Here is a basic step by step walkthrough on how to log Anyconnect VPN connections with FDM and FTD to a syslog server.
First, find out the syslog level that you want going to your syslog server. For example, I am using "Critical", so I will use that in this example.
1) Go to "Objects" -> "Event List Filters"
2) Click the "+" next to "Add a new Event List Filter"
3) Give the filter a name, such as "syslog-critical-withvpn"
4) Click the "+" next to "Severity and Log Class", choose "Critical", and click "OK"
5) Click "Please select Log Class" and checkmark the desired classes (I checkmarked all of them)
6) In the "Syslog Range / Message ID", enter "109201-109203"
7) Click "Add Another Syslog Range / Message ID" and enter "716001 - 716002"
8 Click "OK" to add the new filter
9) Click "Device: DeviceName" -> "Logging Settings"
10) Under "Syslog Servers", if you haven't added your server yet, click the "+" and add your server
11) Under "Message Filtering for Firepower Threat Defense", click "Custom Logging Filter" and choose "syslog-critical-withvpn"
12) Click "SAVE"
13) Deploy the changes
The secret here is the custom logging filter. The documentation is not clear whether the syslog level combines with the MessageID range, or filters by the MessageID range.
The answer is it COMBINES with the MessageID range, so you can have both!
(The FDM only allows you to pick only one custom filter for the syslog server, so that's why it is important to be able to do this)
And now you now have an easy way to add further Message Id's for syslogging, by simply going to edit the custom filter and adding more sets of Message Id's!
Here is a list of available syslog message ID's to pick from:
https://www.cisco.com/c/en/us/td/docs/security/firepower/Syslogs/b_fptd_syslog_guide.html
