1 Reply Latest reply on Jan 2, 2018 9:28 AM by chriscampbell

    LEm with Cisco Firepower / Firesight syslog

    jsgrenon

      Hi,

       

      I have a Cisco Firepower virtual appliance, and try to see log into LEM. I have configure Syslog as I found here : Configure a FireSIGHT System to Send Alerts to an External Syslog Server - Cisco

       

      On the LEM side, I cannot found any log, or information. I try to reconfigure the connector, but without success.

       

      Any one have installed LEM and Firepower.

       

      More info :

       

      Asa with FP module - Connect to Firepower applicance

      Firepower Appliance - Same vlan that ASA, and LEM

       

       

      Regards,

       

      JS

        • Re: LEm with Cisco Firepower / Firesight syslog
          chriscampbell

          JS,

           

          Did you modify the connector to point to the correct log facility?

          In the Sourcefire connector, you should see /var/log/auth.log in the configuration if you set it up the same way as below(Image from the Cisco page you posted above)

          Cisco Syslog config

           

          Another thing to check is that you are receiving logs in the auth.log folder.

          Open a SSH session(cmc login) or VMWare console to the LEM.

          Type appliance and then checklogs.

          Type the number to select the auth.log file and see if it contains anything from the sourcefire device.

          If your are still running into the issue, feel free to reach out to us in support!

           

          Thanks,

          Chris