Cisco FTD lost connection to FMC, what will happen to the IPS eventlog

[Freemen]

lets say FMC down for 1 day, after FMC up, will the 1 day event send back to FMC? 

will it have any datalost?

[tvotna · Accepted solution]

Unified event files can be overwritten, because they have size limit. Refer to this article for details:

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/admin/710/management-center-admin-71/health-troubleshoot.html#Cisco_Reference.dita_36fffa99-f454-48e1-bc2e-ea49250b08cd

[Freemen]

Thanks for the info

[Marvin Rhoads]

As implied by @tvotna , yes. You will most likely lose a record of events as the FTD device is not designed to store a large number of events locally.

[Wonxie]

You will most likely lose a record of events as the FTD device is not designed to store a large number of events locally.

so does it storoes some ? how much ? will they be sent back to fmc when its up ?

[tvotna]

On managed devices events are stored in files. Yes, events are sent to FMC when connectivity between managed device and FMC is restored, unless events are drained from files, if the number of events exceeds certain limit. Different event types have different limits. Use "show disk-manager" and this article for explanations:

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/216081-troubleshoot-drain-of-fmc-unprocessed-ev.html