Disk Usage Error

[bhamel]

Hello community.  I am receiving the following critical health event on Disk Usage 0 Disk Test Drain of unprocessed events from Unified Low Priority Events.  How do I resolve this issue please?  We are using Firepower 6.1.0  Thank you.

[nspasov]

A couple of suggestions here:

1. Upgrade to 6.1.0-Patch-1 (Or even patch-2). I have not faced the issue that you are having but did have tons of other problems after 1st upgrading to 6.1.0. Things got a lot better after I deployed patch-1. I don't have patch-2 installed yet but I am planning on doing that soon. 

2. Re-run the test and see if the error message clears

I hope this helps!

Thank you for rating helpful posts!

[Saad Abdul Malik]

Hello!

I started having this same issue today, were you able to figure out a solution? Please update. Thank you!

[bhamel]

Unfortunately I don't have a resolution for you.  Our issue cleared itself.

[Jim Jones]

I just started having this today as well. I'm running 6.0.2. Going to try the 6.0.4 install tonight and see if it clears it up.

[ITWhiteRock]

We have this issue as well, ASA 5512-X version 9.7.1(4) and FMC 6.2.0 (build 362). Getting flurries of critical alerts almost every day, usually in the early hours of the morning.

There is a bug logged for this issue:

https://quickview.cloudapps.cisco.com/quickview/bug/CSCuz86604

It says only affecting up to 6.1.0 but I think 6.2.0 is also affected.

Link to other thread in the bug discussion forum:
https://supportforums.cisco.com/discussion/13285706/frequent-drain-connection-event-cscuz86604

Has anyone found a fix / software version combination that works?

[Jetsy Mathew]

Hello TWhiteRock 

This issue that you are seeing is due to the  CSCuz86604.  The symptoms of this bug are Health alerts for "Frequent Drain of Connection Events" that never go away.  This bug is known to affect ASA5512s or ASA5515s running Firepower Services running software version 6.x (6.2) that have Connection Event RAMDISK storage enabled.  As a workaround, we can try running  the  ' configure log-events-to-ramdisk disable ' command.

Rate if this answer helps.

Regards

Jetsy