FTD appears to by default disable certain log messages that the ASA had on by default. Including deny's.
On FTD 6.6.0: Devices->Platform Settings->Pencil Icon->Syslog->Syslog Settings
Here you will see a list of Syslog IDs which cisco decided to by default not log.
The one you are looking for is 106023. Click the Pencil, check the enabled Checkbox. Save and deploy.
Unfortunately it'll be of somewhat limited use, because the log message won't actually include what access rule/group blocked the connection like the ASA did. It'll always just say "CSM_FW_ACL_" blocked it, since the FTD stores everything in a flat lina access-list.
You should go through the rest of the blocked Syslog IDs to see if there's anything else you want. The meaning of the Syslog IDs are here:
https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs-sev-level.html
There are several other ones which are quite useful if you're accustomed to debugging traffic via syslog.
