cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
21237
Views
10
Helpful
3
Replies

FMC : Warining : Disk Usage : Frequent drain of connection Events

sam cook
Spotlight
Spotlight

Hi,

 

I'm running FMC 6.2.3.1 and I got this warning message :

"Disk Usage : Frequent drain of connection Events"

 

on one of my FTS also running 6.2.3.1 version.

 

I found onther subject speaking about this error but it referneced a bug already fixed. I think I'm running the latest version of FTD and FMC so what do you think is the reason ?

 

3 Replies 3

mohanB
Level 1
Level 1

Applied the solution mentioned here to get rid of the issue for the version not mentioned in the bug also

(https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuz86604/?rfs=iqvred)

if you do show disk-manager , you might see some events storage USED space is close to the maximum storage. 

And if you do 

> show log-events-to-ramdisk (some firepower models do not have this)

it might be logged to ramdisk which is limited

Doing below will move the logging from ramdisk to SSD

> configure log-events-to-ramdisk disable

 

 

 

 

Akira Muranaka
Level 8
Level 8

Except ASA5512/5515, " configure log-events-to-ramdisk disable" should not be used because it will cause the wear and tears of SSD disk. In addition, "configure log-events-to-ramdisk disable" may not be supported on several platforms.

 

Almost reason of "Disk Usage : Frequent drain of connection Events" is caused by tremendous connection logging configuration and sessions, or lack of eventing performance of using FTD/FMC. Therefore, either tuning logging configuration or reducing DoS traffic or upgrading FTD/FMC will be solution.

 

Please see the CSCuz86604 about workaround and limitation in detail.
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuz86604/?rfs=iqvred

 

The below document is useful for understanding architecture and troubleshooting step.

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/216081-troubleshoot-drain-of-fmc-unprocessed-ev.html

phipse_508122
Level 1
Level 1

Thank you.

I followed the instructions and got the following.

Capture.PNG

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: