topic Re: FMC - Logging deployment history to remote server in Network Security

FMC - Logging deployment history to remote server

konemg — Thu, 22 Dec 2022 09:45:56 GMT

Hi,

I would like to log into remote server (as syslog, for example) each deployment configuration (the modifications). On my FMC, there's a section called "Deployment history" where you can see all the history changes, I want that. How can I send this information to a remote server?

I have been looking for a specific Syslog ID to configure my syslog (at Platform Settings) that logs these changes, but I couldn't find one.

Any idea how can I do it?

Regards!

Re: FMC - Logging deployment history to remote server

MHM Cisco World — Thu, 22 Dec 2022 10:40:36 GMT

Configure Logging on FTD via FMC - Cisco

check this guide

Re: FMC - Logging deployment history to remote server

balaji.bandi — Thu, 22 Dec 2022 10:43:53 GMT

i have not come across any specific syslog ID to send to syslog for the deployment history. (yes good to have that option - may be cisco wish request here i guess here).

others welcome to post - happy to learn if one have other suggestions.

Re: FMC - Logging deployment history to remote server

konemg — Thu, 22 Dec 2022 10:53:15 GMT

Hi,

I have already checked this post and explains how to configure remote logging on FTD, but there's no specific explanation about how to log deployed changes.

Thank you!

Re: FMC - Logging deployment history to remote server

MHM Cisco World — Thu, 22 Dec 2022 10:56:36 GMT

from guide I attach,

Re: FMC - Logging deployment history to remote server

konemg — Thu, 22 Dec 2022 11:13:12 GMT

Hi,

I know there is a section to specify Message ID's, the point is that there's no one that logs deployed changes. For example, as your screenshot shows, the Message ID 106002 logs "Connection denied by outbound". Look at the reply of @balaji.bandi.

Thanks!

Re: FMC - Logging deployment history to remote server

MHM Cisco World — Thu, 22 Dec 2022 11:25:21 GMT

first step is config event list, the n under event class you select event list and name.

Re: FMC - Logging deployment history to remote server

Marvin Rhoads — Thu, 22 Dec 2022 12:42:26 GMT

You cannot send these events to syslog directly as far as I know. However you can email them via a scheduled report.

Open System > Monitoring > Audit, the click on Reporting. Customize the report to only include events with "Deployment" in the message. Like this:

You can then create a scheduled task to run this report periodically and send it out via email. Perhaps your syslog server has the ability to ingest the email attachments with some parsing help?