Firepower FTD syslog logs increased 10x late last week.

[duckngooser]

We have two Firepower FTD boxes that showed a 10x syslog log increase starting late last week.  The first box went from 18million logs per day to 180million.  Then 2 days later a 2nd box in a different datacenter went from 19 million to over 200 million.  Both have stayed at the current log volume.  In analyzing the logs, it appears the FTD's are logging a ton of "sessions" with a duration of 0.  In some cases, it appears to be logging the same source/dest IP/Port combination on multiple logs.  I have a tac case open, but so far we've yet to hear much analysis.

Just curious if anyone else is having a similar issue.  We're running 7.0.5..

[balaji.bandi]

is this occuring after Upgrade ? check any changes in the ACP rule recently added with Logging in the rule.

[duckngooser]

No changes were made.  No upgrades..  These boxes were in normal operations for years with this configuration.  The only possibly updates were the automated ones for snort, vuln database, etc system "lite" updates.

[Milos_Jovanovic]

Hi @duckngooser,

Have you checked interface graphs? One of the explanations can be increased traffic, which could be visible on graph levels.

Another explanation could be that you have lots of "attacks" (attempts from outside on services which are unavailable), which won't necessarily generate traffic increase, but would stress FW a bit, and would generate syslog for each denied connection. I do see lots of these.

You should do some analysis of files before and after, and to try to determine what kind of events is within those 10x increase. I do realize this is not an easy task, but is the only way to be sure from where the increase comes. E.g. try to filter old log, and start excluding expected stuff such is connection established, connection ended, NAT created, NAT ended, and monitor how much you have other stuff, and then repeat the process with new file. I would expect that you can determine failry quickly which type of events is generating this excess size.

Kind regards,

Milos

[AndresCornetOliva]

Hi!

Did you find anything? I'm experiencing the same thing and on the same FTD version. I've also seen some increased delay in connections, that I think may be related with this. Did you find the reason/solution to this increasing events?