Sometimes there are just too many connections in your network and your FMC cannot handle them. Especially virtual FMC is not very good syslog collector (there is limit of connection in DB). FMC is more suitable as a SIEM – all your security events should still be sent to FMC. Cisco FTD eventing design When you want to log all the connection information there will be lots of syslogs, and