FireSight and Syslog

[istewart11]

Probably over thinking this but when setting up syslog on Cisco FTD what's the source of the log messages?

The FMC VM or the FTD appliance itself?

[Marvin Rhoads · Accepted solution]

A syslog event that's the result of a policy setting comes from the FTD device itself, not the FMC.

[istewart11]

thanks for that.