FMC 2500

[watson.james796@gmail.com]

Is there a way to view the software update history from  the Cisco FMC GUI?

[Marvin Rhoads · Accepted solution]

You can possibly sort them out from the Audit log. It would be much easier though to go into the cli (expert mode) and look at the folders in /var/log/sf. FMC (and FTD devices as well) creates a new folder every time and upgrade is run. The update folders are Cisco* since version 6.3 and Sourcefire* before that.

Here's my FMC, for example (lovingly maintained since 2014!):

admin@sfvdc:/var/log/sf$ ls -al | grep Sourcefire            
drwxr-xr-x  13 root root     4096 Aug 29  2016 Sourcefire_3D_Defense_Center_S3_6.1.0_Pre-install-6.0.1.999
drwxr-xr-x  13 root root     4096 Apr  3  2016 Sourcefire_3D_Defense_Center_S3_Hotfix-6.0.1.1
drwxr-xr-x  14 root root     4096 Feb 17  2017 Sourcefire_3D_Defense_Center_S3_Hotfix_A-6.2.0.1
drwxr-xr-x  13 root root     4096 Jun  2  2014 Sourcefire_3D_Defense_Center_S3_Patch-5.3.0.1
drwxr-xr-x  13 root root     4096 Oct 23  2014 Sourcefire_3D_Defense_Center_S3_Patch-5.3.1.1
drwxr-xr-x  13 root root     4096 Mar  7  2015 Sourcefire_3D_Defense_Center_S3_Patch-5.3.1.2
drwxr-xr-x  13 root root     4096 Mar  7  2015 Sourcefire_3D_Defense_Center_S3_Patch-5.4.1
drwxr-xr-x  14 root root     4096 May 22  2015 Sourcefire_3D_Defense_Center_S3_Patch-5.4.1.1
drwxr-xr-x  14 root root     4096 Jul 28  2015 Sourcefire_3D_Defense_Center_S3_Patch-5.4.1.2
drwxr-xr-x  14 root root     4096 Oct  5  2015 Sourcefire_3D_Defense_Center_S3_Patch-5.4.1.3
drwxr-xr-x  14 root root     4096 Feb  8  2016 Sourcefire_3D_Defense_Center_S3_Patch-6.0.0.1
drwxr-xr-x  13 root root     4096 Aug 13  2016 Sourcefire_3D_Defense_Center_S3_Patch-6.0.1.1
drwxr-xr-x  15 root root     4096 Jan  9  2017 Sourcefire_3D_Defense_Center_S3_Patch-6.1.0.1
drwxr-xr-x  13 root root     4096 Apr 20  2017 Sourcefire_3D_Defense_Center_S3_Patch-6.2.0.1
drwxr-xr-x  14 root root     4096 Nov 15  2017 Sourcefire_3D_Defense_Center_S3_Patch-6.2.2.1
drwxr-xr-x  15 root root     4096 Mar  1  2018 Sourcefire_3D_Defense_Center_S3_Patch-6.2.2.2
drwxr-xr-x  13 root root     4096 May 29  2018 Sourcefire_3D_Defense_Center_S3_Patch-6.2.3.1
drwxr-xr-x  13 root root     4096 Jun 16  2018 Sourcefire_3D_Defense_Center_S3_Patch-6.2.3.2
drwxr-xr-x  14 root root     4096 Aug  5  2018 Sourcefire_3D_Defense_Center_S3_Patch-6.2.3.3
drwxr-xr-x  14 root root     4096 Aug 15  2018 Sourcefire_3D_Defense_Center_S3_Patch-6.2.3.4
drwxr-xr-x  14 root root     4096 Sep 13  2018 Sourcefire_3D_Defense_Center_S3_Patch-6.2.3.5
drwxr-xr-x  13 root root     4096 Oct 21  2018 Sourcefire_3D_Defense_Center_S3_Patch-6.2.3.6
drwxr-xr-x  14 root root     4096 Nov 16  2018 Sourcefire_3D_Defense_Center_S3_Patch-6.2.3.7
drwxr-xr-x  14 root root     4096 Oct 22  2014 Sourcefire_3D_Defense_Center_S3_Upgrade-5.3.1
drwxr-xr-x  15 root root     4096 Mar  7  2015 Sourcefire_3D_Defense_Center_S3_Upgrade-5.4.0
drwxr-xr-x  14 root root     4096 Nov 23  2015 Sourcefire_3D_Defense_Center_S3_Upgrade-6.0.0
drwxr-xr-x  14 root root     4096 Mar 23  2016 Sourcefire_3D_Defense_Center_S3_Upgrade-6.0.1
drwxr-xr-x  15 root root     4096 Aug 30  2016 Sourcefire_3D_Defense_Center_S3_Upgrade-6.1.0
drwxr-xr-x  14 root root     4096 Feb  1  2017 Sourcefire_3D_Defense_Center_S3_Upgrade-6.2.0
drwxr-xr-x  14 root root     4096 May 18  2017 Sourcefire_3D_Defense_Center_S3_Upgrade-6.2.1
drwxr-xr-x  15 root root     4096 Sep 24  2017 Sourcefire_3D_Defense_Center_S3_Upgrade-6.2.2
drwxr-xr-x  14 root root     4096 May 29  2018 Sourcefire_3D_Defense_Center_S3_Upgrade-6.2.3
drwxr-xr-x  12 root root     4096 May 29  2018 Sourcefire_3D_Defense_Center_S3_Upgrade-6.2.3.1527587355.rollback
admin@sfvdc:/var/log/sf$ ls -al | grep Cisco     
drwxr-xr-x  13 root root     4096 Feb 21  2019 Cisco_Firepower_Mgmt_Center_Patch-6.3.0.1
drwxr-xr-x  13 root root     4096 Apr  8  2019 Cisco_Firepower_Mgmt_Center_Patch-6.3.0.2
drwxr-xr-x  11 root root     4096 May 19  2019 Cisco_Firepower_Mgmt_Center_Patch-6.4.0.1
drwxr-xr-x  12 root root     4096 Jun 28  2019 Cisco_Firepower_Mgmt_Center_Patch-6.4.0.2
drwxr-xr-x  12 root root     4096 Jul 24  2019 Cisco_Firepower_Mgmt_Center_Patch-6.4.0.3
drwxr-xr-x  12 root root     4096 Sep 20  2019 Cisco_Firepower_Mgmt_Center_Patch-6.4.0.4
drwxr-xr-x  12 root root     4096 Sep 20  2019 Cisco_Firepower_Mgmt_Center_Patch-6.4.0.5
drwxr-xr-x  12 root root     4096 Oct 17  2019 Cisco_Firepower_Mgmt_Center_Patch-6.4.0.6
drwxr-xr-x  10 root root     4096 Dec  5  2019 Cisco_Firepower_Mgmt_Center_Patch-6.5.0.1
drwxr-xr-x  10 root root     4096 Dec 22  2019 Cisco_Firepower_Mgmt_Center_Patch-6.5.0.2
drwxr-xr-x  10 root root     4096 Mar  7  2020 Cisco_Firepower_Mgmt_Center_Patch-6.5.0.4
drwxr-xr-x  10 root root     4096 Feb 18  2022 Cisco_Firepower_Mgmt_Center_Patch-7.0.1.1
drwxr-xr-x  14 root root     4096 Dec  6  2018 Cisco_Firepower_Mgmt_Center_Upgrade-6.3.0
drwxr-xr-x  13 root root     4096 Apr 27  2019 Cisco_Firepower_Mgmt_Center_Upgrade-6.4.0
drwxr-xr-x  12 root root     4096 Dec  5  2019 Cisco_Firepower_Mgmt_Center_Upgrade-6.5.0
drwxr-xr-x  13 root root     4096 Oct  6  2021 Cisco_Firepower_Mgmt_Center_Upgrade-6.6.5
drwxr-xr-x  13 root root     4096 Oct  8  2021 Cisco_Firepower_Mgmt_Center_Upgrade-7.0.1
drwxr-xr-x  13 root root     4096 May  7  2022 Cisco_Firepower_Mgmt_Center_Upgrade-7.0.2
drwxr-xr-x  13 root root     4096 Jul  5  2022 Cisco_Firepower_Mgmt_Center_Upgrade-7.0.3
drwxr-xr-x  12 root root     4096 Sep 27  2022 Cisco_Firepower_Mgmt_Center_Upgrade-7.0.4
drwxr-xr-x  11 root root     4096 May 12 17:06 Cisco_Secure_FW_Mgmt_Center_Hotfix_AN-7.2.4.1
drwxr-xr-x  14 root root     4096 Oct  5  2022 Cisco_Secure_FW_Mgmt_Center_Upgrade-7.2.1
drwxr-xr-x  13 root root     4096 Jan 28  2023 Cisco_Secure_FW_Mgmt_Center_Upgrade-7.2.2
drwxr-xr-x  13 root root     4096 May  5 19:18 Cisco_Secure_FW_Mgmt_Center_Upgrade-7.2.4
drwxr-xr-x  13 root root     4096 Jul 31 08:12 Cisco_Secure_FW_Mgmt_Center_Upgrade-7.2.5
admin@sfvdc:/var/log/sf$

[watson.james796@gmail.com]

Hello again Marvin,

I decided to use the CLI to access the log files, my FMC appliance is a 2500 running the Cisco Firepower Extensible Operating System (FX-OS) v2.10.1; I'm getting the following syntax error when applying the below commands:

Is it possible my OS version has a different directory?

[Marvin Rhoads · Accepted solution]

First change directory (cd) to /var/log/sf. Then run the "ls..." command.

[watson.james796@gmail.com]

Thanks Marvin! Looks like it worked I wasn't able to locate any Cisco or Sourcefire files;

I noticed that this FMC 2500 is running a snort rule "Running Snort Rule update version:  2023-01-04-002-vrt"

[Marvin Rhoads · Accepted solution]

So it may have the original FMC version that shipped from the factory and has never been upgraded. (Unless somebody went to the trouble to delete the old directories). Snort rules don't automatically update unless you set them to do so under System > Updates > Rule Updates.

[watson.james796@gmail.com]

Awesome thanks Marvin! I will view the audit log, and great job maintaining that FMC!