Cisco Cisco Content Security Management Appliance M390 User Guide
Chapter 3 Using Centralized Email Reporting
3-36
Cisco IronPort AsyncOS 7.2.0 for Security Management User Guide
OL-21768-01
•
For troubleshooting, identify which parts of the system are using the most
resources.
resources.
Monitor your Email Security appliances to ensure that the capacity is appropriate
to your message volumes. Over time, volume inevitably rises and appropriate
monitoring ensures that additional capacity or configuration changes can be
applied proactively. The most effective way to monitor system capacity is to track
the overall volume, the messages in the work queue, and the incidents of Resource
Conservation Mode.
to your message volumes. Over time, volume inevitably rises and appropriate
monitoring ensures that additional capacity or configuration changes can be
applied proactively. The most effective way to monitor system capacity is to track
the overall volume, the messages in the work queue, and the incidents of Resource
Conservation Mode.
•
Volume: It is important to understand the “normal” message volume and the
“usual” spikes in your environment. Track this data over time to measure
volume growth. You can use the Incoming Mail and Outgoing Mail pages to
track volume over time. For more information, see
“usual” spikes in your environment. Track this data over time to measure
volume growth. You can use the Incoming Mail and Outgoing Mail pages to
track volume over time. For more information, see
and
•
Work Queue: The work queue is designed to work as a “shock absorber”—
absorbing and filtering spam attacks and processing unusual increases in
non-spam messages. However, the work queue can also indicate a system
under stress. Prolonged and frequent work queue backups may indicate a
capacity problem. You can use the System Capacity – Workqueue page to
track the activity in your work queue. For more information, see
absorbing and filtering spam attacks and processing unusual increases in
non-spam messages. However, the work queue can also indicate a system
under stress. Prolonged and frequent work queue backups may indicate a
capacity problem. You can use the System Capacity – Workqueue page to
track the activity in your work queue. For more information, see
.
•
Resource Conservation Mode: When an Cisco IronPort appliance becomes
overloaded, it enters Resource Conservation Mode (RCM) and sends a
CRITICAL system alert. This is designed to protect the device and allow it to
process any backlog of messages. Your Cisco IronPort appliance should enter
RCM infrequently and only during a very large or unusual increase in mail
volume. Frequent RCM alerts may be an indication that the system is
becoming overloaded. RCM is not tracked by the System Capacity page.
overloaded, it enters Resource Conservation Mode (RCM) and sends a
CRITICAL system alert. This is designed to protect the device and allow it to
process any backlog of messages. Your Cisco IronPort appliance should enter
RCM infrequently and only during a very large or unusual increase in mail
volume. Frequent RCM alerts may be an indication that the system is
becoming overloaded. RCM is not tracked by the System Capacity page.
How to Interpret the Data You See on System Capacity Page
When choosing time ranges for viewing data on the System Capacity page, the
following is important to remember:
following is important to remember:
•
Day Report— The Day report queries the hour table and displays the exact
number of queries that have been received by the appliance on an hourly basis
over a 24 hour period. This information is gathered from the hour table. This
is an exact number.
number of queries that have been received by the appliance on an hourly basis
over a 24 hour period. This information is gathered from the hour table. This
is an exact number.