Syslog ID 852001 & 852002

[Chess Norris]

Hello,

I recently observed our FTD is getting flooded with  lots of Syslog ID 852001 & 852002 messages.

It basically hundreds of those messages every minute (example below)

Jan 23 2023 02:51:59: %FTD-6-852002: Received Full Proxy to Lightweight event from application Snort for TCP flow 10.199.254.162/27607 to 10.10.1.94/47873
Jan 23 2023 02:51:59: %FTD-6-852001: Received Lightweight to full proxy event from application Snort for TCP flow 10.14.38.1/27789 to 10.20.8.146/8726
Jan 23 2023 02:51:59: %FTD-6-852002: Received Full Proxy to Lightweight event from application Snort for TCP flow 10.14.38.1/27789 to 10.20.8.146/8726
Jan 23 2023 02:52:04: %FTD-6-852001: Received Lightweight to full proxy event from application Snort for TCP flow 10.14.38.1/34260 to 10.10.1.101/8726

I've read the explanation here

https://www.cisco.com/c/en/us/td/docs/security/firepower/Syslogs/b_fptd_syslog_guide/syslogs10.html#id_122205 

but it's a bit vague and we dont have any SSL policys and I just started to noticed those messages recently.

Does anyone have an idea on what might trigger those messages?

There is also not possible to filter out those specifik syslog ID's due to a bug, which makes it even more frustrating

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvx37329 

Thanks

/Chess

[Marvin Rhoads]

I haven't come across it but, given the BugID you cited, I'd encourage you to open a TAC case.

Work on ENH (enhancement) bugs gets prioritized that way.

[Chess Norris]

Thanks. I'll open a case with TAC and see what they say.

/Chess

[MHM Cisco World]

I will check this Syslog message today.

[Chess Norris]

TAC raised the severity for the issue about not beeing able to rate limit those syslog IDs and just replied and told be that this should be fixed in version 7.4, which will most likely will be released in April. The issue is not only with those specific IDs, but rather for all syslog IDs over 805003 (In the range 805003 - 8300006) 

 https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwe68840  

/Chess

[MHM Cisco World]

Thanks alot for your update 

[adamgerber]

Thank you for this - hope this gets fixed in 7.4.