Filter
Top Products
67-32
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter 67 Managing Reports
Troubleshooting Report Manager
• Ensure that these devices are appropriately configured for sending events to Security Manager, and
that events from the device appear in Event Viewer. Ensure that the device and Security Manager are
using the same syslog port. For information on configuring the devices, see Configuring ASA and
FWSM Devices for Event Management, page 66-25 and Configuring IPS Devices for Event
Management, page 66-26. To check the syslog port that Security Manager is using, view the setting
on the Tools > Security Manager Administration > Event Management page in Configuration
Manager.
• For IPS devices, ensure that the certificate has not expired. Check the certificates table by selecting
Manage > IPS > IPS Certificates in Configuration Manager and regenerate the certificate if
necessary.
• The report settings might specify a time period in which no aggregated data exists for the report.
Data is aggregated every 15 minutes, 1 hour (on the hour), and 1 day (at midnight). Try changing
the time parameters of the report. See Editing Report Settings, page 67-21. Consider the following:
–
To see a Last 1 Hour report, a change of hour must occur since initially starting the Event
Manager service. For example, if you start the service at 10:05, hourly reports are available only
after 11:00.
–
To see a Last 1 Day report, a change of day must occur since initially starting the Event Manager
service. For example, if you start the service at 10:05, you must wait until after midnight to see
a daily report.
–
To see a Last 1 Week report, at least one full day cycle must occur. Weekly reports are based on
daily reports.
–
To see a Last 1 Month report, at least one full month must pass since starting the service.
–
To see a custom time period report, at least one daily cycle must occur.
• If you create a new custom report, it might take up to one hour for data to become available. Also,
ensure that the time period is Last 1 Hour until the report is old enough to have data for other time
periods.
Problem: You cannot get reports for a specific device.
Solution: Investigate the following:
• The device must have been selected for event management during the reporting time-frame as
described in Selecting Devices to Monitor, page 66-31. Even if a device is selected, Report Manager
might not support all devices that are supported for Event Viewer. For information on the supported
device types, see Understanding Report Management, page 67-1.
• The report settings might exclude the device. Unless the report settings indicate that All Devices are
considered in the report, check the device selection to ensure the device is included. See Editing
Report Settings, page 67-21.
• The report settings might specify a time period in which no data exists for the device. Try changing
the time parameters of the report. See Editing Report Settings, page 67-21.
• If your organization uses Cisco Secure ACS to control access to the application, you can view
reports on a device only if you have at least View privileges to the device. Check whether you have
the required permissions.
Problem: You cannot see data in certain IPS predefined reports after specifying values for each of
signature, victim IP, and attacker IP.