topic Hello Arjun, in Network Security

FMC Syslog Alerts Add multiple servers

junajunction — Fri, 21 Feb 2020 14:05:13 GMT

Hi Guys, I am trying to add syslog servers in logging of a specific access policy rule. I have created an new syslog server for the same. I want to add multiple syslog servers for the same. Please let know if this is a limitation from FMC. since i am not able to find if we can have multiple syslog servers configured for the rules.

Thanks,

Arjun

Hello Arjun,

Veronika Klauzova — Sun, 28 May 2017 19:37:30 GMT

Hello Arjun,

unfortunately this is not possible at the moment. You can consider to configure eStreamer for Connection events towards multiple clients, so you can have same information on multiple-servers. Probably that would fit your requirement the best. Many of available syslogs servers act as eStreamer client, so most likely you dont need to deploy separate machines.

There is option for multiple syslog servers for Data-path/ASA logging part on FTD appliance. But for Firepower/Snort part applies above what I have mentioned.

Best regards,

Veronika

Additionally here is

Veronika Klauzova — Sun, 28 May 2017 19:49:30 GMT

Additionally here is enhancement request for your requirement:

CSCuz17592 - [ENH] Send syslog messages to more than one client.

You can keep track of it, by saving bug. you will get notification when status changes(get resolved) or if this is something critical to your business to have it implemented, please reach out to your Cisco Account team representative.

Best regards,

Veronika

Re: Additionally here is

jsburch01 — Tue, 21 Nov 2017 15:51:35 GMT

We have two syslog servers managed by two different teams and they both need the same syslog data. This feature would be very nice to have.

Re: Hello Arjun,

vamsi08 — Mon, 25 Jun 2018 09:29:44 GMT

if we don't have eStreamer configured is there any another possibility.