FMC Maximum Events

[kroh]

Hi,

May I know the default value of the event database for FMC4600 and FMC2700 equipment?
Intrusion event database, connection database, malware event database, etc.
As guide of FMC 7, The official document only specifies the upper limit (maximum) value, but does not mention the default value.

And I want to know the flow that is deleted when the intrusion detection event exceeds the maximum value.

[balaji.bandi]

As guide of FMC 7, The official document only specifies the upper limit (maximum) value, but does not mention the default value.

check the below configuration guide :

Specify the maximum number of event records

Consider the minimum and maximum number of records that can be stored in the database. For example, a virtual Firepower Management Center by default stores 10 million events but the maximum number of events is 50 million. Go to System > Configuration > Database to adjust the size to meet your needs.

https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/connection_logging.html

[kroh]

Thank you for your response.

What I want is the value set as the initial value when the FMC4600 and FMC2700 equipment are first booted

[Aref Alsouqi]

I think the default values you see in System > Configuration > Database on any FMC apply to all FMC models. However, the maximum values would change based on model basis.

[kroh]

Thank you for your response.

What I want is the value set as the initial value when the FMC4600 and FMC2700 equipment are first booted.

And I want to know the flow that is deleted when it exceeds the value set in database.

[Aref Alsouqi]

Not sure, maby @Rob Ingram or @Marvin Rhoads can help here.

[Marvin Rhoads]

I don't know the defaults but they add up not to exceed the overall platform capacity. Those capacities are listed in the data sheet.

They are saved in a first-in, first-out (FIFO) sort of scheme. When the capacity for a given table is exceeded, a periodic job will trim out the oldest ones based loosely on the rate that they are incoming. So you may see the current number exceed the configured limit at times.

"Flows" are never deleted by this process. Only records of events.