sensor can't reach DC

[mahmoud.awney1]

in sourcefire if sensor can't reach to Defence center. Are events are stored on sensor ? and i want to  know the limit the sensor can stored events ?

[Marvin Rhoads]

Yes, they are stored locally.

You can see and manage the local storage space by following the steps in this TAC article.

[Ed Padilla Jr]

The events get queue on the sensor, for some period, and then proceeds to purge them.  It may store for several days, depending on the amount of events and size of storage on the sensor.