Cisco Firepower Syslog issue

davidyar · 2019-07-12T20:10:19.896Z

Hi Pheniix, In our deployment we have an standalone FP4110 to run FTD application. I configured platform settings of the FXOS chassis however, I got a validation error when I am trying to configure the Syslog. Here is the error: "Same hostname cannot be configured for multiple external servers" What can I do?

mike.ghahremani

Jul 12, 2019

Hi David, it's most probably a simple bug! Try it out with CLI and forget GUI for a second! :D

Configure via CLI the equivalent of section Local Destinations:

FP4120-A /monitoring # enable syslog console
FP4120-A /monitoring* # set syslog console level critical
FP4120-A /monitoring* # enable syslog monitor
FP4120-A /monitoring* # set syslog monitor level debugging
FP4120-A /monitoring* # commit-buffer

Configure via CLI the equivalent of section Remote Destinations:

FP4120-A /monitoring # enable syslog remote-destination server-1
FP4120-A /monitoring* # set syslog remote-destination server-1 facility local1
FP4120-A /monitoring* # set syslog remote-destination server-1 level debugging
FP4120-A /monitoring* # set syslog remote-destination server-1 hostname 10.61.161.235
FP4120-A /monitoring* # commit-buffer

Configure via CLI the equivalent of section Local Sources:

FP4120-A /monitoring # enable syslog source audits
FP4120-A /monitoring* # enable syslog source events
FP4120-A /monitoring* # enable syslog source faults
FP4120-A /monitoring* # commit-buffer

Additionally, you can enable a local file as a Syslog destination. These Syslog messages can be displayed using the commands show logging or show logging logfile:

FP4120-A /monitoring # enable syslog file
FP4120-A /monitoring* # set syslog file level debugging
FP4120-A /monitoring* # set syslog file name Logging
FP4120-A /monitoring* # commit-buffer