cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
10991
Views
30
Helpful
26
Replies
Beginner

Drain of unprocessed events from Connection Events - Appear on my Sourcefire

Hi all, 

Have your ever got error "Drain of unprocessed events from Connection Events" on your device? I look on my FMC and it show this error on my sourcefire module. I tried to search this error on internet but didn't found any issue like this. Please help

noted : I check disk free space, both are fine.

26 REPLIES 26
Cisco Employee

If the FP module is

If the FP module is configured to send the events to FMC, then you could have:

- pretty slow connection between the module and FMC and a high number of generated connection events, which are lagged behind

- hung process on FMC which receive the events. There were some bugs related on this.

What's the sensor and FMC version?

Beginner

Hi Claudiu,

Hi Claudiu,

Thanks for reply FMC version is 6.1.0.1

Cisco Employee

Do you use file policies?

Do you use file policies?

Beginner

Yes just 1 policy for torrent

Yes just 1 policy for torrent file.

Beginner

Did you ever get this

Did you ever get this resolved? I getting same error after upgrading from 6.0.x to 6.1.x.

Beginner

Was this issue resolved?  we

Was this issue resolved?  we have the same issue, we are on 6.1.0.  We open a TACs, but cisco hasn't provided a solution yet. Thinking of going to 6.2.x cause of many more other non related issues.

Highlighted
Beginner

I had multiple issues 

I had multiple issues  including the one you mentioned when upgrading from 6.0 to 6.1 that I lost track of most of the fixes and not sure which one thing fixed the issue.

But here are several things I did: 

I patched all the way up to 6.1.02-57 for both FMC and my SFR sensor module, then I applied a Hotfix of 6.1.3-1 and then the next day there was another patch of 6.1.0.3-57 which I applied.

I also cleaned up/deleted all the old upgrade patches, VDBs, rules, etc, and purged excess data, logs, and backups.

Using the following link for example:

https://www.speaknetworks.com/cisco-firepower-high-disk-space-utilization/

There is also a bug note of this problem but I don't think I implement the workaround, I belive the patching and purging of files did the trick.

Here is link to bug.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuz86604/?referring_site=bugquickviewredir

Beginner

thanks jwornstaff!

thanks jwornstaff!

We implemented the workaround that was in bug (CSCuz86604) and that stop the alerting.

Soon we will be upgrading to 6.2 and hopefully the many other bugs we have.

Participant

Re: I had multiple issues

I had this error and so I began to delete the updates and VDBs that were applied previously and no longer required and during this the error cleared. 

Beginner

We were having lots of issues

We were having lots of issues, including the one above.  TAC advised us to install 6.2.0.  After the 6.2.0 install we have not had the "Drain of unprocessed events from Connection Events".  Try the 6.2.0 updates.

Participant

Re: We were having lots of issues

I have 6.2.1 installed and I still get the messages.

Enthusiast

Re: We were having lots of issues

Hi,

I have this issue on 6.2.2

br, Mikael
Beginner

Re: We were having lots of issues

I have 6.2.2 installed and I still get the messages.

Participant

Re: We were having lots of issues

Go to the latest and then retest. I'm on 6.2.3.7 I believe