Cisco Cisco Email Security Appliance C170 사용자 가이드
2-33
Cisco IronPort AsyncOS 7.6 for Email Daily Management Guide
OL-25138-01
Chapter 2 Using Email Security Monitor
Email Security Monitor Pages
•
Volume: It is important to have an understanding of the “normal” message volume and the “usual”
spikes in your environment. Track this data over time to measure volume growth. You can use the
Incoming Mail and Outgoing Mail pages to track volume over time. For more information, see
spikes in your environment. Track this data over time to measure volume growth. You can use the
Incoming Mail and Outgoing Mail pages to track volume over time. For more information, see
•
Work Queue: The work queue is designed to work as a “shock absorber”-- absorbing and filtering
spam attacks and processing unusual increases in ham messages. However, the work queue is also
the best indicator of a system under stress, prolonged and frequent work queue backups may indicate
a capacity problem. You can use the WorkQueue page to track the average time messages spend in
the work queue and the activity in your work queue. For more information, see
spam attacks and processing unusual increases in ham messages. However, the work queue is also
the best indicator of a system under stress, prolonged and frequent work queue backups may indicate
a capacity problem. You can use the WorkQueue page to track the average time messages spend in
the work queue and the activity in your work queue. For more information, see
•
Resource Conservation Mode: When a Cisco IronPort appliance becomes overloaded, it will enter
“Resource Conservation Mode” (RCM) and send a CRITICAL system alert. This is designed to
protect the device and allow it to process any backlog of messages. Your Cisco IronPort appliance
should enter RCM infrequently and only during a very large or unusual increase in mail volume.
Frequent RCM alerts may be an indication that the system is becoming overloaded. Resource
Conservation Mode is not tracked by the system capacity page.
“Resource Conservation Mode” (RCM) and send a CRITICAL system alert. This is designed to
protect the device and allow it to process any backlog of messages. Your Cisco IronPort appliance
should enter RCM infrequently and only during a very large or unusual increase in mail volume.
Frequent RCM alerts may be an indication that the system is becoming overloaded. Resource
Conservation Mode is not tracked by the system capacity page.
System Capacity- Workqueue
The Workqueue page shows the average time a message spends in the work queue, excluding any time
spent in the Cisco IronPort Spam quarantine or in a system quarantine. You can view time periods from
an hour up to one month. This average can help in identifying both short term events delaying mail
delivery and identify long term trends in the workload on the system.
spent in the Cisco IronPort Spam quarantine or in a system quarantine. You can view time periods from
an hour up to one month. This average can help in identifying both short term events delaying mail
delivery and identify long term trends in the workload on the system.
Note
If a message is released from the quarantine into the work queue, the “average time in work queue”
metric ignores this time. This prevents double-counting and distorted statistics due to extended time
spent in a quarantine.
metric ignores this time. This prevents double-counting and distorted statistics due to extended time
spent in a quarantine.
The report also shows the volume of messages in the work queue over a specified time period, and it
shows the maximum messages in the work queue over the same time period.
shows the maximum messages in the work queue over the same time period.
Occasional spikes in the Workqueue graphs are normal and expected. If the spikes occur with increasing
frequency and are maintained over a long period of time, this may indicate a capacity issue. When
reviewing the work queue page, you may want to measure the frequency of work queue backups, and
take note of work queue backups that exceed 10,000 messages.
frequency and are maintained over a long period of time, this may indicate a capacity issue. When
reviewing the work queue page, you may want to measure the frequency of work queue backups, and
take note of work queue backups that exceed 10,000 messages.