How to configure syslog on Cisco devices with Firepower Management Center

These instructions assume:

• You’re running Firepower Management Center (FMC) software version 6.2 or higher.
• Firepower Threat Defence (FTD) devices are connected to your FMC device.
• The date, time and time zone are correctly set on the Firepower devices.
• You have login credentials and admin access to your Firepower Management Center.
• The IP address of your Auvik collector is known. You can find this in the Syslog > Summary tab in the Export Information column

Configure syslog

1. Log into your Firepower Managed Center console.
2. Click Devices.
3. Click Platform settings.
4. Navigate to Threat Defense Policy > Syslog > Syslog Servers.
5. Click Add.
6. Select the IP address that corresponds to the host with the Auvik collector. 
7. For Protocol, select UDP.
8. For Port, enter 514. 
9. Click OK and Save to save the configuration.
10. Click Save to save the platform setting. 
11. Select Deploy. Choose the FTD appliance where you want to apply the changes and click Deploy in order to start deployment of the platform setting.

For more information:
https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/200479-Configure-Logging-on-FTD-via-FMC.html