Firepower connection events - timespan to short

[thomas poeckl]

Hello;

I have the problem that the timspn is to shot for analysing connection troubles.

What is a working solution to increase the timespan, or to download the connection event history?

many Thanks, Thomas

[Marvin Rhoads · Accepted solution]

By default FMCv stores 1 million connection events. You can change this settings (subject to the platform limits) under the Configuration > Database menu.

You can alternatively send connection events to an external system like Splunk ($$$) or an ELK stack (free but you have to build it from open source)

[thomas poeckl]

Hello Marvin;

Thanks, exactly what i need.

Greetings, Thomas