Using TCP port of Syslog and FTD and local logging?

[CiscoPurpleBelt]

Hi All,

Let's say the syslog server being used can use any port for syslog, is just using TCP 514 instead of default UDP 514 good practice?

Aside from current logging stopping and/or breaking, is just changing the setting potentially impacting anything else?

Also, are local logs still logged in the FTD even if logging to external server is in use? 

[Marvin Rhoads]

Syslog messages can be very voluminous, especially on firewalls. For that reason we prefer udp, a connectionless protocol, as it does not require the tcp 3-way handshake and related overhead. Normally we only see tcp-based syslog in environments with very strict compliance requirements that mandate all connections be logged and, if logs are not verified, to block traffic.

External logging and local logging can co-exist if so configured.

[CiscoPurpleBelt]

Yes that is correct, requirements are to use TCP.

[MHM Cisco World]

Also, are local logs still logged in the FTD even if logging to external server is in use?  local log depend on buffer size and I think if you config is as max size still it so small compare to external Syslog. 
TCP Syslog configuration on the ASA device - Cisco Community

[CiscoPurpleBelt]

Thanks. Per that link, does the Firepower FTD (FTD code) stop allowing new connections when the syslog becomes unavailable as well?

[Marvin Rhoads · Accepted solution]

@CiscoPurpleBelt there is a default check box in the platform settings for syslog server that says "Allow users traffic to pass when TCP syslog server is down". If you uncheck that box and apply that platform settings with a tcp syslog server, new connections will be blocked it the configured syslog server is unavailable.

This is equivalent to the ASA command "no logging permit-hostdown".