FMC Event Capacity dashboard

[s_SiD_s]

Good day!
I limited events to 7M....but events are still collecting...see screenshot.

Is it ok?

[Mark Elsen]

   - @s_SiD_s                      FYI : https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/system_configuration.html#ID-2258-0000026d
                                                   https://community.cisco.com/t5/network-security/fmc-maximum-events/td-p/5260041

 M.
                                                   

[s_SiD_s]

so, according links, 10M is the top...after that FMC will delete old events?

because a already configured maximum...but it still collecting

[Mark Elsen · Accepted solution]

    - @s_SiD_s                    Indeed  , older events will be purged from the database ,

  M.

[Marvin Rhoads]

The purge of older events is a periodic action, not a real time 1-1 replacement of oldest with newest. Thus you will see the number usually reflect some amount higher than the configured maximum.