topic Historical logs on FTD 3110 managed by FMC 4700 in Network Security

Historical logs on FTD 3110 managed by FMC 4700

KayaaKashyap — Thu, 04 Jan 2024 05:54:36 GMT

Hi All,

Is there any way to calculate : How much space will be required on SIEM for 1 day/week/month logs generated on FTD 3110 managed by FMC 4700.

Re: Historical logs on FTD 3110 managed by FMC 4700

Ruben Cocheno — Thu, 04 Jan 2024 10:10:17 GMT

@KayaaKashyap

It's difficult to calculate as not aware of the current policies/logging and usage of those. I would suggest producing a baseline of previous past 30 days of logs and use that as your metric, it's not going to be perfect but gives you something to work with.

Re: Historical logs on FTD 3110 managed by FMC 4700

Marius Gunnerud — Thu, 04 Jan 2024 10:37:37 GMT

As Ruben has already mentioned, this is difficult to determine as this will depend on the amount of traffic / connections passing through the firewall. And as time goes by this value will change as the network grows and changes.

Firepower is quite "chatty" and generates more logs than your regular ASA. It also depends on if you only want connection logs or also SNORT and threat intelligence logs. I would recommend setting up filters that will send only the logs you want as this will help you reduce the amount of logs generated and thereby save you some space.

If this is a dedicated syslog server for the FTD installation and you do not know how much traffic you are expecting, you could start out your external syslog server with 250GB of storage and then you could increase this if needed. If the syslog server is shared by other devices, then you will need to take that into account.

Re: Historical logs on FTD 3110 managed by FMC 4700

KayaaKashyap — Thu, 04 Jan 2024 16:30:51 GMT

Thanks @Marius Gunnerud and @Ruben Cocheno 🙂