1 Reply Latest reply on Jan 2, 2018 9:28 AM by chriscampbell

    LEm with Cisco Firepower / Firesight syslog




      I have a Cisco Firepower virtual appliance, and try to see log into LEM. I have configure Syslog as I found here : Configure a FireSIGHT System to Send Alerts to an External Syslog Server - Cisco


      On the LEM side, I cannot found any log, or information. I try to reconfigure the connector, but without success.


      Any one have installed LEM and Firepower.


      More info :


      Asa with FP module - Connect to Firepower applicance

      Firepower Appliance - Same vlan that ASA, and LEM






        • Re: LEm with Cisco Firepower / Firesight syslog



          Did you modify the connector to point to the correct log facility?

          In the Sourcefire connector, you should see /var/log/auth.log in the configuration if you set it up the same way as below(Image from the Cisco page you posted above)

          Cisco Syslog config


          Another thing to check is that you are receiving logs in the auth.log folder.

          Open a SSH session(cmc login) or VMWare console to the LEM.

          Type appliance and then checklogs.

          Type the number to select the auth.log file and see if it contains anything from the sourcefire device.

          If your are still running into the issue, feel free to reach out to us in support!