topic Re: FMC Critical Alert Disk Usage in Network Security

FMC Critical Alert Disk Usage

401 — Mon, 02 Sep 2024 02:41:13 GMT

Hello Cisco Team,

I would like to inquire about the FMC software that I have integrated with the ASA firewall. There is a critical alert indicating "Frequent drain of Connection Events" related to disk usage. However, when checking the health dashboard, the disk status does not appear to be full or in failure. You can see this in the image below.

Could your team please provide an explanation regarding this issue?

Thank you.

Health statusalert

Re: FMC Critical Alert Disk Usage

Mark Elsen — Mon, 02 Sep 2024 07:13:51 GMT

- FYI : https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwd26466
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuz86604

Re: FMC Critical Alert Disk Usage

Marius Gunnerud — Mon, 02 Sep 2024 22:54:01 GMT

We had this issue previously. It was fixed for us after upgrading to version 7.2.5.

Re: FMC Critical Alert Disk Usage

401 — Tue, 03 Sep 2024 02:07:15 GMT

I am already on version 7.2.5.2. Is there a way to remove or clear those alarms?

Re: FMC Critical Alert Disk Usage

BoomShakaLak — Tue, 03 Sep 2024 07:04:15 GMT

Are you by chance logging ACP rules at both beginning and end ?

Re: FMC Critical Alert Disk Usage

Marvin Rhoads — Tue, 03 Sep 2024 07:28:24 GMT

Your health status screenshot appears to be from your device running FTD. Can you share the health screenshot for FMC including events/second? That is the usual culprit for the error message (which basically says the FMC's ability to write incoming events to the database on disk is overwhelmed). The bug cited by @Mark Elsen are also a possibility. Although they should be fixed in your FMC version, bugs from earlier releases have been known to persist across an upgrade from an affected version.

Re: FMC Critical Alert Disk Usage

401 — Wed, 04 Sep 2024 03:13:10 GMT

this the health screenshot for FMC.

Re: FMC Critical Alert Disk Usage

Marvin Rhoads — Wed, 04 Sep 2024 04:11:15 GMT

The FMC health shows less than 4k events/second (connections, intrusion etc. combined) yet the input rate is constant up around 25 Mbps - that is quite unusually high. Something is send a LOT of data to the FMC for processing but it doesn't look like connection events. Do you possibly have firewall debugging enabled and set via platform policy to send events to FMC?