Filter
Top Products
66-5
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter 66 Viewing Events
Introduction to Event Viewer Capabilities
Table 66-1 Event Viewer Scope and Limits
Item Description
Device Support You can view events collected from the following types of devices.
Although Event Viewer has been tested with the indicated software
releases, you might be able to use it with older software releases.
• ASA devices (including ASA-SM) and security contexts—All
8.x releases.
• FWSM devices and security contexts—Releases 3.1.17, 3.2.17,
4.0.10, and 4.1.1 and higher.
• IPS devices and virtual sensors—Releases 6.1 and higher.
IPS support does not include IOS IPS.
Event Data Store Size and
Location
You can control the location and disk space allocated to holding events
collected from monitored devices. After the Event Data Store is 90
percent filled, newest events replace oldest events.
You can also configure an extended storage, or archive, location on
attached storage devices. Security Manager automatically copies events
into the extended storage; when you view historical events, they are
automatically retrieved from extended storage if they no longer reside
on the local disk.
For more information on configuring these settings, see the Event
Management Page, page 11-22
Event Limit You can control the maximum number of events that can be viewed at
one time in the events table using the Event Data Pagination Size
option. For information on configuring the option, see Event
Management Page, page 11-22.
Policy Objects You can use some types of policy objects, such as network/host and
services objects, when creating column filters.
You can also view host object names instead of IP addresses in the
source and destination columns by selecting View > Show Network
Host Objects. This option is selected by default.
IP address to host name mapping is supported only for the source and
destination of events. Also, the mapping applies to Host objects only;
Event Viewer will not show an object name when the source or
destination of an event matches a Network object, Group object, or
Address Range object.
Tip Hover over a host object name to view the IP address associated
with that object.
Views A single Event Viewer client can open at most four historical views and
one real-time view at a time.
Clients For a single Security Manager server, a maximum of 5 Security
Manager clients can open Event Viewer at one time, and a Security
Manager client can open one copy of Event Viewer.