Firewall Reboot events

[SecSuperAdmin]

Hi All, 

Is there a way to check FTD reboot events in FMC? 

Or where we can check the system events of FTD in FMC?

[Aref Alsouqi]

I think you can check those events in the pigtail logs from the FTD CLI.

[SecSuperAdmin]

I am new to FTD. Is there any guide or KB for the same ?

[Cristian Matei]

Hi,

    Interesting and at the same time same time relevant question you've brought up. I'm not aware of a simple way of finding the reason for an FTD reload from the FMC GUI, other than, from FMC GUI, going to System--> Monitor, accessing the relevant FTD, using the "Generate Troubleshooting Files" knob and knowing where to look in those files to find the reason. However, finding the reason within the troubleshooting file is the same as finding the reason from FTD CLI.

    There are multiple ways of finding the reason, based on the actual platform model, see here a self-explanatory document:

https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/217663-troubleshoot-asa-or-ftd-unexpected-reloa.html

Thanks,

Cristian.

[Marvin Rhoads]

@SecSuperAdmin the troubleshooting bundle mentioned by @Cristian Matei will contain multiple internal system logs which may (or may not) contain the root cause of any reboot events.

Cisco TAC is the best source for analysis of the bundle as they have automation tooling to parse through the large volume of data in a bundle.

[SecSuperAdmin]

@Marvin Rhoads , Understood. Is there any specific place we can see system events ?

[Aref Alsouqi]

I think you can go into the expert mode and look at "/var/log/messages".