FPR-1140 doesn't send syslog messages seen in ASDM to server

[robertschmitzberlin]

When looking at the ASDM Real-Time Log Viewer I can see lots of connection build-ups and teardowns. I can filter them and find the connections that I look for. Everything fine here.

I want to see the very same output on my syslog server. But they don't show up. All I see there are messages that are NOT shown in the Real-Time Log Viewer. But these messages all come from the IP address of the Firepower device I look at with the ASDM.

What did I configure wrong?

In "Configuration - Device Management - Logging - Logging Filters" both the ASDM and the Syslog Servers are set to "Severity: Informational".

Of course logging is enabled in "Configuration - Device Management - Logging - Logging Setup".

This is reflected on the CLI:

# show run logging        
logging enable
logging timestamp
logging trap informational
logging asdm informational
logging host 'interface' 'IP address'
#

Any help is highly appreciated.

[marce1000]

 - What  happens if you change the logging levels from informational to debugging ?

 M.

[robertschmitzberlin]

Thank you for the suggestion, but it doesn't change the main problem.

I set both ASDM and Syslog Servers to "Debugging" and also enabled "Send debug messages as syslogs", but there are still no connection build-ups or teardowns in the syslog on the syslog server.

[robertschmitzberlin]

I have controlled the configuration and checked it against another similar machine from another customer. The configuration is fine.

It looks like the problem is a filter on the customer side. I might be able to confirm this tomorrow.

[robertschmitzberlin]

After spending a lot of time on this phenomenon a colleague finally tells me that he had the same problem at another customer's site. The firepower sends all the syslog messages, but they have a certain format that is dropped by the syslog server. The solution was to re-configure the syslog server to accept the message format.

I hav asked our server admins to look into this, but haven't received an answer yet.

[robertschmitzberlin · Accepted solution]

Ok, now it works as it should.

The solution was to delete the line

no logging host [interface name] [ip address of syslog server]

and then to add it again:

logging host [interface name] [ip address of syslog server]

And the syslog messages arrived at the syslog server again.