Have your ever got error "Drain of unprocessed events from Connection Events" on your device? I look on my FMC and it show this error on my sourcefire module. I tried to search this error on internet but didn't found any issue like this. Please help
noted : I check disk free space, both are fine.
If the FP module is configured to send the events to FMC, then you could have:
- pretty slow connection between the module and FMC and a high number of generated connection events, which are lagged behind
- hung process on FMC which receive the events. There were some bugs related on this.
What's the sensor and FMC version?
Was this issue resolved? we have the same issue, we are on 6.1.0. We open a TACs, but cisco hasn't provided a solution yet. Thinking of going to 6.2.x cause of many more other non related issues.
I had multiple issues including the one you mentioned when upgrading from 6.0 to 6.1 that I lost track of most of the fixes and not sure which one thing fixed the issue.
But here are several things I did:
I patched all the way up to 6.1.02-57 for both FMC and my SFR sensor module, then I applied a Hotfix of 6.1.3-1 and then the next day there was another patch of 22.214.171.124-57 which I applied.
I also cleaned up/deleted all the old upgrade patches, VDBs, rules, etc, and purged excess data, logs, and backups.
Using the following link for example:
There is also a bug note of this problem but I don't think I implement the workaround, I belive the patching and purging of files did the trick.
Here is link to bug.
I had this error and so I began to delete the updates and VDBs that were applied previously and no longer required and during this the error cleared.
We were having lots of issues, including the one above. TAC advised us to install 6.2.0. After the 6.2.0 install we have not had the "Drain of unprocessed events from Connection Events". Try the 6.2.0 updates.