Cisco ASA FireSight Management Center Logs overwriting issues

[amalmichaelvj]

Hello team,

I have installed Cisco ASA5545 with Firepower Services.Firepower is managed via FMC.

My issues are my old  logs in fmc are overwriting with news logs after 1 month.I need logs for atleast one year.

HOw Can i accomplich that?

[nspasov]

Hi there! Here are my questions/suggestions:

1. What model FMC are you running on your network? The amount of logs that can be retained depends on the model. For more info on that you can reference the Data Sheet below:

http://www.cisco.com/c/en/us/products/collateral/security/firesight-management-center/datasheet-c78-736775.html

2. If you need longer log retention and you don't want to invest in another solution then you will need to get a bigger FMC appliance

3. If you are able to invest in another solution then you should explore a SIEM solution that you can use to offload to logs to. I am a huge fan of Splunk as it is very easy to deploy and use. It is not cheap but it is a very good product. They also offer a free version that will index up to 500MBs per day. On the top of that there are tons of apps that were written for specific products (Cisco, Palo Alto, etc). There are other vendors out there...Splunk happens to be my favorite :)

I hope this helps!

Thank you for rating helpful posts!