ASA Rsyslog

cat /etc/rsyslog.conf
# rsyslog v5 configuration file
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)

# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# $template MyASAFormat,"timereported:%timereported% fromhost:%FROMHOST% hostname:%HOSTNAME% tag:%syslogtag%(%pri% ) message:%msg:::drop-last-lf%\n"

$template MyASAFormat,"%timereported%%msg:::drop-last-lf%\n"
$template MyASAVPNRegex,"%msg:R,ERE,0,DFLT:\%ASA-[0-9]-(316|320|402|404|501|602|702|713|714|715)[0-9]{3}:.*--end%\n"
$template MyASAGeneralLog,"/var/log/cisco/%HOSTNAME%/asa-general.log"
$template MyASAVPNLog,"/var/log/cisco/%HOSTNAME%/asa-vpn.log"

[...]
# Dawid Mocek. 25-05-2015
# Cisco ASA
# local0.*                                              /var/log/cisco.log;asaFormat
# local0.*                                              /var/log/cisco.log

local0.*                                                ?MyASAGeneralLog;MyASAFormat
:msg, ereregex,"\%ASA-[0-9]-(316|320|402|404|501|602|702|713|714|715)[0-9]{3}:" -?MyASAVPNLog;MyASAFormat