Event log limitation?

Tyler N — Tue, 12 Mar 2019 13:17:19 GMT

We are running Cisco Firepower Management Center (v6.1.0.1 build 53).

While reviewing Connections->Events, we are having difficulty reviewing entries older than an hour or so (or perhaps it's based on # of items). For example at 1:20pm EST we view Connection Events with the filter “Block” and for a specific device. Upon going to page 2, there are no events beyond 12:18pm EST. This occurs with various filters and views.

Is there a limitation on this size or documentation on the specifics?

Thank you.

The Firepower Management

Rahul Govindan — Fri, 10 Feb 2017 20:54:04 GMT

The Firepower Management center has a default limit of 1 million events, after which it is overwritten. Also, depending on your logging setting, events might be logged twice, causing older logs to be overwritten. Try increasing it to a higher value based on the type of FMC in your environment. The limits are given in the doc here:

http://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118012-troubleshoot-firesight-00.html

Also, the above guide should help explain how events may be logged twice (beginning and end of a connection) or not logged at all.

topic Event log limitation? in Network Security

Event log limitation?

The Firepower Management