Symptom

Frequent restarts of the syslog-ng process on the Firepower Management Center / Secure Firewall Management Center (FMC). Occasional but noticeable time gaps seen in log files on the FMC that are managed and written to by syslog-ng. Elevated CPU use by MySQL/MariaDB on the FMC, possibly accompanied by health alerts for high CPU use (if the health policy applied to the FMC has CPU health modules enabled).

Conditions

The FMC manages FTDs that have VPN features in use. The platform settings policies assigned and deployed to the FTDs have "Enable Logging to Firewall Management Center" active under "VPN Logging Settings" in the "Syslog" section of the platform settings policy. The "Logging Level" for "VPN Logging Settings" has been set to one of the two highest logging levels ("informational" or "debugging").

Workaround

Set the Logging Level for "VPN Logging Settings" to "notifications" or lower (with the lower logging levels appearing higher up in the drop-down box). Save the platform settings policy. Deploy to the applicable FTDs.

Further Problem Description