Syslogs for Allow and Denies on FMC and FTD

[jmeetze]

We have setup Syslog to remote Syslog servers under our Device Platform Settings.  For some reason, we are not able to see logs on our syslog server that shows information like "TCP connection Allowed from Src_IP to Dest_IP on Access-Control Policy "Sample Policy" Rule: "Test Rule".  

I can see logs for all of our pre-filter rules, but it seems like I do not see any logs for our rules in our Access-Control Policy.  I have verified that the checkbox is checked under each rule to "Send to Syslog".  Does anyone know what Syslog ID's to enable to get these logs?  I've gone through the list of Syslog ID's on Cisco's site, but it's quite the effort to go through that list.   On ASA it seemed we got these logs by simply turning on Syslog.  

Here's  a screenshot of my configuration:  

Should I not be able to see Allow/Deny logs with source/destination IP, and Access-Control Rule Name?

Thanks in advance.

[balaji.bandi]

have you enabled logging in ACP rule :

[jmeetze]

Yes, I have enabled logging on all rules with the option checked to Send to Syslog Server.  

[MHM Cisco World]

prefilter what action you choose here ??

[jmeetze · Accepted solution]

I'm only using prefilter for traffic I do not wish to inspect so the action on those rules is all FastPath.  I do have logging enabled though for each rule and it's configured the same as my ACP rules which is Log to Syslog server.  

I may actually be seeing some logs now, but they just contain way more information that I'm used to.  We migrated from ASA to FTD and in ASA it was a pretty simple log showing your source ip, dest ip, src port, dest port, action, and rule name.  I guess with FTD's it will now show like the one below:

If that's the case, then it looks as if I am now seeing logs correctly.  I guess the new format threw me off a bit. 

Thanks!