cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
4142
Views
10
Helpful
1
Replies

Module Disk Usage: Drain of unprocessed events from Unified Low Priority Events. !!

adel.slimi
Level 1
Level 1

hello ,

please i have an alert message in my FMC 6.2.2 from the FTD 

Module Disk Usage: Drain of unprocessed events from Unified Low Priority Events.

 

any one can help me with this  ? !

 

THNX

1 Reply 1

miculp
Cisco Employee
Cisco Employee

This generally means that you're logging too much, and this can be typical with a virtual FMC with many sensors registered to it. I would start by pruning back what you're logging, by keeping what's important to the business or critical for operations. If this doesn't alleviate your problem then I would suggest you reach out to TAC assuming you have a support contract. The thing to be aware of, drops, SI, malware or Snort events are not included in the events that "drained" due to prioritization of the disk manager. Typically, low-priority events such as accepts will be affected.

 

Things you can do to alleviate some of this is "inspect but not log" traffic. Should a nefarious thing occur, that will be logged but the remaining not malicious traffic will not. DNS is a good example of this. 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card