Drain of unprocessed events from Connection Events - Appear on my Sourcefire

[pongsiri_chu]

Hi all, 

Have your ever got error "Drain of unprocessed events from Connection Events" on your device? I look on my FMC and it show this error on my sourcefire module. I tried to search this error on internet but didn't found any issue like this. Please help

noted : I check disk free space, both are fine.

[Stepan Vesely]

Hello,

it could be problem with clock in FMC. 

FMC -> System -> Configuration -> Time Synchronization -> Set My Clock (via NTP from) and set IP address of NTP.

Steve 

[tg2000]

we have FMC version 6.6.1-91 and FTD 6.6.1-91.but still  frequently we face  diskuage: Drain of unprocessed events from Connection Events any one who can help us on this issue

[Marvin Rhoads]

I have a customer currently experiencing this on their FMC 6.6.1. TAC initially offered several troubleshooting steps but has now acknowledged it may be a (new) bug that has resurfaced in the current release.

In their case, they had an FMCv that was operating fine for over a year with the managed sensors seeing relatively steady traffic and never encountering the error. It only began after FMC upgrade to 6.6.1. In other (non-bug-related) cases it can be seen when the events per second exceed the capacity of the FMC to process them.

For troubleshooting you can verify if the process in FMC is actually seeing a backlog of events via the following steps:

Log into fmc cli

Esc to root (sudo su)

Run the command “manage_procs.pl”

Enter option 3 and hit enter

Enter option 2 and hit enter

Enter option 0 and hit enter

[dgneo]

For anyone else who might run into this - I just upgraded my FTD 4115 from 6.7.0 to 7.0.2 and ran into this issue. The above steps resolved it for me.

Thanks Marvin!

[steeda]

FMC and FTD 6.6.1 here - same issue. Sensor was fine for 4 years, never a problem until upgrade from 6.3 to 6.6.1. Now this error blowing constantly and there is no actual disk usage or channel problem. What's the fix?

[Marvin Rhoads]

There is a bug in 6.6.1 that may cause this. It is fixed in 6.6.3. I had a customer encounter the bug after upgrading to 6.6.1 and a subsequent upgrade to 6.6.3 did indeed fix it.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvs47365