How to extract FMC Logs

[MSJ1]

Is it possible to extract FMC Logs to a different system ?

[balaji.bandi]

You mean from FMC to other system - yes possible check by login to FMC and $sudo su give you access to Linux access.

[MSJ1]

But what will be the Log file name  I should look for ?

Just to be clear , i am referring to the all kind of events ( like Connection events , Intrusion events etc ) I can see from FMC.

[balaji.bandi]

As per i know in terms of events they are stored in DB (PostgreSQL- i guess), you can backup them as per the below guide :

https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Backup_and_Restore.html

You can configure Syslog to an external server to offload them.

Most of the other logs stored /var/log