Firepower Files and Processes

Since I had to use the root shell various times for troubleshooting on firepower systems, I decided to document some of the various binaries and logfiles that are available on FMC and firepower sensors.

The following list only containts an overview of the various tools you can find on fmc and ftd shell. In the future I will create blog posts for various items listed here to explain what they are doing and how to use them.


This list of configuration files, binaries, processes and log files has been created for anyone who wants to take a deeper look into the system. Keep in mind that this list is not a complete reference and only consists of elements I found useful. Before touching any binaries and processes in production environments make sure you really know what you are doing. Descriptions for various files may not be entirely correct since many of the listed tools are not documented by Cisco in any way for customers and partners. If you spot any errors just let me know.

FirePOWER Management Center

Processes & Binaries

Path Description
/usr/local/sf/bin/adi Identity Process (Active Directory/pxGRID/User Agent)
/usr/local/sf/bin/ HA Daemon for FMC High Availability
/usr/local/sf/bin/CloudAgent Cloud Agent (AMP, URL Filtering, SI)
/usr/local/sf/bin/sftunnel Management SSL Tunnel
/usr/local/sf/bin/ Check sftunnel status
/usr/local/sf/bin/pmtool FMC Management Binary (Control Processes, Display Process Health, etc.)
/usr/local/sf/bin/ Check sftunnel event transfer status
/usr/local/sf/bin/ Manage eStreamer
/usr/local/sf/bin/ Manage pruning (e.g. clear event db)
/usr/local/sf/bin/ Manage FMC High Availability
/usr/local/sf/bin/ Troubleshoot FMC High Availability
/usr/local/sf/bin/ Connect to Sybase Database
/usr/local/sf/bin/ Check IDS event rate of the last hour
/usr/local/sf/bin/eo_tool Object Management Tool of FMC application. Do not edit objects if you do not know what you are doing
/usr/local/sf/bin/pigtail Tail various logfiles for troubleshooting
/usr/local/sf/bin/u2dump Dump user identity mappings into a human readable format

Configuration Files

Path Description
/etc/sf/PM.conf Process Manager configuration
/etc/sf/ADI.conf Identity Process configuration
/etc/sf/sftunnel.conf SSL Tunnel configuration
/etc/sf/fireAMP_proxy.conf AMP Proxy Settings
/etc/sf/ims.conf Environment Variables
/etc/sf/ims-data.conf Snort Authentication Credentials
/etc/sf/bca.cfg Brightcloud URL Filtering
/etc/sf/cloudagent.conf Cloud Agent (AMP, URL Filtering, SI)
/etc/sf/iprep_sources.conf Security Intelligence IP Feeds
/etc/sf/dns_sources.conf Security Intelligence DNS Feeds
/etc/sf/dns_cache.conf DNS Caching Options
/etc/sf/network-amp.conf AMP for Network Settings
/etc/sf/amp-stunnel.conf AMP Cloud Settings
/etc/sf/sandbox_cloud.conf Threatgrid Cloud Settings
/etc/sf/sandbox_file_size.cfg Threatgrid max Filesize
/etc/sf/geo_updates.conf Geo-IP Update Settings
/etc/sf/seu_versions.conf Snort Version
/etc/sf/email.conf Mail settings
/etc/sf/msmtprc Mail setting details
/etc/sf/patch_history Patch History
/etc/sf/sf-version OS / APP Version
/usr/local/sf/updates/ Update Directory

Log Files

Path Description
/var/log/messages Logging for various proccesses
/usr/local/sf/cloud_download/tmp/url_db_dl.log Brightcloud Database Download Log
/var/log/urldb_log Brightcloud Database Download Log
/var/log/iprep.log Security Intelligence Feed Download Status Log
/var/log/smart_agent Smart Licensing Agent Log
/var/log/sch.log Call Home Log
/var/log/ntp.log NTP Server Connections
/var/log/process_stdout.log STDOUT Output of Processes
/var/log/process_stderr.log STDERR Output of Processes
/var/log/CSMAgent.log CSM related access logs
/var/log/mojo.log Mojo Perl Webserver Logs
/var/log/syncd.log High Availability Log (FMC HA)
/var/log/sf//status.log Status Log for FMC upgrade
/var/log/sf//000_start/* Logs for actions taken before upgrade is started
/var/log/sf//200_pre/* Logs for actions taken to start update
/var/log/sf//300_os/* Update logs for Fire Linux OS upgrade

FirePOWER Threat Defense

Processes & Binaries

Path Description
/ngfw/usr/local/sf/bin/pmtool FirePOWER Management Binary (Control Processes, Display Process Health, etc.)
/ngfw/usr/local/sf/bin/CloudAgent Cloud Agent (AMP, URL Filtering, SI)
/ngfw/var/cisco/ngfwWebUi/tomcat/bin/ Onboard Web UI (FDM)
/ngfw/usr/local/sf/bin/sftunnel Management SSL Tunnel
/ngfw/usr/local/sf/bin/ Generate troubleshooting file for sensor. Saved to /ngfw/var/common

Configuration Files

Path Description
/etc/sf/bca.conf URL Filtering Settings
/etc/sf/sandbox_cloud.conf ThreatGRID Settings
/etc/sf/cloudagent.conf AMP and SI Settings
/etc/sf/patch_history Patch History

Log Files

Path Description
/ngfw/var/log/process_stderr.log STDERR Output of FTD Processes
/ngfw/var/log/process_stdout.log STDOUT Output of FTD Processes
/ngfw/var/log/ngfwManager.log ngfwManager Log
/ngfw/var/log/messages General Log File
/ngfw/var/log/action_queue.log Task Log (FMC Triggered Tasks)
/ngfw/var/log/policy_deployment.log Policy Deployment Log

Other Files

Path Description
/var/sf/sidns_download Security Intelligence - DNS
/var/sf/sidns_download/*.lf DNS Feeds
/var/sf/siurl_download Security Intelligence - URLs
/var/sf/siurl_download/*.lf URL Feeds
/var/sf/iprep_download Security Intelligence - IPs
/var/sf/iprep_download/.*lf IP Reputation Feeds
/var/sf/cloud_download Brightcloud URL Filtering
/var/sf/cloud_download/cloudagent_dlupdate_health Brightcloud URL Filtering database status
/var/sf/cloud_download/full_bcdb_rep.bin URL Database
/dev/shm/Global.bcdb URL Database (in shared memory)
/var/sf/clamupd_download/ CLAMAV Database
/var/sf/clamupd_download/*.cvd CLAMAV Database files
/var/sf/remediation Remediation modules
/var/sf/detection_engines Snort configuration
/var/sf/updates Updates directory
/var/sf/identity_integration User to IP mappings
/var/common Dump Directory (backups, t-shoot files, etc.)