FMC 2500 Audit Logs For Failed Authentication Not Being Shown in Remote Syslog Server

[PETER AGENGO]

Hello, 

I have FMC 2500 configured to send logs to an external remote syslog server. I see the audit logs in remote syslog server for successful login attempts to the FMC GUI but not the failed authentication attempts. 

Product Model Cisco Firepower Management Center 2500
Software Version 6.3.0
Operating System Cisco Fire Linux OS
Operating System Version 6.3.0

Send Audit Log to Syslog :
Host > xx.xxx.xxx.xxx
Facility < SYSLOG
Severity > INFO

Anyone come across this? 

[PETER AGENGO · Accepted solution]

This issue was resolved. Just needed a little bit of patience in searching for the logs. Once I saw the log message on FMC I was confident I would see it in the SIEM.