topic Re: FMC : Warining : Disk Usage : Frequent drain of connection Events in Network Security

FMC : Warining : Disk Usage : Frequent drain of connection Events

sam cook — Fri, 21 Feb 2020 15:48:26 GMT

Hi,

I'm running FMC 6.2.3.1 and I got this warning message :

"Disk Usage : Frequent drain of connection Events"

on one of my FTS also running 6.2.3.1 version.

I found onther subject speaking about this error but it referneced a bug already fixed. I think I'm running the latest version of FTD and FMC so what do you think is the reason ?

Re: FMC : Warining : Disk Usage : Frequent drain of connection Events

mohanB — Fri, 15 Jun 2018 19:22:22 GMT

Applied the solution mentioned here to get rid of the issue for the version not mentioned in the bug also

(https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuz86604/?rfs=iqvred)

if you do show disk-manager , you might see some events storage USED space is close to the maximum storage.

And if you do

> show log-events-to-ramdisk (some firepower models do not have this)

it might be logged to ramdisk which is limited

Doing below will move the logging from ramdisk to SSD

> configure log-events-to-ramdisk disable

Re: FMC : Warining : Disk Usage : Frequent drain of connection Events

Akira Muranaka — Mon, 02 Nov 2020 03:22:01 GMT

Except ASA5512/5515, " configure log-events-to-ramdisk disable" should not be used because it will cause the wear and tears of SSD disk. In addition, "configure log-events-to-ramdisk disable" may not be supported on several platforms.

Almost reason of "Disk Usage : Frequent drain of connection Events" is caused by tremendous connection logging configuration and sessions, or lack of eventing performance of using FTD/FMC. Therefore, either tuning logging configuration or reducing DoS traffic or upgrading FTD/FMC will be solution.

Please see the CSCuz86604 about workaround and limitation in detail.
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuz86604/?rfs=iqvred

The below document is useful for understanding architecture and troubleshooting step.

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/216081-troubleshoot-drain-of-fmc-unprocessed-ev.html

Re: FMC : Warining : Disk Usage : Frequent drain of connection Events

phipse_508122 — Mon, 01 Aug 2022 20:40:28 GMT

Thank you.

I followed the instructions and got the following.