Can we use FMC as a syslog server for managed sensors?

[matty-boy]

Hi all,

We have a customer with an FMC/FTD deployment. They currently have no central syslog service to send syslogs from the FTDs.

FMC is good at storing security related logs but what about infrastructure logs generated by FTDs (routing peer or physical link up/down, admin made a config change, etc)? Is there any way we can send these sorts of logs to the FMC as a central syslog server?

Thanks in advance,

Matt.

[Marvin Rhoads · Accepted solution]

I don't think so.

Normally, events sent from the sensors get to FMC via the eventing interface which uses TLS over tcp/8302.

Syslog would require the FMC to be listening on udp/514 (which it does not) and be able to store, parse and display syslog message format.

[matty-boy]

Thank you for confirming my suspicion Marvin.