FireSight logs

[kashifglobal12]

Hello All,

I have one fmc on which 5 sourcefire is added. My question is how many logs can fmc Store from each sourcefire. And if we have external syslog server which retrieve logs from fmc does this effect reporting on fmc because all the events like user activity, malware and etc will be maintain in external syslog server?

Thank you.... 

[mikael.lahtela]

Hi,

FMC has a shared database for different logging.
You can find the number of event logged under System>Configuration>Database.
Here you can find the limitations:
https://www.cisco.com/c/en/us/products/collateral/security/firesight-management-center/datasheet-c78-736775.html?cachemode=refresh

Not sure about what you are thinking about the syslog vs reporting, can you elaborate on that?

br, Mikael

[kashifglobal12]

Hi Mikael,

What i thinking is that fmc make reports(Dashboard, overview) on basis of
logs created as events. right ! So if we maintain logs or events on
external syslog server will this effect reporting or dashboard information
because logs are maintaining not on fmc but on external syslog server?

[mikael.lahtela]

Hi,

The reports will only show what is logged in the fmc database.
It will not keep track on what has been sent to an external syslog.

br, Mikael