How can I retrieve the event log that was stored on Firepower while the FMC was down?

[taasai]

Hi,
I'm testing the eNcore's behavior in some FMC failure scenarios. Even if the FMC encounters a shutdown, the FMC retrieves the event logs that was stored on the Firepower during the failure when it comes online again, and the log will be shown on the FMC's GUI. But eNcore dashboard didn't show the log. It just missed. Is there any way to have eNcore retrieve the log from FMC on demand?

[douglashurd]

Cisco TAC can explain how to access the eStreamer unified2 files. This file stor is not the same as the event database that is accessed when you search events via the UI or when running reports. Its much smaller in terms of the number of events it can queue up as well.

[ongwei]

have you resolved this? I have same issue as you. is looking for solution