cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
46334
Views
56
Helpful
35
Replies

Drain of unprocessed events from Connection Events - Appear on my Sourcefire

pongsiri_chu
Level 1
Level 1

Hi all, 

Have your ever got error "Drain of unprocessed events from Connection Events" on your device? I look on my FMC and it show this error on my sourcefire module. I tried to search this error on internet but didn't found any issue like this. Please help

noted : I check disk free space, both are fine.

35 Replies 35

Claudiu Cismaru
Cisco Employee
Cisco Employee

If the FP module is configured to send the events to FMC, then you could have:

- pretty slow connection between the module and FMC and a high number of generated connection events, which are lagged behind

- hung process on FMC which receive the events. There were some bugs related on this.

What's the sensor and FMC version?

Hi Claudiu,

Thanks for reply FMC version is 6.1.0.1

Do you use file policies?

Yes just 1 policy for torrent file.

jwornstaff
Level 1
Level 1

Did you ever get this resolved? I getting same error after upgrading from 6.0.x to 6.1.x.

fescobar48
Level 1
Level 1

Was this issue resolved?  we have the same issue, we are on 6.1.0.  We open a TACs, but cisco hasn't provided a solution yet. Thinking of going to 6.2.x cause of many more other non related issues.

I had multiple issues  including the one you mentioned when upgrading from 6.0 to 6.1 that I lost track of most of the fixes and not sure which one thing fixed the issue.

But here are several things I did: 

I patched all the way up to 6.1.02-57 for both FMC and my SFR sensor module, then I applied a Hotfix of 6.1.3-1 and then the next day there was another patch of 6.1.0.3-57 which I applied.

I also cleaned up/deleted all the old upgrade patches, VDBs, rules, etc, and purged excess data, logs, and backups.

Using the following link for example:

https://www.speaknetworks.com/cisco-firepower-high-disk-space-utilization/

There is also a bug note of this problem but I don't think I implement the workaround, I belive the patching and purging of files did the trick.

Here is link to bug.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuz86604/?referring_site=bugquickviewredir

thanks jwornstaff!

We implemented the workaround that was in bug (CSCuz86604) and that stop the alerting.

Soon we will be upgrading to 6.2 and hopefully the many other bugs we have.

I had this error and so I began to delete the updates and VDBs that were applied previously and no longer required and during this the error cleared. 

ewhite
Level 1
Level 1

We were having lots of issues, including the one above.  TAC advised us to install 6.2.0.  After the 6.2.0 install we have not had the "Drain of unprocessed events from Connection Events".  Try the 6.2.0 updates.

I have 6.2.1 installed and I still get the messages.

Hi,

I have this issue on 6.2.2

br, Mikael

I have 6.2.2 installed and I still get the messages.

Go to the latest and then retest. I'm on 6.2.3.7 I believe
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: