topic Re: FMC Maximum Events in Network Security

FMC Maximum Events

kroh — Thu, 13 Feb 2025 07:59:22 GMT

Hi,

May I know the default value of the event database for FMC4600 and FMC2700 equipment?
Intrusion event database, connection database, malware event database, etc.
As guide of FMC 7, The official document only specifies the upper limit (maximum) value, but does not mention the default value.

And I want to know the flow that is deleted when the intrusion detection event exceeds the maximum value.

Re: FMC Maximum Events

balaji.bandi — Thu, 13 Feb 2025 09:23:20 GMT

As guide of FMC 7, The official document only specifies the upper limit (maximum) value, but does not mention the default value.

check the below configuration guide :

Specify the maximum number of event records

Consider the minimum and maximum number of records that can be stored in the database. For example, a virtual Firepower Management Center by default stores 10 million events but the maximum number of events is 50 million. Go to System > Configuration > Database to adjust the size to meet your needs.

https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/connection_logging.html

Re: FMC Maximum Events

Aref Alsouqi — Thu, 13 Feb 2025 10:12:50 GMT

I think the default values you see in System > Configuration > Database on any FMC apply to all FMC models. However, the maximum values would change based on model basis.

Re: FMC Maximum Events

kroh — Mon, 17 Feb 2025 02:24:07 GMT

Thank you for your response.

What I want is the value set as the initial value when the FMC4600 and FMC2700 equipment are first booted

Re: FMC Maximum Events

kroh — Mon, 17 Feb 2025 02:25:23 GMT

Thank you for your response.

What I want is the value set as the initial value when the FMC4600 and FMC2700 equipment are first booted.

And I want to know the flow that is deleted when it exceeds the value set in database.

Re: FMC Maximum Events

Aref Alsouqi — Mon, 17 Feb 2025 11:20:37 GMT

Not sure, maby @Rob Ingram or @Marvin Rhoads can help here.

Re: FMC Maximum Events

Marvin Rhoads — Wed, 19 Feb 2025 19:20:57 GMT

I don't know the defaults but they add up not to exceed the overall platform capacity. Those capacities are listed in the data sheet.

They are saved in a first-in, first-out (FIFO) sort of scheme. When the capacity for a given table is exceeded, a periodic job will trim out the oldest ones based loosely on the rate that they are incoming. So you may see the current number exceed the configured limit at times.

"Flows" are never deleted by this process. Only records of events.