Cisco Cisco Email Security Appliance C170 Guia Do Utilizador

After an Email Security appliance is configured to use centralized reporting and 
you add it to the Security Management appliance as a managed appliance, the 
Email Security appliance operates in centralized reporting mode. When an Email 
Security appliance is in centralized reporting mode, the scheduled reports for that 
appliance are suspended, and you can no longer access the scheduled report 
configuration page and the archived reports for the appliance. Also, the appliance 
stores only a week’s worth of data. New data for the monthly and yearly reports 
is stored on the Security Management appliance. Existing data on the Email 
Security appliance for the monthly report is not transferred to the Security 
Management appliance. After centralized reporting is disabled, the Email 
Security appliance begins storing new monthly report data.

If you disable centralized reporting on the Email Security appliance, scheduled 
reports resume, and you can access its archived reports. After disabling 
centralized reporting, the appliance only displays data for the past hour and day, 
but not the past week or month. This is temporary. The appliance will display the 
reports for the past week and month after it accumulates enough data. If the Email 
Security appliance is placed back into centralized reporting mode, it will display 
data for the past week in the interactive reports. 

You can configure an Email Security appliance to use either local (on-box) 
tracking or centralized tracking. 

You cannot enable both centralized and local tracking on an Email Security 
appliance.

To enable centralized tracking on an Email Security appliance:

Click Security Services > Message Tracking.

The Message Tracking Service page is displayed.