CiscoWorks VMS Security Monitor competed reports fail to email

Windows Server 2000
VMS 2.2
SecMon 2.2
We periodically have an issue with CiscoWorks VMS Security Monitor Reporting where VMS will stop emailing completed reports. In the past when we reboot the server the email which has been queued up somewhere all gets delivered and the email delivery will work for a few months until it stops again. We rebooted the server this time and the completed reports emails are still not being delivered.
When I test email functionality from the Windows command prompt with blat I can send email from the system through the mail server to my email address. All of the CiscoWorks processes are running without errors.
Where else can I look to troubleshoot this issue?
Thanks in advance

There might be probelm in contacting mail server configured in SecMon
See this URL for Configuring the E-mail Notifications with Scripts for IDS Alerts Using CiscoWorks Monitoring Center for Security:
http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_example09186a00801fc770.shtml#maintask1

Similar Messages

Reports failing to Email - losing logon parameters

Post Author: hd1
CA Forum: General
I have some reports that are failing to email. There are 2 reports that fail everytime they are supposed to run. The first report I have that is failing is not getting emailed when it should. It says that there were incorrect logon parameters but I was able to pull up the report. I have had a similiar issue but once I enter the password in for report it works fine but this issue is different. The password is populated but the report will not email. The other issue I have is a strange one and it this error is only on my other report.
ERROR: Failed to retrieve initial report values. For example, database information for this report could be incomplete or incorrect. This is a configuration problem. please contact your systems administrator.
Once I go to into the Central Management Console, I can refresh the reset the report, then it works fine, but this error comes up every week. This report however, is not getting emailed, this error is seen when you try to view the report on infoview.
Has anyone had a similar problem?

Hi, apologies for the late reply, I've finally got time to follow this up.
I've unmarked Susan's reply as answer until I have actually fixed it. The linked info seems relevant but isn't hitting it on the head.
Reports cannot be generated manually, they fail whether manual or scheduled. The receive connectors appear fine and are configured correctly. The "Default SERVERNAME"
receive connector is still there and is untouched since the initial fresh install of this server. I verified the config is as per;
and
I will try the fix my network wizard out of hours on our own server and update this post later.

VMS Security Monitor Event Rules - Email Script Question

Reference: "Configure E-mail Notifications with Scripts for IDS Alerts Using CiscoWorks Monitoring Center for Security"
http://www.cisco.com/en/US/customer/products/hw/vpndevc/ps4077/products_configuration_example09186a00801fc770.shtml#fivesensor
Good day all -
I have created the Email Notification process as desribed in the linked article. The script runs as expected when a High severity alert is triggered but does not fill in the variables within the email body. I have double-checked that I have the right version of the script for the sensors that we are using. Has anyone else been working with this (or some other) scripting solution and maybe have a suggestions on what to try next?

Try the configuration available at the URL http://cisco.com/en/US/docs/security/security_management/vms/security_monitor/2.2/user/guide/ch05.html.

SBS2011 Network Reports failing to email

Hello all,
I have a number of SBS2011 machines that are failing to send the daily network reports.
I’ve done some troubleshooting already and cannot resolve it, thus this post.
Neither the scheduled report nor the “generate and e-mail report” method work.
When I try the “generate and e-mail”option, I get the error “An error has occurred while sending this report. As a result, some of the recipients will not receive this report in e-mail”
The following error is also logged in the file C:\Program Files\Windows Small Business Server\Logs\MonitoringServiceLogs\DataServiceComponents.log
[16568] 141022.113000.4756: Messaging: MessagingTaskException: The operation couldn't be performed because object 'NT AUTHORITY\SYSTEM' couldn't be found on SBS.DOMAIN.local'. - Error# (80006)
I’ve read various other posts in this forum and only one post was close but it wasn’t resolved despite someone marking it as resolved after suggesting to run SBS BPA. BPA has been run on this server incidentally and it’s clean. I’ve also followed
the instructions to manually repair the reporting services from the Microsoft blog. Re-created ok but still no joy.
The error message from the DataServiceComponents.log suggests it’s a permissions issue but I don’t know how to resolve it.
I read that the SBSMonAcct account must be enabled for these reports to work yet one of the servers that we maintain that IS sending these reports via email to external addresses has this account disabled (yet the email still comes from
[email protected]). So I am thinking that this account is irrelevant? It was disabled by default on our internal SBS and I tried enabling it but still no joy.
Anyone got any suggestions? Much appreciated.

Hi, apologies for the late reply, I've finally got time to follow this up.
I've unmarked Susan's reply as answer until I have actually fixed it. The linked info seems relevant but isn't hitting it on the head.
Reports cannot be generated manually, they fail whether manual or scheduled. The receive connectors appear fine and are configured correctly. The "Default SERVERNAME"
receive connector is still there and is untouched since the initial fresh install of this server. I verified the config is as per;
and
I will try the fix my network wizard out of hours on our own server and update this post later.

Cisco Email Security Appliance (ESA) - Reporting

In previous versions on ESA you could export data and reports in CSV formats using an API. Is that still available?
>From the following document :
IRONPORT ASYNCOS 6.4 REPORTING API FOR IRONPORT APPLIANCES
REPORTING API OVERVIEW
The Reporting API feature allows you to download the same data collected by the Email Security Monitor component of the IronPort Email Security appliance or Security Management appliance in a comma separated value (CSV) format. This format allows users to integrate the IronPort appliance's data gathering capabilities into other IT and business reporting systems.
DOWNLOADING REPORTING DATA
You can retrieve the data used to build the charts and graphs in the Email Security Monitor feature via HTTP. This is useful if you plan to perform further analysis on the data via other tools. The data is available in standard comma separated value (CSV) format. The easiest way to get the HTTP query you will need is to configure one of the Email Security Monitor pages to display the type of data you want. You can then simply click the Export... link to initiate the download process.

It went away, there's a new one (RESTful) in 9.0/9.1
http://www.cisco.com/c/dam/en/us/td/docs/security/esa/esa9-0/ESA_API_1-0_Getting_Started_Guide.pdf

CiscoWorks VMS Event Viewer usage compared with MARS

I've been using VMS Security Monitor Event Viewer to monitor IPS sensors for the past few years. I'm used to the workflow of reviewing events in Event Viewer and then resolving them and sometimes removing them from the grid.
I'm beginning to use MARS and I'd like to know what the equivalent of resolving and removing from grid in MARS is or is this something you don't do in MARS and you work differently with the events in MARS?
Thanks in advance

The actual replacement for the IDS Event Viewer is the IPS Manager Express (IME) and not MARS. If you are looking for real-time monitoring and filtering of events for upto 5 sensors, then IME is the way to go. MARS is more of a SIM/SEM tool that collects logs from 'various' devices and 'correlates' those events into meaningful 'incidents'. It does the same for IPS devices. But you won't see 'every' event in the MARS Incidents page (as every event is not an incident). You have to run a query for that (Historical or real-time).
Regards
Farrukh

Informational events in security monitor

I am looking for the configuration method so that the VMS security monitor will display informational events in addition to low, med., and high events..
The documentation I have found explains what the informational event is, but I cannot find out how to enable it in security monitor..
thanks!

It should display all events unless you have an event viewer filter. An event viewer filter can be configured for example to only show high severity events.
http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/cw2000/mon_sec/secmon20/ug/ch04.htm#wp322119

Monitoring AES-256 on CiscoWorks VMS 2.3

We want to monitor our AES-256 VPN tunnels for our environment using CiscoWorks VMS 2.3. Our AES-256 VPN peers is a VPN concentrator with multiple PIX firewalls to our remote sites(hub and spoke design). Will CiscoWorks VMS 2.3 support this architecture for VPN monitoring?
Thanks in advance,
Erwin

The management functions for firewalls, Network IPS, Cisco Security Agents, VPNs, security monitoring, and performance monitoring have been updated with new features or usability improvements. Management Center for IDS Sensors is called Management Center for IPS Sensors for its increased IPS focus. The installation of VMS is faster and more streamlined. Management support for router-based IPS signatures has been added to extend security to the network infrastructure.
http://www.cisco.com/en/US/products/sw/cscowork/ps2330/products_installation_guide_chapter09186a00804d137d.html

Cisco Secure ACS 5.4/Monitoring and Report Viewer - SNMP Settings

Hello Everyone.
I hope this is the right forum for my question.
We just purchased 8 1121 ACS 5.4 appliances. I have some familiarity with the older 1113 and 1120 appliances running ACS 4.2. So I have a lot to learn.
Right now I'm trying to understand the Monitoring and Report Viewer System Configuration. I set the SNMP V2 read comm. string to the same string I configured from the CLI.
etc-labacsb1-1/admin# show runn | inc snmp
snmp-server contact "ACS1121;XXXXX"
snmp-server location "B1 Lab"
snmp-server community XXXXXX ro
1) It was not the same string as configured on CLI. Does setting this give me access to query more than system type or server type MIB objects.
2) Can you provide an example? (for example to query a switch - snmpwalk -v 1 -c XXXXXX hostname 1.3.6.1.4.1.9.9.43)
3) What is the MIB object tree OID (1.3.6.1.4.1.9.???) for these ACS appliances?
Thanks in advance.
Ray Westphal
EHI

that's correct. here is what we have in ACS 5.4 for snmp.
ACS 5.4 supports Simple Network Management Protocol (SNMP) to provide logging services. The SNMP agent provides read-only SNMPv1 and SNMPv2c support. The supported MIBs include:
•SNMPv2-MIB
•RFC1213-MIB (MIB II)
•IF-MIB
•IP-MIB
•TCP-MIB
•UDP-MIB
•CISCO-CDP-MIB
•ENTITY-MIB
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.4/device_support/sdt54.html#wp71020
~BR
Jatin Katyal
**Do rate helpful posts**

In vms 2.3 with security monitor 2.2 all signature is showing as false

Hi,
We are having cisco IPS 4255 with IPS version 5.1.1 and latest signature. We are connected IPS is in promiscuous mode and we are seeing all the signature are false in security monitor 2.2. Please help me to overcome from this problem.
Regards,
Ram

Where are you seeing this? What does it mean by saying that a signature is "false"? Are you referring to false positives that the signatures fire?

Security Monitor Events display incorrect time

I have a time issue between a 4240 sensor (5.0) and Security Monitor (2.1). The events in the sensor are correct but 7 hours off in Security Monitor, even though the VMS server understands the correct time (knows there are events in the last hour) but will not display them. After doing some research, it looks as though we needed to load CSCOids2.1.0-sol_SecMon_2_1_Service_Pack_1-6.tar right? Well I did, ran the perl script, everthing was successful. CiscoWorks shows the patch as being applied. Reloaded VMS and the sensor, and still I have what seems like a UTC problem (UTC offset always =0 yet time zone=arizona). Any suggestions?
Thanks!

Is the correct offset configured on the sensor?
Execute "show conf" and verify the value for the timezone offset. Remember that this is in minutes and not hours. If the timezone diffence is 7 hours then the value on the sensor should be 7hours*60minutes=420minutes.
Also use "show events" on the sensor to look at a few alerts on the sensor itself. It will report both the UTC/GMT time and the Local time. Verify that the offset between the 2 is correct on the sensor. (be sure to account for summertime/daylight savings time)

Crystal 10 Reports fail with error: "Load Report Failed"

Hi,
this seems to be a mystery. A client has Crystal 10 reports run from a Visual Studio 2003 application (.NET 1.1) running fine on and old server.
Once the .NET application is installed on a new Windows 2003 server, all Crystal 10 reports fail with the error message: "Load report failed" Source: CrystalDecisions.CrystalReport.Engine.
I set the worker process in the application pool to "system admin" and all Crystal reports failed. I had thought it was a security issue. I even removed Crystal 10 and installed Crystall XI Developer Edition and all reports raised the exact same error message from CrystalDecisions.CrystalReport.Engine.
Crystal does call the stored procedure to retrieve the data but cannot load the PDF. I have used 3 different physical servers, one Win 2003 64-bit and two Win 2003 32-bit and get the same error.
Help!
Thanks

Hi Mak,
It seems that you are having issue with SDK's.
Post your question in Business Objects SDK Application Development ->
.NET Development - Crystal Reports Forum.
That forum is monitored by qualified technicians and you will get a faster response there. Also, all SDK's queries remain in one place and thus can be easily searched in one place.
Thank you for your understanding,
Shweta

Scheuled report failing intermittently With Permission Error

Hello,
A scheduled custom report fails some days. The user has permission to both run and schedule the report. There is no problem to view the reports neither to set up the schedule. And the schedule often runs ok, just every now and then it fails with following error.
errdetail=oracle.apps.xdo.servlet.scheduler.ProcessingException\: Job execution failed because the user who scheduled this job has no more permission or priviledge to run the job. [REPORT_URL]\=[/*********.xdo], [USERNAME]\=[USERNAME]\r\n\********(XDOJob.java\:356)\r\n\tat org.quartz.core.JobRunShell.run(JobRunShell.java\:195)\r\n\tat org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java\:520)\r\nI saw a related document in metalink [ID 1330421.1] but it mentions about sharing the scheduler bertween two instances which I am not sure what that means. I have also checked following forum but for that user the failuer is permanent unlike in our case where its random.
Schedule problems
We are currently on;
Standalone Oracle BI Publisher 10.1.3.4
Windows 2003
Using LDAP (MS Active Directory) as a Security Model
Thanks for your help.

After we restarted the services, the issue went away. (very strange)

Crystal Reports Load report failed

Hi all,
Using VS2008. Crystal Reports 2008.
I have a .net application which uses LINQ. I am required to integrate existing Crystal reports into the web site.
In my web config file i have my connection string set up
<add name="connection Name" connectionString="Data Source=ServerName;Initial Catalog=database;uid=username;password=Password;Integrated Security=SSPI" providerName="System.Data.SqlClient"/>
and also I have set the authentication as follows:
<authentication mode="Windows"/>
<identity impersonate="true" userName="username" password="password"/>
I need the impersonation for when I deploy my app to the server.
The crystal report uses an existing connection set up when the report was created. So this is not tied to a LINQ table (i think this may be the problem).
I have no clue how to progress from here. When I try to change the datasource location to the LINQ table within the application, it won't map properly as the table contains nullable values.
Any ideas would be greatly appreciated.
Louise

Hi,
That particular problem with 'Load Report Failed' was happening because the identity impersonation account I had set up did not have rights to my TEMP folder on my machine. Crystal needs to be able to read and write to that folder.
I hope that helps you.
Louise

Runtime v13.0.6.1027 causing Load Report Failed on Citrix Receiver v13.4.0.25

With the installation of SP6 runtime, our clients that connect via Citrix are getting the following Load Report Failed message:
In order to fix, they must change their Citrix Connection Session Security for Files to Full Access. And, apparently, even if this Files setting is correct, they still cannot create files on the root of their C: drive, so they must create a new folder on their C: dirve and save any files to that folder.
I saw this discussion Crystal report error while loading the file and Don stated:
"Hello,
It's exactly what it says, the path to the report is not correct, user does not have permission to it or it simply doesn't exist.
Check Citrix's Forum, there are known issues with it and CR.
Don"
Prior to our upgrade to V13.0.6.1027, we we used the Crystal 2008 runtime components to run reports, and had no issue. Why, with this version of runtime does the access change? We have many citrix users, and this has become a critical issue.
Can you please point me to the specific forum that states the known issues with Citrix and CR?
Thank you

I never checked myself but because it a Citrix issue you should ask Citrix for help. They are familiar with permission issues and configurations.
If you run CR on your desktop it works...
Don

CiscoWorks VMS Security Monitor competed reports fail to email

Similar Messages

Maybe you are looking for