cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1555
Views
10
Helpful
3
Replies

FireSIGHT connection event report issue in excel format

i deployed FMC version 6.2.2 which managing FTD appliance  , i am trying to generate report for specific rule with its connection events for last 3 days in excel format but after generating report it give me on the last two hours , i tried to exceed the limit from 10000 to 1000000 but give me same result ? it is limitation in firepower management center or is there another way to exceed it 

1 Accepted Solution

Accepted Solutions

Hello Mohamed,

Normally the time period option from the Report is what is needed to be adjusted along with the Maximum Results.

Report Time Window.png

 

I also have to mention that the FMC, any hardware model, is currently limited to generate a max of 400k Maximum Results. This is a limitation on the system. Thus you would not be able to see 1 million lines on the excel file.

 

Ensure to select the Time Window of 2 hours, then for Maximum Result, no more than 400k. If the report fails, then decrease the amount.

View solution in original post

3 Replies 3

argrullo
Cisco Employee
Cisco Employee

Hello,

 

The issue you are encountering is due to the database limit that is currently set. On a default deployment, the limit is set to 1 million connection events.

 

This limit can be expanded depending on your hardware model of FMC. You can edit it by going to System > Database. If you click on the help icon, you will be able to see the limits for each category.

 

For example a vFMC has a limit of 50 million connection events. Expanding the database can cause performance issues since the FMC now has much more data to correlate and maintain. It is common to see the mysql process become high. Thus to avoid that, if its a vFMC, ensure to dedicate plenty of resources and if you are seeing performance issues, you might need to decrease the limit.

 

There is also the issue that just because you can select 1 week or 1 year, it does not mean that is what the FMC is able to maintain. To find out how much you currently have, go to the connection events, select a timeframe for 1 week, this should load all the events you have. Then note the time in the first row, then click on the first packet hyperlink, this should reverse the sort order and give you the latest time you have. Compare the timeframes, and this is how many hours, or days your FMC can maintain.

it is virtual Management Center and maximum connection event is 1000000 ( 1 Million) , what i am asking is to generate report for last two days with CSV format , it give me only 10000 raw and tried to exceed this limit to 1000000 , the output of the report still 10000 for last two hours , how can i increase it ?

Hello Mohamed,

Normally the time period option from the Report is what is needed to be adjusted along with the Maximum Results.

Report Time Window.png

 

I also have to mention that the FMC, any hardware model, is currently limited to generate a max of 400k Maximum Results. This is a limitation on the system. Thus you would not be able to see 1 million lines on the excel file.

 

Ensure to select the Time Window of 2 hours, then for Maximum Result, no more than 400k. If the report fails, then decrease the amount.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers