cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
366
Views
0
Helpful
1
Replies
Participant

Firepower FMC Connection Events database size

My connection event database has only 158000 rows (I assume this means connections) covering only a 12 minute period of time, even though under System - Configuration - Database I have this set to 1,000,000 events.

Why am I not able to store more connections in the FMC than I am currently?

Thanks.

NM

1 REPLY 1
Cisco Employee

Re: Firepower FMC Connection Events database size

Keep in mind that the database takes into considerations all events (IPS, File, Network Discovery, etc.) and not just connection events. Check those as well and see if the math adds up. In general, it is a good practice to get a SIEM solution such as Splunk and utilize the eStreamer to punt events to it. 

Thank you for rating helpful posts!