topic Firewall Reboot events in Network Security

Firewall Reboot events

SecSuperAdmin — Tue, 02 Dec 2025 02:54:04 GMT

Hi All,

Is there a way to check FTD reboot events in FMC?

Or where we can check the system events of FTD in FMC?

Re: Firewall Reboot events

Aref Alsouqi — Tue, 02 Dec 2025 10:41:26 GMT

I think you can check those events in the pigtail logs from the FTD CLI.

Re: Firewall Reboot events

SecSuperAdmin — Tue, 02 Dec 2025 11:49:48 GMT

I am new to FTD. Is there any guide or KB for the same ?

Re: Firewall Reboot events

Cristian Matei — Tue, 02 Dec 2025 14:59:01 GMT

Hi,

Interesting and at the same time same time relevant question you've brought up. I'm not aware of a simple way of finding the reason for an FTD reload from the FMC GUI, other than, from FMC GUI, going to System--> Monitor, accessing the relevant FTD, using the "Generate Troubleshooting Files" knob and knowing where to look in those files to find the reason. However, finding the reason within the troubleshooting file is the same as finding the reason from FTD CLI.

There are multiple ways of finding the reason, based on the actual platform model, see here a self-explanatory document:

https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/217663-troubleshoot-asa-or-ftd-unexpected-reloa.html

Thanks,

Cristian.

Re: Firewall Reboot events

Marvin Rhoads — Wed, 03 Dec 2025 03:17:35 GMT

@SecSuperAdmin the troubleshooting bundle mentioned by @Cristian Matei will contain multiple internal system logs which may (or may not) contain the root cause of any reboot events.

Cisco TAC is the best source for analysis of the bundle as they have automation tooling to parse through the large volume of data in a bundle.

Re: Firewall Reboot events

SecSuperAdmin — Wed, 03 Dec 2025 06:08:19 GMT

@Marvin Rhoads , Understood. Is there any specific place we can see system events ?

Re: Firewall Reboot events

Aref Alsouqi — Wed, 03 Dec 2025 09:43:49 GMT

I think you can go into the expert mode and look at "/var/log/messages".