05-24-2018 06:12 AM - edited 02-21-2020 07:48 AM
Hi,
I'm running FMC 6.2.3.1 and I got this warning message :
"Disk Usage : Frequent drain of connection Events"
on one of my FTS also running 6.2.3.1 version.
I found onther subject speaking about this error but it referneced a bug already fixed. I think I'm running the latest version of FTD and FMC so what do you think is the reason ?
06-15-2018 12:22 PM
Applied the solution mentioned here to get rid of the issue for the version not mentioned in the bug also
(https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuz86604/?rfs=iqvred)
if you do show disk-manager , you might see some events storage USED space is close to the maximum storage.
And if you do
> show log-events-to-ramdisk (some firepower models do not have this)
it might be logged to ramdisk which is limited
Doing below will move the logging from ramdisk to SSD
> configure log-events-to-ramdisk disable
10-22-2020 11:26 PM - edited 11-01-2020 07:22 PM
Except ASA5512/5515, " configure log-events-to-ramdisk disable" should not be used because it will cause the wear and tears of SSD disk. In addition, "configure log-events-to-ramdisk disable" may not be supported on several platforms.
Almost reason of "Disk Usage : Frequent drain of connection Events" is caused by tremendous connection logging configuration and sessions, or lack of eventing performance of using FTD/FMC. Therefore, either tuning logging configuration or reducing DoS traffic or upgrading FTD/FMC will be solution.
Please see the CSCuz86604 about workaround and limitation in detail.
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuz86604/?rfs=iqvred
The below document is useful for understanding architecture and troubleshooting step.
08-01-2022 01:40 PM
Thank you.
I followed the instructions and got the following.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: