Change facility for intrution event logs via LinaConfigTool on FTD

[Pennerborn]

Hello,

I'm trying to change the facility via LinaConfigTool on a Cisco 2100 FTD, 7.0 for intrution event logs. 

I've used this command to change the facility for syslogs:

/usr/local/sf/bin/LinaConfigTool "logging facility 19"

Is there any similar for intrution event logs? Or can you do it any other way without FMC?

Kind regards,

Tom Pennerborn

[Pennerborn · Accepted solution]

I've found the soulution

In the file /ngfw/var/sf/detection_engines/YOUR-OWN/ids_alert.conf

Under intrution change facility to one from this document: external_alerting_for_intrusion_events.pdf (cisco.com)