splunk")
                group("splunk")
                perm(0770)
        );
};

destination df_SOC_Debug {
        file(
                "/DATA/logging/tmp/$HOST"
                perm(644)
                create_dirs(yes)
                dir_owner("splunk")
                dir_group("splunk")
                dir_perm(0770)
                owner("splunk")
                group("splunk")
                perm(0770)
        );
};


# Forward ASA messages to SOC and write ASA messages to files
log {
        source(remote_net);
        filter(f_SOC);
        destination (dh_SOC);
#  Only for Debugging
        destination (df_SOC_Debug);
};

# ASA User lgoin logout for French Corona Home Office issue SR-0320025
log {
        source(remote_net);
        filter(f_ASA);
        destination (df_ASA);
};


