Good question. It looks like you need syslog server which can react to specific syslog messages and notify you via email or something. The messages are:
%ASA-1-717054: The type certificate in the trustpoint tp name is due to expire in number days. Expiration date and time Subject Name
subject name Issuer Name issuer name Serial Number serial number
%ASA-1-717055: The type certificate in the trustpoint tp name has expired. Expiration date and time Subject Name subject name Issuer
Name issuer name Serial Number serial number
They are produced by default:
crypt ca alerts expiration begin 60 repeat 7
To the best of my knowledge, FMC currently can only receive VPN syslogs from a pre-defined list ("Enable Logging to Secure Firewall Management Center" option under Devices > Platform Settings > Syslog), which results in:
logging list FMC_VPN_EVENT_LIST level errors class vpn
logging fmc MANAGER_VPN_EVENT_LIST
Messages 717054, 717055 belong to class "ca" and hence not sent to FMC, if I'm not mistaken. Also, it looks like we don't have Telegraph Health Module for managed devices which can react to certain syslogs (e.g. those with high severity level) generated from Lina and notify corresponding health module on the FMC so that it can generate health alert.
Sadly enough, we don't have full visibility to what happens on managed devices when FMC alone is used for management.
