Firepower Management Center 6.1 viewing events limited to 25 rows per page

[Lee Dress]

is there a way to increase the number of rows on the analysis events pages? 

every page in FMC Analysis (connection, file, etc) seems to be limited to 25 rows per page. 

I need to inspect about 68,000 rows of connection events from a device that was infected with adware. I don't want to look at 2700 pages. 

I'd like to see maybe 100 rows per page, or more.

clicking "view all" at the bottom of the page does nothing.

I've attached a snapshot to explain what I'm talking about.

Thanks,

Lee

[Pranay Prasoon]

Bad news...So far there is no way to see more than 25 events at once on FMC events page.

[Lee Dress]

if you click on "report designer" on the page in question and generate a report, it will show all events. so it can be done. Thanks for the help.

[Pranay Prasoon]

I guess the best option is to send all events on syslog server and then customize it on excel sheet the way you want to view the details.

[Warbs]

Currently on 6.2.2 and still have the same (annoying) restriction unless I am missing something. 

[Marvin Rhoads]

The setting can be changed per user as shown in the screenshots below. Click on your username in the upper right of the FMC GUI and then "User Preferences > Event View Settings". The maximum you can set is 1000 events per page.

[pro_engineering]

This is awesome!! 

One more thing, when we search for connection events - is there any way to See total number of rows at the end instead of this message "Displaying rows 1–500 of many rows". I would like to see total number of rows instead of it saying "many rows". 

Any heads up would be highly appreciated!

[Marvin Rhoads]

@pro_engineering,

You're welcome.

I do recall seeing the "many rows" previously on some FMCs. Are you seeing it on a recent release still? I'm looking at one right now (Release 6.2.3.5 running on an FMC 1000 hardware appliance) with 1,268,178 rows and it shows the full number.

Update - I do see it when I do a filtered search. I think they don't calculate the total number of hits when you filter the search.

[pro_engineering]

Exactly i am running 6.2.3.4, and yeah makes sense, when i search for general connection events - shows total number but for filtered search same thing "many rows". 

[Ciscouser1!]

Hi. I'm just enquiring if its possible to view logs older than 24 hours?

I don't seem to be able to see logs older than that. Can I change to view to see older logs?

Thanks in advance

[pro_engineering]

It depends on your FMC. If it is Virtual FMC and you have set the max limit of Connection Events under Connection Database. 

That being said, "A virtual FMC is limited by design to 10 million events total. See Table 3 of the product data sheet for confirmation: http://www.cisco.com/c/en/us/products/collateral/security/firesight-management-center/datasheet-c78-736775.html

That includes 2 million Connection Events and 1 million each of various other types of events as shown in your FMC under System > Configuration > Database. You can change the relative allocations and even go so far as to allocate all 10 milion records to connections events. But the overall database size is not configurable nor is the amount of disk allocated to the VM." 

- https://community.cisco.com/t5/intrusion-prevention-and/connection-events-and-storage-size/td-p/3006514

Find more information over here:

https://community.cisco.com/t5/firepower/increase-database-limits-virtual-fmc/td-p/3016872

So if you are on your max connection event limit and you are still not able to see  the events, then you may have to switch to the Physical FMC.

Hope this helps

[zufayri]

Hi Marvin,

I have do your guide from 20 to 100 but it still not reflect and still same. May I know what I do wrong?

Still displaying 1-20

[Marvin Rhoads]

Please note the setting is specific per user.

Which view are you seeing only 20 rows shown? What version of FMC is this?

[zufayri]

Sorry I just saw it for event what I show you is at Object Management for Network tab. But can the object network display more than 20? 

[Marvin Rhoads]

Object display is limited to 20 per screen. The user settings only affect Event displays.

If you want to see all objects associated with a given Access Control Policy (ACP), you can export the ACP as a PDF from the ACP top level page. The PDF will list every referenced object and its value (among other things).