FMC : Warining : Disk Usage : Frequent drain of connection Events

[sam cook]

Hi,

I'm running FMC 6.2.3.1 and I got this warning message :

"Disk Usage : Frequent drain of connection Events"

on one of my FTS also running 6.2.3.1 version.

I found onther subject speaking about this error but it referneced a bug already fixed. I think I'm running the latest version of FTD and FMC so what do you think is the reason ?

[mohanB]

Applied the solution mentioned here to get rid of the issue for the version not mentioned in the bug also

(https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuz86604/?rfs=iqvred)

if you do show disk-manager , you might see some events storage USED space is close to the maximum storage. 

And if you do 

> show log-events-to-ramdisk (some firepower models do not have this)

it might be logged to ramdisk which is limited

Doing below will move the logging from ramdisk to SSD

> configure log-events-to-ramdisk disable

[Akira Muranaka]

Except ASA5512/5515, " configure log-events-to-ramdisk disable" should not be used because it will cause the wear and tears of SSD disk. In addition, "configure log-events-to-ramdisk disable" may not be supported on several platforms.

Almost reason of "Disk Usage : Frequent drain of connection Events" is caused by tremendous connection logging configuration and sessions, or lack of eventing performance of using FTD/FMC. Therefore, either tuning logging configuration or reducing DoS traffic or upgrading FTD/FMC will be solution.

Please see the CSCuz86604 about workaround and limitation in detail.
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuz86604/?rfs=iqvred

The below document is useful for understanding architecture and troubleshooting step.

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/216081-troubleshoot-drain-of-fmc-unprocessed-ev.html

[phipse_508122]

Thank you.

I followed the instructions and got the following.