Event log limitation?

[Tyler N]

We are running Cisco Firepower Management Center (v6.1.0.1 build 53).

While reviewing Connections->Events, we are having difficulty reviewing entries older than an hour or so (or perhaps it's based on # of items). For example at 1:20pm EST we view Connection Events with the filter “Block” and for a specific device. Upon going to page 2, there are no events beyond 12:18pm EST. This occurs with various filters and views.

Is there a limitation on this size or documentation on the specifics?

Thank you.

[Rahul Govindan]

The Firepower Management center has a default limit of 1 million events, after which it is overwritten. Also, depending on your logging setting, events might be logged twice, causing older logs to be overwritten. Try increasing it to a higher value based on the type of FMC in your environment. The limits are given in the doc here:

http://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118012-troubleshoot-firesight-00.html

Also, the above guide should help explain how events may be logged twice (beginning and end of a connection) or not logged at all.