Authentication Attempts Logs On FTD FirePOWER 2130 or FTD Cisco ISA 3000

[PETER AGENGO]

Community,

Has anyone been able to successfully get syslog messages from an FTD device for successful or failed authentication attempts via SSH? I have my FTD appliances (FirePOWER 2130 and FTD Cisco ISA 3000s) sending logs to a remote syslog server. I see the intrusion and acl logs but not user authentication logs. Any feedback would be appreciated. 

[Marvin Rhoads]

@PETER AGENGO thanks for keeping the community updated.

[PETER AGENGO]

Worked with Cisco Engineers to check out their proposed solution to this issue. The solution will be included in their patch release or maintenance release slated for end of August. 

[Michael Kozak]

After working with support did the original solution work?  

[wnewman1986]

Thanks so much for posting this!  I have been pulling my hair out! I can't believe this isn't a simple feature that would be included on day ONE! 

[pjohannik]

FYI.  This has never been resolved.  Same issues in 7.3.0.  They say the syslog for Authentacation only works when running ASA code.  If running FTD image then you have to look for the SSHD messages.  They have opened a Firestarter Feature Enhancement.