FTD's Syslog

[00uq6s92nAQyTe3t35d6]

Hello all,

Would anyone know, if the Syslog message for 430001 to 430005 can be tuned in the FTD/FMC ?

I want to stop sending logging for some of the Connection Event Fields.

Thanks

[balaji.bandi]

Can you confirm tuned means you do not like to send or you like to send ?

You can only send certain message to syslog Look below :

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/200479-Configure-Logging-on-FTD-via-FMC.html

[00uq6s92nAQyTe3t35d6]

Hello,

Correct, I want to keep IDs 430001 to 430005 but tune out some the noise, so it's not sending everything via those log's

On your link - I have seen and read this too, that's what I realised. 

Thanks anyway.  

[balaji.bandi]

Sure now you know how to do, goog stuff..!

[dp@sig4]

What are logging to? Syslog does indeed create a lot of noise. If you are using Splunk, it is not recommended to use syslog. Use eStreamer.