topic FMC Event Viewer in Network Security

FMC Event Viewer

fatalXerror — Fri, 21 Feb 2020 17:29:12 GMT

Hi, I would like to ask how long does the FMC hold the logs in its Event Viewer log database? And is it configurable?

Thanks

Re: FMC Event Viewer

Marvin Rhoads — Wed, 11 Sep 2019 12:28:26 GMT

It's not based on time but number of events.

For Connection Events and Security Intelligence events (combined) the upper limit is 50 million on an FMCv (release 6.4) and up to 1 billion on an FMC 4000 series. (We expect this to change in Firepower 6.5 - for the better.) The default is 1 million events. You can easily get that many in just a few hours on a moderate size enterprise if you are logging all connections.

You can see and change the settings in FMC under System > Configuration > Database

Re: FMC Event Viewer

fatalXerror — Wed, 11 Sep 2019 16:35:17 GMT

Hi @Marvin Rhoads, what will happen if it reach the limit? Based on my understanding from you there is no default or automatic purging for the logs in FMC, am I correct? THanks

Re: FMC Event Viewer

Marvin Rhoads — Thu, 12 Sep 2019 11:13:44 GMT

The events "roll over" when you reach the limit. That is, the oldest events are dropped out of the tables to make room for the newest ones.

The only thing in Firepower that doesn't behave this way is host discovery. That's why it's important to properly define your $HOME_NET and $EXTERNAL_NET variables.