FMC Events Time Frame frozen at 30ish minutes !?

[ida71]

I have a HA pair of FMC 1600 appliances & all has been well until last week, when the Analysis/Connection/Events view, stopped responding to changes in the event view time selection. The default is the last 1hr, but it only shows the last 30-40 minutes of events.  I can change the setting to sliding or fixed time frame, but it still only shows this very short window, or nothing if the time frame  selected is older than that.  I know there are events logged as I can leave it & watch it refresh every 5 minutes & the older events slide out of the screen view.

Strangely the Intrusion events which share the timeline selection, work fine, so set time to be the last week & I see a list of intrusion events for the last week, but the events view stays stuck on 30-40 minutes !

I have tried different browsers, Firefox/IE/Chrome on two different servers, one of which was just rebooted with the latest Window security updates & the effect is the same.

Anyone come across this ?  Anyone have a fix ?  I have it logged out with TAC, but they are not seeing anything in the support files.

Thanks

Chris.

[Marius Gunnerud · Accepted solution]

You can increase the buffer by going to System > Configuration > Database and you can increase the Event limit.  I normally increase this to 1,000,000 (on fmc2500) but you can increase it what you require.  Just keep in mind that this can have an impact on storage and possibly performance on the FMC if you increase it too much.

https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/system_configuration.html#concept_C94E9492C76E4CCC9100B3139C7CF771

[ida71]

Thanks Marius, TAC came back with the same conclusion. My only concern is what increased the login level so much that 1M was not enough. I'll check what has upped the log entries & see what's what.