https://community.cisco.com/t5/network-security/firepower-event-backlog/m-p/3379801#M18211 <P>Hi All,</P> <P>&nbsp;</P> <P>Cisco TAC provided workaround, to disable "backlog status" in FMC/Firepower. It also filed this issue as bug (CSCvc89954) and not publish to public. The setting to disable backlog status via System Health policy, select Backlog status and choose disable.</P> Tue, 08 May 2018 06:09:03 GMT Looi Siew Key 2018-05-08T06:09:03Z https://community.cisco.com/t5/network-security/firepower-event-backlog/m-p/2952552#M18144 <P>Updated to version 6.1.0.1-53 and getting "Event Backlog errors". &nbsp;</P> <P></P> <P>Every so often it will pull up a health alert saying:</P> <P></P> <P>"Event backlog has been increasing for 62 Mins. 30 Secs. Current backlog is 1800308383.0mb"</P> <P></P> <P>We are sending event logs to a external ELK stack which I am thinking is what the backlog is. &nbsp;How can I find more information on what exactly the backlog is and where I can clear it.</P> <P></P> <P></P> <DIV role="presentation" class="x-window-bl"> <DIV role="presentation" class="x-window-br"> <DIV role="presentation" class="x-window-bc"> <DIV role="presentation" class="x-window-footer"> <DIV class=" x-panel-btns"></DIV> </DIV> </DIV> </DIV> </DIV> Mon, 12 Dec 2016 15:28:41 GMT https://community.cisco.com/t5/network-security/firepower-event-backlog/m-p/2952552#M18144 tsiemers1 2016-12-12T15:28:41Z https://community.cisco.com/t5/network-security/firepower-event-backlog/m-p/2952553#M18170 <P>The Firepower Management Center sends syslog to external via UDP and would not be contributing to&nbsp;a backlog. If it were sending TCP, which for some reason, is a outstanding feature request, maybe. But that would mean that Logstash was not listing.</P> Fri, 24 Mar 2017 18:07:02 GMT https://community.cisco.com/t5/network-security/firepower-event-backlog/m-p/2952553#M18170 Jason Kopacko 2017-03-24T18:07:02Z https://community.cisco.com/t5/network-security/firepower-event-backlog/m-p/2952554#M18180 Starting getting this message after we set up esteamer... It's a pull from what we understand, but see this event now. Fri, 07 Jul 2017 20:52:03 GMT https://community.cisco.com/t5/network-security/firepower-event-backlog/m-p/2952554#M18180 mng-zahid 2017-07-07T20:52:03Z https://community.cisco.com/t5/network-security/firepower-event-backlog/m-p/3198488#M18194 <P>Were you ever able to resolve this? If so, what was the underlying issue?</P> Fri, 13 Oct 2017 18:33:23 GMT https://community.cisco.com/t5/network-security/firepower-event-backlog/m-p/3198488#M18194 ChiefSec-SF 2017-10-13T18:33:23Z https://community.cisco.com/t5/network-security/firepower-event-backlog/m-p/3311274#M18204 <P>Hi Guys,</P> <P>&nbsp;</P> <P>We have same issue as well, and it happen quite frequent.&nbsp;</P> <P>The backlog message will comes every hour and recover by itself around 5-10min until next hours.</P> <P>&nbsp;</P> <P>Kindly advise.</P> Mon, 15 Jan 2018 08:07:25 GMT https://community.cisco.com/t5/network-security/firepower-event-backlog/m-p/3311274#M18204 Looi Siew Key 2018-01-15T08:07:25Z https://community.cisco.com/t5/network-security/firepower-event-backlog/m-p/3379801#M18211 <P>Hi All,</P> <P>&nbsp;</P> <P>Cisco TAC provided workaround, to disable "backlog status" in FMC/Firepower. It also filed this issue as bug (CSCvc89954) and not publish to public. The setting to disable backlog status via System Health policy, select Backlog status and choose disable.</P> Tue, 08 May 2018 06:09:03 GMT https://community.cisco.com/t5/network-security/firepower-event-backlog/m-p/3379801#M18211 Looi Siew Key 2018-05-08T06:09:03Z https://community.cisco.com/t5/network-security/firepower-event-backlog/m-p/4133536#M1072829 <P>Running 6.4.0.4 and seeing this backlog event build up message.</P><P>CSCvc89954 mentions its fixed in 6.2</P><P>Going to raise a support case</P><P>&nbsp;</P> Tue, 11 Aug 2020 06:18:18 GMT https://community.cisco.com/t5/network-security/firepower-event-backlog/m-p/4133536#M1072829 evan.chadwick1 2020-08-11T06:18:18Z https://community.cisco.com/t5/network-security/firepower-event-backlog/m-p/4135522#M1072972 <P>I'm seeing this issue in 6.4 too. Can you tell us what's the resolution of support case?</P> Thu, 13 Aug 2020 18:27:26 GMT https://community.cisco.com/t5/network-security/firepower-event-backlog/m-p/4135522#M1072972 CatharinaDaherTeixeira0891 2020-08-13T18:27:26Z https://community.cisco.com/t5/network-security/firepower-event-backlog/m-p/4135576#M1072976 <P>Cisco Tac diagnosed it was cosmetic.<BR />CSCvh85504</P><P>effected releases</P><DIV class="affectedInLabel greyRow"><DIV>&nbsp;</DIV></DIV><DIV class="allList"><DIV class="jspContainer"><DIV class="jspPane"><DIV class="whiteRow">6.2.2.1</DIV><DIV class="greyRow">6.2.2.3</DIV><DIV class="whiteRow">6.2.3</DIV><DIV class="greyRow">6.3.0</DIV><DIV class="whiteRow">6.4.0</DIV><DIV class="greyRow">6.5.0</DIV></DIV></DIV></DIV> Thu, 13 Aug 2020 20:03:59 GMT https://community.cisco.com/t5/network-security/firepower-event-backlog/m-p/4135576#M1072976 evan.chadwick1 2020-08-13T20:03:59Z