Cisco Cisco Content Security Management Appliance M390 Guía Del Usuario
4-41
AsyncOS 8.1 for Cisco Content Security Management User Guide
Chapter 4 Using Centralized Email Security Reporting
Note
The Security Management appliance must be able to communicate with
downloads.cisco.com
to
correctly populate the tables on the Outbreak Filters page.
System Capacity Page
The Email > Reporting > System Capacity page provides a detailed representation of the system load,
including messages in the work queue, incoming and outgoing messages (volume, size, and number),
overall CPU usage, CPU usage by function, and memory page swapping information.
including messages in the work queue, incoming and outgoing messages (volume, size, and number),
overall CPU usage, CPU usage by function, and memory page swapping information.
The System Capacity page can be used to determine the following information:
•
Identify when Email Security appliances are exceeding recommended capacity; this enables you to
determine when configuration optimization or additional appliances are needed.
determine when configuration optimization or additional appliances are needed.
•
Identify historical trends in system behavior that point to upcoming capacity issues.
•
For troubleshooting, identify which parts of the system are using the most resources.
Monitor your Email Security appliances to ensure that the capacity is appropriate to your message
volumes. Over time, volume inevitably rises and appropriate monitoring ensures that additional capacity
or configuration changes can be applied proactively. The most effective way to monitor system capacity
is to track the overall volume, the messages in the work queue, and the incidents of Resource
Conservation Mode.
volumes. Over time, volume inevitably rises and appropriate monitoring ensures that additional capacity
or configuration changes can be applied proactively. The most effective way to monitor system capacity
is to track the overall volume, the messages in the work queue, and the incidents of Resource
Conservation Mode.
•
Volume: It is important to understand the “normal” message volume and the “usual” spikes in your
environment. Track this data over time to measure volume growth. You can use the Incoming Mail
and Outgoing Mail pages to track volume over time. For more information, see
environment. Track this data over time to measure volume growth. You can use the Incoming Mail
and Outgoing Mail pages to track volume over time. For more information, see
and
•
Work Queue: The work queue is designed to work as a “shock absorber”— absorbing and filtering
spam attacks and processing unusual increases in non-spam messages. However, the work queue can
also indicate a system under stress. Prolonged and frequent work queue backups may indicate a
capacity problem. You can use the System Capacity – Workqueue page to track the activity in your
work queue. For more information, see
spam attacks and processing unusual increases in non-spam messages. However, the work queue can
also indicate a system under stress. Prolonged and frequent work queue backups may indicate a
capacity problem. You can use the System Capacity – Workqueue page to track the activity in your
work queue. For more information, see
•
Resource Conservation Mode: When an appliance becomes overloaded, it enters Resource
Conservation Mode (RCM) and sends a CRITICAL system alert. This is designed to protect the
device and allow it to process any backlog of messages. Your appliance should enter RCM
infrequently and only during a very large or unusual increase in mail volume. Frequent RCM alerts
may be an indication that the system is becoming overloaded. RCM is not tracked by the System
Capacity page.
Conservation Mode (RCM) and sends a CRITICAL system alert. This is designed to protect the
device and allow it to process any backlog of messages. Your appliance should enter RCM
infrequently and only during a very large or unusual increase in mail volume. Frequent RCM alerts
may be an indication that the system is becoming overloaded. RCM is not tracked by the System
Capacity page.
How to Interpret the Data You See on System Capacity Page
When choosing time ranges for viewing data on the System Capacity page, the following is important to
remember:
remember:
•
Day Report— The Day report queries the hour table and displays the exact number of queries that
have been received by the appliance on an hourly basis over a 24 hour period. This information is
gathered from the hour table. This is an exact number.
have been received by the appliance on an hourly basis over a 24 hour period. This information is
gathered from the hour table. This is an exact number.
•
Month Report— The Month report queries the day tables for the 30 or 31 days (dependent on the
number of days in the month), giving you an exact report on the number of queries over 30 or 31
days. Again, this is an exact number.
number of days in the month), giving you an exact report on the number of queries over 30 or 31
days. Again, this is an exact number.