cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2333
Views
5
Helpful
1
Replies

Firepower Management Center connection event storage

l.buschi
Level 2
Level 2

A costumer of mine would like to check the firepower managemnt center storage capacity fon connection event.

How can I check the amount of event stored per day?

He would like to store 1 years event logs complete with users activity. 

how can I check the daily amount of stored logs in terms of megabytes?

Is there a way to set a policy to manage internal storage.

how can I store old event?

Thank you all for you help.

johnny

 

1 Reply 1

Marvin Rhoads
Hall of Fame
Hall of Fame

If you are logging all connections, then no Firepower appliance is going to have the capacity for a year's worth of events on anything but the smallest network. The high end appliance can store 1 billion events but a medium size network an generate that in as little as a month.

 

Here's a reference to the appliance limits and how to configure the database allocation for event types:

 

https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/system_configuration.html#concept_C94E9492C76E4CCC9100B3139C7CF771

 

A given connection event consumes about 700 bytes per event on average, but that is highly variable. If you do the math and map that against the appliance types, the resultant database size is (roughly) between 33 and 652 GB on the FMC (FMCv vs. high end FMC 4500 appliance). cisco does not allow you to change the overall database sizes - only allocate among the various event types (connection, intrusion, file, security intelligence etc.).

 

Unless there's a specific legal or regulatory requirement, few organizations really need to store more than a couple days worth of connection events. If you really need to do that, then I suggest looking into a third party tool like Splunk (consume vents via eStreamer) or one of the open source syslog management solutions like Graylog or ELK Logstash (consume events as syslog messages).

Review Cisco Networking for a $25 gift card