No InlineResult on IPS logs

Integration Support · ‎09-02-2026

Hi everyone,

I have recently set up a remote syslog server and configured syslog logging for Cisco FTD (v7.6.4) via FMC.

The logs are being sent and received as expected. Here is an example of an IPS event log from the syslog server:

<41>Sep 2 08:48:28 fmc TestAlert: [1:12798:10] "INDICATOR-SHELLCODE base64 x86 NOOP" [Impact: Currently Not Vulnerable] From "ftd" at Wed Sep 2 08:48:25 2026 UTC [Classification: Executable Code was Detected] [Priority: 1] {tcp} x.x.x.x:80 (france)->x.x.x.x:49331 (unknown)

While the InlineResult action (e.g., Block/Alert) is visible within the FMC GUI, it does not appear to be included in the generated syslog output.

Is there a configuration or setting available in FMC/FTD to include the InlineResult field directly in the syslog stream?

Thanks in advance,

Marvin Rhoads · ‎09-02-2026

If you have set the access control policy rule to log the associated connection events, that should generate an event with the associated action and reason (e.g., Block, Intrusion Event).