Symptom
Changes via FTD CLI to syslog server, e.g. "configure syslog_server", do not have the desired result. System-level messages (e.g. login/logout messages, as opposed to lina/ACL messages) are being generated locally, but are not being transmitted to remote syslog servers. This is true when CC-mode is enabled and syslog messages must be sent over TLS (with or without mutual authentication), but it may also be true in other configurations.
Conditions
Found on: FTD 6.4.0.1 build 17 running on Firepower 4140.
Workaround
Edit syslog-ng.conf by hand to correct the problem. It's a text file, not too big, TAC could probably handle this pretty easily. Copy the 6.7.0 syslog-ng-ssp.conf file into your syslog-ng.conf file. Otherwise, upgrade to a fixed version is the only other option.
Further Problem Description
Had nothing to do with CC mode. It simply did not work because the syslog-ng-ssp.conf file was incorrect. FTD messages were never being forwarded to lina, and therefore had no chance of ever getting sent to the remote syslog server. Apparently MODELS 77 and 75 were fixed, just not MODEL 76. This fix corrects MODEL 76.
