View Historical Events

The Live events page shows the most recent 500 events that match the filter and search criteria you entered. Events older than the most recent 500 are transferred to the Historical events table. That transfer takes roughly a minute to perform. You can then filter all the events you have stored to find events you're looking for.

To view historical events:

Procedure

Step 1

In the navigation pane, choose Analytics > Event Logging.

Step 2

Click the Historical tab. By default, when you open the Historical events table, the filter is set to display the events collected within the last hour.

The event attributes are largely the same as what is reported by Firepower Device Manager (FDM) or the Adaptive Security Device Manager (ASDM).

For a complete description of Firepower Threat Defense event attributes, see Cisco FTD Syslog Messages.
For a complete description of ASA event attributes, see Cisco ASA Series Syslog Messages.