Cisco Cisco Content Security Management Appliance M1070 Mode D'Emploi
4-38
AsyncOS 9.6 for Cisco Content Security Management Appliances User Guide
Chapter 4 Using Centralized Email Security Reporting
Understanding the Email Reporting Pages
•
Work Queue: The work queue is designed to work as a “shock absorber”— absorbing and filtering
spam attacks and processing unusual increases in non-spam messages. However, the work queue can
also indicate a system under stress. Prolonged and frequent work queue backups may indicate a
capacity problem. You can use the System Capacity – Workqueue page to track the activity in your
work queue. For more information, see
spam attacks and processing unusual increases in non-spam messages. However, the work queue can
also indicate a system under stress. Prolonged and frequent work queue backups may indicate a
capacity problem. You can use the System Capacity – Workqueue page to track the activity in your
work queue. For more information, see
•
Resource Conservation Mode: When an appliance becomes overloaded, it enters Resource
Conservation Mode (RCM) and sends a CRITICAL system alert. This is designed to protect the
device and allow it to process any backlog of messages. Your appliance should enter RCM
infrequently and only during a very large or unusual increase in mail volume. Frequent RCM alerts
may be an indication that the system is becoming overloaded. See
Conservation Mode (RCM) and sends a CRITICAL system alert. This is designed to protect the
device and allow it to process any backlog of messages. Your appliance should enter RCM
infrequently and only during a very large or unusual increase in mail volume. Frequent RCM alerts
may be an indication that the system is becoming overloaded. See
.
How to Interpret the Data You See on System Capacity Page
When choosing time ranges for viewing data on the System Capacity page, the following is important to
remember:
remember:
•
Day Report— The Day report queries the hour table and displays the exact number of queries that
have been received by the appliance on an hourly basis over a 24 hour period. This information is
gathered from the hour table. This is an exact number.
have been received by the appliance on an hourly basis over a 24 hour period. This information is
gathered from the hour table. This is an exact number.
•
Month Report— The Month report queries the day tables for the 30 or 31 days (dependent on the
number of days in the month), giving you an exact report on the number of queries over 30 or 31
days. Again, this is an exact number.
number of days in the month), giving you an exact report on the number of queries over 30 or 31
days. Again, this is an exact number.
The ‘Maximum’ value indicator on the System Capacity page is the highest value seen for the specified
period. The ‘Average’ value is the average of all values for the specified period. The period of
aggregation depends on the interval selected for that report. For example, you can choose to see the
Average and Maximum values for each day if the chart is for a month period.
period. The ‘Average’ value is the average of all values for the specified period. The period of
aggregation depends on the interval selected for that report. For example, you can choose to see the
Average and Maximum values for each day if the chart is for a month period.
You can click the View Details link for a specific graph to view data for individual Email Security
appliances and overall data for the appliances connected to the Security Management appliance.
appliances and overall data for the appliances connected to the Security Management appliance.
System Capacity – Workqueue
The Workqueue page shows the average time a message spends in the work queue, excluding any time
spent in the Spam quarantine or in a policy, virus, or outbreak quarantine. You can view time periods
from an hour up to one month. This average can help in identifying both short term events delaying mail
delivery and identify long term trends in the workload on the system.
spent in the Spam quarantine or in a policy, virus, or outbreak quarantine. You can view time periods
from an hour up to one month. This average can help in identifying both short term events delaying mail
delivery and identify long term trends in the workload on the system.
Note
If a message is released from the quarantine into the work queue, the “average time in work queue”
metric ignores this time. This prevents double-counting and distorted statistics due to extended time
spent in a quarantine.
metric ignores this time. This prevents double-counting and distorted statistics due to extended time
spent in a quarantine.
The report also shows the volume of messages in the work queue over a specified time period, and it
shows the maximum messages in the work queue over the same time period. The graphical
representation of the maximum messages in the work queue also shows the work queue threshold level.
shows the maximum messages in the work queue over the same time period. The graphical
representation of the maximum messages in the work queue also shows the work queue threshold level.
Occasional spikes in the Workqueue graphs are normal and expected. If the messages in the work queue
remain higher than the configured threshold for a long duration, this may indicate a capacity issue. In
this scenario, consider tuning the threshold level or review the system configuration.
remain higher than the configured threshold for a long duration, this may indicate a capacity issue. In
this scenario, consider tuning the threshold level or review the system configuration.
To change the work queue threshold level, see