FMC 2500 Audit Logs For Failed Authentication Not Being Shown in Remote Syslog Server

PETER AGENGO — Fri, 21 Feb 2020 17:09:51 GMT

Hello,

I have FMC 2500 configured to send logs to an external remote syslog server. I see the audit logs in remote syslog server for successful login attempts to the FMC GUI but not the failed authentication attempts.

Product Model Cisco Firepower Management Center 2500
Software Version 6.3.0
Operating System Cisco Fire Linux OS
Operating System Version 6.3.0

Send Audit Log to Syslog :
Host > xx.xxx.xxx.xxx
Facility < SYSLOG
Severity > INFO

Anyone come across this?

Re: FMC 2500 Audit Logs For Failed Authentication Not Being Shown in Remote Syslog Server

PETER AGENGO — Wed, 12 Jun 2019 01:00:32 GMT

This issue was resolved. Just needed a little bit of patience in searching for the logs. Once I saw the log message on FMC I was confident I would see it in the SIEM.

topic FMC 2500 Audit Logs For Failed Authentication Not Being Shown in Remote Syslog Server in Network Security

FMC 2500 Audit Logs For Failed Authentication Not Being Shown in Remote Syslog Server

Re: FMC 2500 Audit Logs For Failed Authentication Not Being Shown in Remote Syslog Server