Filter
Top Products
66-31
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter 66 Viewing Events
Managing the Event Manager Service
Selecting Devices to Monitor
All ASA and FWSM devices and security contexts, and IPS devices and virtual sensors, that are added
to the Security Manager database are automatically selected for monitoring in Event Viewer.
Note To reliably report events from contexts in multiple-context mode, Cisco Event Viewer requires an IP
address for the management interface of each context.
If you do not want to use Event Viewer with a device, you can deselect the device for monitoring. Note
that if an ASA or FWSM device or security context is not configured to use the Security Manager server
as a syslog server, you will not get events from the device or security context anyway, so you might not
need to deselect an ASA or FWSM that you do not want to monitor.
Tip You cannot monitor Cisco IOS IPS devices in Event Viewer.
Related Topics
• Adding Devices to the Device Inventory, page 3-6
• Configuring ASA and FWSM Devices for Event Management, page 66-25
• Configuring IPS Devices for Event Management, page 66-26
Step 1 In Event Viewer, select View > Manage Monitored Device to open the Manage Monitored Devices
dialog box.
The device list shows all devices in the Security Manager inventory to which you have view permissions.
You cannot see any devices for which you have no permissions. Any selections you make are limited to
the displayed devices. If you do not have permission to select or deselect any devices, the list is read-only
and you cannot select devices for monitoring. For more information on access permissions, see
Understanding Event Viewer Access Control, page 66-3.
Step 2 Ensure that only those devices whose events you want to monitor in Event Viewer are selected. Deselect
any undesired devices.
You can change the selection status for all devices in a device group by selecting or deselecting the
group.
Step 3 Click OK.
You might need to wait for the changes take effect in Event Viewer.
Monitoring Event Data Store Disk Space Usage
The Event Manager service uses a specified amount of disk space for the primary and extended event
data stores. This ensures that the service does not overwhelm the server computer or the extended storage
location. You configure the size of the primary and extended event data stores on the Tools > Security
Manager Administration > Event Management page as described in Event Management Page,
page 11-22.