topic Firepower 8250 Drain of unprocessed events from Connection Events in Network Security

Firepower 8250 Drain of unprocessed events from Connection Events

CSC011240286 — Fri, 21 Feb 2020 14:23:33 GMT

Hi There

We have the below critical alert from one of our sourcefire devices it comes and goes.

Drain of unprocessed events from Connection Events.

Any ideas would be appreciated.

yogdhanu — Sun, 08 Oct 2017 08:32:54 GMT

Hello there,

Check if this older post is related to your problem.

CSC011240286 — Wed, 11 Oct 2017 10:00:50 GMT

Hi Yogdhanu

I take it the below answer from Claudiu Cismaru posted on the forum is correct?

If the FP module is configured to send the events to FMC, then you could have:

- pretty slow connection between the module and FMC and a high number of generated connection events, which are lagged behind

- hung process on FMC which receive the events. There were some bugs related on this.

What's the sensor and FMC version?