I did some searches here to see whether I could get any hits on Cisco Firepower Management Center - none.
I’m using the latest 18.104.22.168 (build 51) and wanted to send syslog stream to my existing Graylog 2.1.0+62db7e0, codename Smuttynose, which otherwise is receiving ton of logs from all over the place and I know it’s good and functioning correctly.
I was surprised to find that Graylog can not receive anything at all from FirePOWER. I figured it’s some simple on the Cisco end (like syslog not being enabled correctly) but there - the setup is just too simple. As a test I directed the syslog stream to Splunk and the logs show up just as expected. So I know the device is sending syslog just fine.
So I’m probably missing something about troubleshooting this on the Graylog side. If I go to inputs and watch all incoming traffic I do not see anything at all from the FP source. How can I troubleshoot this? It seems Graylog is rejecting the stream for some reason. What could that be? The format?
I even did “create extractor” in a hope to capture the incoming message from FP and “see” it but just as before - nada, no messages at all.