12-25-2016 10:56 PM - edited 03-12-2019 06:14 AM
Hi all,
Have your ever got error "Drain of unprocessed events from Connection Events" on your device? I look on my FMC and it show this error on my sourcefire module. I tried to search this error on internet but didn't found any issue like this. Please help
noted : I check disk free space, both are fine.
01-02-2017 10:46 AM
If the FP module is configured to send the events to FMC, then you could have:
- pretty slow connection between the module and FMC and a high number of generated connection events, which are lagged behind
- hung process on FMC which receive the events. There were some bugs related on this.
What's the sensor and FMC version?
01-04-2017 10:00 PM
01-06-2017 01:59 AM
Do you use file policies?
01-10-2017 07:14 PM
Yes just 1 policy for torrent file.
04-27-2017 04:38 AM
Did you ever get this resolved? I getting same error after upgrading from 6.0.x to 6.1.x.
05-03-2017 08:34 AM
Was this issue resolved? we have the same issue, we are on 6.1.0. We open a TACs, but cisco hasn't provided a solution yet. Thinking of going to 6.2.x cause of many more other non related issues.
05-03-2017 10:17 AM
I had multiple issues including the one you mentioned when upgrading from 6.0 to 6.1 that I lost track of most of the fixes and not sure which one thing fixed the issue.
But here are several things I did:
I patched all the way up to 6.1.02-57 for both FMC and my SFR sensor module, then I applied a Hotfix of 6.1.3-1 and then the next day there was another patch of 6.1.0.3-57 which I applied.
I also cleaned up/deleted all the old upgrade patches, VDBs, rules, etc, and purged excess data, logs, and backups.
Using the following link for example:
https://www.speaknetworks.com/cisco-firepower-high-disk-space-utilization/
There is also a bug note of this problem but I don't think I implement the workaround, I belive the patching and purging of files did the trick.
Here is link to bug.
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuz86604/?referring_site=bugquickviewredir
05-04-2017 07:11 AM
thanks jwornstaff!
We implemented the workaround that was in bug (CSCuz86604) and that stop the alerting.
Soon we will be upgrading to 6.2 and hopefully the many other bugs we have.
12-13-2018 11:58 PM
I had this error and so I began to delete the updates and VDBs that were applied previously and no longer required and during this the error cleared.
05-03-2017 10:24 AM
We were having lots of issues, including the one above. TAC advised us to install 6.2.0. After the 6.2.0 install we have not had the "Drain of unprocessed events from Connection Events". Try the 6.2.0 updates.
09-26-2017 04:04 PM
I have 6.2.1 installed and I still get the messages.
10-17-2017 01:02 AM
12-15-2018 11:52 PM
I have 6.2.2 installed and I still get the messages.
12-16-2018 04:13 PM
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide