topic Re: Firepower Management Center 6.1 viewing events limited to 25 rows in Network Security

Firepower Management Center 6.1 viewing events limited to 25 rows per page

Lee Dress — Fri, 21 Feb 2020 13:59:01 GMT

is there a way to increase the number of rows on the analysis events pages?

every page in FMC Analysis (connection, file, etc) seems to be limited to 25 rows per page.

I need to inspect about 68,000 rows of connection events from a device that was infected with adware. I don't want to look at 2700 pages.

I'd like to see maybe 100 rows per page, or more.

clicking "view all" at the bottom of the page does nothing.

I've attached a snapshot to explain what I'm talking about.

Thanks,

Lee

Bad news...So far there is no

Pranay Prasoon — Thu, 22 Dec 2016 06:25:11 GMT

Bad news...So far there is no way to see more than 25 events at once on FMC events page.

I guess the best option is to

Pranay Prasoon — Thu, 22 Dec 2016 06:27:09 GMT

I guess the best option is to send all events on syslog server and then customize it on excel sheet the way you want to view the details.

if you click on "report

Lee Dress — Wed, 11 Jan 2017 16:35:37 GMT

if you click on "report designer" on the page in question and generate a report, it will show all events. so it can be done. Thanks for the help.

Re: Firepower Management Center 6.1 viewing events limited to 25 rows per page

Warbs — Tue, 10 Oct 2017 14:44:54 GMT

Currently on 6.2.2 and still have the same (annoying) restriction unless I am missing something.

Re: Firepower Management Center 6.1 viewing events limited to 25 rows per page

Marvin Rhoads — Tue, 10 Oct 2017 15:39:46 GMT

The setting can be changed per user as shown in the screenshots below. Click on your username in the upper right of the FMC GUI and then "User Preferences > Event View Settings". The maximum you can set is 1000 events per page.

Re: Firepower Management Center 6.1 viewing events limited to 25 rows per page

pro_engineering — Tue, 25 Sep 2018 15:17:08 GMT

This is awesome!!

One more thing, when we search for connection events - is there any way to See total number of rows at the end instead of this message "Displaying rows 1–500 of many rows". I would like to see total number of rows instead of it saying "many rows".

Any heads up would be highly appreciated!

Re: Firepower Management Center 6.1 viewing events limited to 25 rows per page

Marvin Rhoads — Tue, 25 Sep 2018 15:43:54 GMT

@pro_engineering,

You're welcome.

I do recall seeing the "many rows" previously on some FMCs. Are you seeing it on a recent release still? I'm looking at one right now (Release 6.2.3.5 running on an FMC 1000 hardware appliance) with 1,268,178 rows and it shows the full number.

Update - I do see it when I do a filtered search. I think they don't calculate the total number of hits when you filter the search.

Re: Firepower Management Center 6.1 viewing events limited to 25 rows per page

pro_engineering — Wed, 26 Sep 2018 13:32:58 GMT

Exactly i am running 6.2.3.4, and yeah makes sense, when i search for general connection events - shows total number but for filtered search same thing "many rows".

Re: Firepower Management Center 6.1 viewing events limited to 25 rows per page

Ciscouser1! — Mon, 29 Apr 2019 10:06:51 GMT

Hi. I'm just enquiring if its possible to view logs older than 24 hours?

I don't seem to be able to see logs older than that. Can I change to view to see older logs?

Thanks in advance

Re: Firepower Management Center 6.1 viewing events limited to 25 rows per page

pro_engineering — Mon, 29 Apr 2019 16:19:44 GMT

It depends on your FMC. If it is Virtual FMC and you have set the max limit of Connection Events under Connection Database.

That being said, "A virtual FMC is limited by design to 10 million events total. See Table 3 of the product data sheet for confirmation: http://www.cisco.com/c/en/us/products/collateral/security/firesight-management-center/datasheet-c78-736775.html

That includes 2 million Connection Events and 1 million each of various other types of events as shown in your FMC under System > Configuration > Database. You can change the relative allocations and even go so far as to allocate all 10 milion records to connections events. But the overall database size is not configurable nor is the amount of disk allocated to the VM."

- https://community.cisco.com/t5/intrusion-prevention-and/connection-events-and-storage-size/td-p/3006514

Find more information over here:

https://community.cisco.com/t5/firepower/increase-database-limits-virtual-fmc/td-p/3016872

So if you are on your max connection event limit and you are still not able to see the events, then you may have to switch to the Physical FMC.

Hope this helps

Re: Firepower Management Center 6.1 viewing events limited to 25 rows

zufayri — Thu, 18 Jan 2024 09:47:39 GMT

Hi Marvin,

I have do your guide from 20 to 100 but it still not reflect and still same. May I know what I do wrong?

Still displaying 1-20

Re: Firepower Management Center 6.1 viewing events limited to 25 rows

Marvin Rhoads — Thu, 18 Jan 2024 12:46:54 GMT

Please note the setting is specific per user.

Which view are you seeing only 20 rows shown? What version of FMC is this?

Re: Firepower Management Center 6.1 viewing events limited to 25 rows

zufayri — Thu, 18 Jan 2024 12:51:48 GMT

Sorry I just saw it for event what I show you is at Object Management for Network tab. But can the object network display more than 20?

Re: Firepower Management Center 6.1 viewing events limited to 25 rows

Marvin Rhoads — Thu, 18 Jan 2024 13:09:33 GMT

Object display is limited to 20 per screen. The user settings only affect Event displays.

If you want to see all objects associated with a given Access Control Policy (ACP), you can export the ACP as a PDF from the ACP top level page. The PDF will list every referenced object and its value (among other things).

Re: Firepower Management Center 6.1 viewing events limited to 25 rows

zufayri — Thu, 18 Jan 2024 13:17:49 GMT

Hi Marvin, May i know where to export the ACP to PDF? I dont fine the ACP top level page from my FMC

Re: Firepower Management Center 6.1 viewing events limited to 25 rows

Marvin Rhoads — Thu, 18 Jan 2024 13:29:29 GMT

@zufayri see here: