All Apps and Add-ons

How can I retrieve the event log that was stored on Firepower while the FMC was down?

taasai
New Member

Hi,
I'm testing the eNcore's behavior in some FMC failure scenarios. Even if the FMC encounters a shutdown, the FMC retrieves the event logs that was stored on the Firepower during the failure when it comes online again, and the log will be shown on the FMC's GUI. But eNcore dashboard didn't show the log. It just missed. Is there any way to have eNcore retrieve the log from FMC on demand?

0 Karma

douglashurd
Builder

Cisco TAC can explain how to access the eStreamer unified2 files. This file stor is not the same as the event database that is accessed when you search events via the UI or when running reports. Its much smaller in terms of the number of events it can queue up as well.

0 Karma

ongwei
Explorer

have you resolved this? I have same issue as you. is looking for solution

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...