UCS Central - Uplink Traffic Monitoring - Statistic reporting

Hey guys,
today I want to start a little discussion about monitoring of uplinks and interpreting the results of the report.
In my UCS Central, I created a report for all my four FC uplinks FI-A:31-32 and FI-B:31-32 of my UCS. (see report in attached file).
So it says for TX (Delta) FI-A:31 10,61 GB. How I have to interpret that result?
like that? 10,61GB in 30sec (30sec collection interval / 15min reporting interval)
means: 10,61GB/30sec = 0,3537 GB/sec = 2,83 Gbit/s.
Sometimes the Result says 102 GB. So it would be 27,2 Gbit/s. That's not possible, because it is a 8GBit FC Uplink. oO
Can someone help me to interpret that correct?
Many thanks
/Hugo

No. You are speaking about SPAN sessions...I'm not speaking about that. I rather refer to having a feature as simple as having a graph of average bandwidth percentage occupation of last week for ethernet port 1/2 of Fabric Interconnect, for instance. We do not have such capabilities in UCS Manager and was wondering till what extent the above mentioned applications do have them??

Similar Messages

UCS Central 1.1(1a) Standard Reports in Statistics tab are empty

We have configured statistics collection with a 15 minute collection interval. The data is reaching the Oracle database we established for the data. However, when I try to run the standard network reports "receive traffic" and "transmit traffic", I receive a "No data error".
While it's been several months since I set it up, I feel fairly certain that I ran the reports successfully shortly after configuring it. I've done some searching and have come up empty on tips/tricks or standard troubleshooting tactics. Any suggestions on either the cause of the problem or the best way to get more data to determine a cause?
Thanks!
-Tim

In the past week, we migrated the backend database to another server (old server being retired).
Prior to the migration, I set the collection interval to infinite (don't collect). The DB was migrated by the DBA team. When I re-entered the new connection information, the reports started working again.
Problem is solved but still would love tips/tricks on how to better debug this issue.
Thanks,
-Tim

ASK THE EXPERTS - WAAS MONITORING AND REPORTING

Welcome to the Cisco Networking Professionals Ask the Expert conversation. This is an opportunity to learn about Cisco Wide Area Application Services monitoring and reporting with Michael Holloway and Joe Merrill. Michael is an escalation support engineer in the Application Delivery Business Unit focusing on escalations to engineering related to the Cisco Wide Area Application Services (WAAS) product. He has worked with Cisco WAAS since its initial development, and with the first product beta.
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin:0in;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;}
Joe Merrill is an escalation support engineer in the Application Delivery Business Unit focusing on escalations to engineering related to the Cisco Wide Area Application Services (WAAS) product. He has worked with Cisco WAAS since its initial development, and with the first product beta.
Remember to use the rating system to let Michael and Joe know if you have received an adequate response.
Michael and Joe might not be able to answer each question due to the volume expected during this event. Our moderators will post many of the unanswered questions in other discussion forums shortly after the event. This event lasts through August 27, 2010. Visit this forum often to view responses to your questions and the questions of other community members.

Very good questions. Let me try and take them one at a time. Some of the answers you will likely find in the CM GUI help (upper-left corner is the Help button), or in the online documentation. But let's add a little more color and detail.
1)When we pull bandwidth Optimization report, on Y-Axis the graphs says Effective Capacity .What is Effective Capacity?
Basically, the "effective increased bandwidth capacity" is telling you how much additional WAN bandwidth you've gained because of the optimization. It will chart somewhere between 1 times and 100 times. Typically it charts all traffic, though you can configure it to chart traffic for specific Applications.
The CDM online help gives the formulas used to chart the graph:
Effective WAN Capacity = 1 / (1-% Reduction Excluding Pass-Through)
% Reduction Excluding Pass-Through = (Original Excluding Pass-Through - Optimized) / (Original Excluding Pass-Through)
2)what is reduction % excluding and including passthrough
Looking at the formulas given above might help you understand. The one is a reduction ratio compared to only the original traffic that is optimized. The other is a reduction ratio compared to all original traffic, whether it is optimized or not. So, if you want to know what kind of optimization you are getting for the traffic that you configured to have optimized, look at the "excluding pass-through" numbers. If you want to know the positive effect that optimization is having on your full traffic load, take a look at the "including pass-through" numbers.
3)What is effectivity capacity including and excluding passthrough ?
The effective capacity is what kind of throughput you can potentially realize on the WAN -- assuming you would fill it to 100% capacity -- because of the level of optimization you are seeing. The "including" numbers show you the effect of optimization compared to all the traffic passing through the WAE whether it is optimized or not. The "excluding" numbers show the effect of optimization compared only to the traffic that is receiving optimizations.
4)With the help of which report, we can show the customer that the file download which took 10 mins in first attempt, is downloaded in 10secons in next attempt?
This one is a little trickier. The reports are much broader than a single connection. They are for all traffic, or for traffic that matches specific defined Applications. You could create a separate Application and matching classifiers for the client and/or server IP addresses and/or ports, run the test, then configure the charts to only show you the data for that Application. By default, statistics for an Application aren’t charted unless you check the "Enable Statistics" box when defining/editing the Application.
5)How to show that the bandwidth utilization has decreased by which %.
You want to look at the % reduction numbers you asked about in #2 above.
6)Which report says that the applications have become this much time faster?
These questions are normally put forwarded by many customers ? Can you please help me with your expertise answer ?
This is probably the hardest question to answer.
"Faster" isn't always easy to define. You are probably talking about user experience rather than statistics found in a network device. What determines that experience? A web page fully populating with all the pictures? A CIFS-based application that saves a file? A custom application that collects data from different servers over different protocols to perform some operation? Much of that is subjective and based on multiple individual requests, sometimes over different protocols.
What we can provide are statistics to show the effect of WAN optimization and application acceleration for specific types of traffic. We can't show you that displaying a web page is N times faster with WAAS, because we don't know which of all the many HTTP requests that are made are specific to the user experience. But we can show that each of the requests received so much overall optimization, so much optimization from DRE, so much optimization from LZ, so much added benefit from HTTP acceleration.
What you would probably do is collect some base-line timings for performing certain user activities, then perform the same operations both cold (first pass) and warm (subsequent passes). Back up those timing numbers with reports from the CM GUI, and perhaps even the "show statistics connection connection-id ". Which reports to use? Start with those Optimization and Acceleration reports. Those are the reports we expect will give the most complete/accurate pictures of the benefit of WAAS. You can also create and even schedule custom reports as needed.

[Request] NTM - Network Traffic Monitor

Hi to everyone:
Could anyone package this?: NTM - Network Traffic Monitor
NTM is a monitor of the network and internet traffic for GNU/Linux. Some characteristics:
* Choice of the interface to monitoring.
* Period to monitoring: Day, Week, Month, Year or Custom Days. With autoupdate.
* Threshold: Autodisconnection if a limit is reached (by NetworkManager).
* Traffic Monitoring: Inbound, outbount and total traffic; Show the traffic speed.
* Time Monitoring: Total time of connections in the period.
* Time Slot Monitoring: Number of sessions used.
* Reports: Show of average values and daily traffic of a configurable period.
* Online checking with NetworkManager or by "Ping Mode".
* The traffic is attributed to the day when the session began.
* Not need root privilege.
* Not invasive, use a system try icon.
NTM is useful for the people that have a internet plan with a limit, and moreover the exceed traffic is expensive.
NTM is write in python and is a open source software, the license is the GNU GPL v2.
A lot of thanks.

#Maintairner: Brieuc Roblin <brieuc.roblin at gmail dot com>
pkgname='ntm'
pkgver='1.2.2'
pkgrel='1'
pkgdesc="Monitor of the network and internet traffic"
arch=('i686' 'x86_64')
license=('GPL')
depends=('pywebkitgtk' 'lsb-release' 'networkmanager')
makedepends=('dpkg')
url=('http://netramon.sourceforge.net/eng/index.html')
source=('http://freefr.dl.sourceforge.net/project/netramon/NTM/ntm-1.x/ntm-1.2.2.deb')
md5sums=('ec438b8c952ac866ffdaa57538d189b7')
build() {
cd "$srcdir"
# Extracting deb
msg2 "Extracting .deb ..."
dpkg-deb -x ntm-*.deb deb
cd "deb"
# Installing
msg2 "Installing..."
cp -r . "$pkgdir"/
I can't really test the program as I'm not using NetworkManager.
Last edited by PyrO_70 (2010-08-20 19:18:24)

UDP traffic analyzed in L4 traffic monitor?

Dear all,
I just wonder if anyone knows whether UDP traffic is analyzed by the WSA's L4 traffic monitor?
It just tells "all ports" in the settings and reports also only reflect port numbers but no details like
which protocol (tcp/udp).
Anyone?
Best,
Hascha

UDP ports will not be blocked.
The L4TM will use the T1 interface to detect traffic to destinations that are on its blacklist. Once detected, the the data interface on the WSA will send a packet with the TCP reset flag to the client to prevent a TCP connection.
I have not tested this so someone correct me if I am wrong. I am answering this based on my understanding of the L4TM feature, and how it works. Since UDP is connectionless, there is no connection for it to kill.
Now this makes me wonder about the Monitor feature though. But I am almost certain it will not block if the action is set to block.
I'll check this out when I'm in the office and will get back to you.
-Vance

24 Hr Network Traffic Monitoring

Hi Markus,
I got this 24-hour Network traffic monitoring output using the program you gave me ;)
I run every hour this > ./network-traffic.sh -c 1
It will give me 1 line output like this,
Monitoring eth0 every 3 seconds. (RXbyte total = 1 Gb TXbytes total = 2 Gb)
RXbytes = 58 Kb TXbytes = 51 Kband I call this program every hour via cron, to produce and output like this:
27-Oct-2010 00:00:07    RXbytes = 10 Kb TXbytes = 9 Kb
27-Oct-2010 01:00:07    RXbytes = 11 Kb TXbytes = 9 Kb
27-Oct-2010 02:00:07    RXbytes = 7 Kb TXbytes = 6 Kb
27-Oct-2010 03:00:07    RXbytes = 48 Kb TXbytes = 42 Kb
27-Oct-2010 04:00:07    RXbytes = 448 b TXbytes = 0 b
27-Oct-2010 05:00:08    RXbytes = 128 b TXbytes = 0 b
27-Oct-2010 06:00:07    RXbytes = 128 b TXbytes = 0 b
27-Oct-2010 07:00:08    RXbytes = 256 b TXbytes = 0 b
27-Oct-2010 08:00:08    RXbytes = 14 Kb TXbytes = 24 Kb
27-Oct-2010 09:00:07    RXbytes = 11 Kb TXbytes = 10 Kb
27-Oct-2010 10:00:08    RXbytes = 11 Kb TXbytes = 10 Kb
27-Oct-2010 11:00:07    RXbytes = 48 Kb TXbytes = 85 Kb
27-Oct-2010 12:00:08    RXbytes = 9 Kb TXbytes = 8 Kb
27-Oct-2010 13:00:07    RXbytes = 13 Kb TXbytes = 28 Kb
27-Oct-2010 14:00:08    RXbytes = 53 Kb TXbytes = 46 Kb
27-Oct-2010 15:00:08    RXbytes = 13 Kb TXbytes = 20 Kb
27-Oct-2010 16:00:08    RXbytes = 13 Kb TXbytes = 20 Kb
27-Oct-2010 17:00:08    RXbytes = 40 Kb TXbytes = 94 Kb
27-Oct-2010 18:00:07    RXbytes = 13 Kb TXbytes = 30 Kb
27-Oct-2010 19:00:08    RXbytes = 6 Kb TXbytes = 9 Kb
27-Oct-2010 20:00:08    RXbytes = 12 Kb TXbytes = 12 Kb
27-Oct-2010 21:00:08    RXbytes = 15 Kb TXbytes = 40 Kb
27-Oct-2010 22:00:07    RXbytes = 9 Kb TXbytes = 11 Kb
27-Oct-2010 23:00:07    RXbytes = 11 Kb TXbytes = 9 KbIs this output data gathering style valid?
I want to give this report to my boss using spreadsheets, but I want to put comments like :
1. at what hour is the network busiest?
2. at what hour is the network the not-busiest?
How do I sort this output from busiest (descending order)?
Thanks a lot,
Ms K

Hi again markie,
This is my actual source code of eth0stat.sh:
# File: eth0stat.sh
# Purpose: Gather network traffic increase between readings
# Command: . ./eth0stat.sh
ifcmd='/sbin/ifconfig eth0'
timestamp=$(date "+%D %T")
logfile=/u01/Monitor/eth0stat.txt
old_rxbytes=$RXBYTES
old_txbytes=$TXBYTES
get_rxbytes() {
   $ifcmd | grep "RX bytes" | cut -d: -f2 | awk '{ print $1 }'
get_txbytes() {
   $ifcmd | grep "TX bytes" | cut -d: -f3 | awk '{ print $1 }'
RXBYTES=$(get_rxbytes); export RXBYTES
TXBYTES=$(get_txbytes); export TXBYTES
if [ $old_rxbytes > 0 ]; then
   diff_rxbytes=$(($RXBYTES - $old_rxbytes))
else
   diff_rxbytes=0
fi
if [ $old_txbytes > 0 ]; then
   diff_txbytes=$(($TXBYTES - $old_txbytes))
else
   diff_txbytes=0
fi
echo "$timestamp,RXbytes:$diff_rxbytes,TXbytes:$diff_txbytes" >> $logfileI created the new program you gave me (eth0stat.sh) and called it from cron every our, but I got this result:
11/01/10 15:00:07,RXbytes:0,TXbytes:0
11/01/10 16:00:07,RXbytes:0,TXbytes:0
11/01/10 17:00:07,RXbytes:0,TXbytes:0
11/01/10 18:00:07,RXbytes:0,TXbytes:0
11/01/10 19:00:07,RXbytes:0,TXbytes:0
11/01/10 20:00:07,RXbytes:0,TXbytes:0
11/01/10 21:00:07,RXbytes:0,TXbytes:0
11/01/10 22:00:08,RXbytes:0,TXbytes:0
11/01/10 23:00:07,RXbytes:0,TXbytes:0
11/02/10 00:00:07,RXbytes:0,TXbytes:0
11/02/10 01:00:08,RXbytes:0,TXbytes:0
11/02/10 02:00:08,RXbytes:0,TXbytes:0
11/02/10 03:00:07,RXbytes:0,TXbytes:0
11/02/10 04:00:07,RXbytes:0,TXbytes:0
11/02/10 05:00:07,RXbytes:0,TXbytes:0
11/02/10 06:00:08,RXbytes:0,TXbytes:0
11/02/10 07:00:08,RXbytes:0,TXbytes:0
11/02/10 08:00:07,RXbytes:0,TXbytes:0
11/02/10 09:00:08,RXbytes:0,TXbytes:0
11/02/10 10:00:08,RXbytes:0,TXbytes:0The output has all 0 bytes :( . Is there something I missed out?
I compared it to the other one I got:
1-Nov-2010 15:00:07     RXbytes = 10 Kb TXbytes = 9 Kb
1-Nov-2010 16:00:07     RXbytes = 10 Kb TXbytes = 9 Kb
1-Nov-2010 17:00:07     RXbytes = 10 Kb TXbytes = 9 Kb
1-Nov-2010 18:00:07     RXbytes = 10 Kb TXbytes = 9 Kb
1-Nov-2010 19:00:07     RXbytes = 10 Kb TXbytes = 9 Kb
1-Nov-2010 20:00:07     RXbytes = 10 Kb TXbytes = 9 Kb
1-Nov-2010 21:00:07     RXbytes = 10 Kb TXbytes = 9 Kb
1-Nov-2010 22:00:08     RXbytes = 10 Kb TXbytes = 9 Kb
1-Nov-2010 23:00:07     RXbytes = 11 Kb TXbytes = 9 Kb
2-Nov-2010 00:00:07     RXbytes = 10 Kb TXbytes = 9 Kb
2-Nov-2010 01:00:08     RXbytes = 10 Kb TXbytes = 9 Kb
2-Nov-2010 02:00:08     RXbytes = 10 Kb TXbytes = 9 Kb
2-Nov-2010 03:00:07     RXbytes = 7 Kb TXbytes = 6 Kb
2-Nov-2010 04:00:07     RXbytes = 256 b TXbytes = 0 b
2-Nov-2010 05:00:07     RXbytes = 320 b TXbytes = 0 b
2-Nov-2010 06:00:08     RXbytes = 0 b TXbytes = 0 b
2-Nov-2010 07:00:08     RXbytes = 466 b TXbytes = 0 b
2-Nov-2010 08:00:07     RXbytes = 1 Mb TXbytes = 19 Mb
2-Nov-2010 09:00:08     RXbytes = 1 Mb TXbytes = 22 Mb
2-Nov-2010 10:00:08     RXbytes = 12 Kb TXbytes = 91 KbThe is seem to be movement starting at 8am Nov 2, 2010.
Please help me debug the eth0stat.sh.
Thanks again so much

Payment statistic report

Is there a standard tcode for payment statistic report to identify payments that really due based on actual pymt date.

hello chloe lam,
That will be possible if your create your report via XLR with required fields.
regards,
Wilma Wang
SAP Business One Forums Team

Error while Deploying Monitoring Server Reports!

Hi,
Trying to install the monitoring role with reporting services but must have missed one or several steps! :)
Have 1 standard edition server and 1 server running Lync monitoring and SQL (that I installed myself, hopefully correct)
Have installed SQL with instance LYNCSQL\LYNSQL (also checked the reporting services feature)
Have intalled the Standard Edition server
Have installed the Monitoring role
Now I want to "Deploy Monitoring Server Reports" from the Lync Server Deployment Wizard.
Specifying Monitoringserver with FQDN (the same server as the acctual SQL server)
Specifying LYNCSQL\LYNCSQL as the Instance\InstanceID
Specifying the systemaccount that I added during the SQL server installation
Don't specifying any usergroup
Receiving the following error:
Could not get objects from namespace root\Microsoft\SqlServer\ReportServer. The RPC server is unavailable. (Exception from HRESULT: 0x800706BA)The RPC server is unavailable. (Exception from HRESULT: 0x800706BA)Cannot get the ReportServerWebService
URL. Verify that Reporting Services is deployed and configured properly on the target SQL instance:"LYNCSQL\LYNCSQL", and that WMI is included on the exception list of firewall setting on the server that is running Reporting Services.Invalid parameter
Windows Firewall is Off!
SQL Server 2008 x64 SP2
When looking in the Lync Server Console I see green status of Standard Edition and the Monitoring Server, but from my LYNCSQL\LYNCSQL i have status of N/A.
Where to start? :)
Update:
Logged on to the Reporting services configuration manager and here are the settings:
Use Built in Account: Local System -> correct or should it be sys.lyncsql as I mentioned before?
Virtual Directory: ReportServer_LYNCSQL
URL: http://servername:80/ReportServer_LYNCSQL
SSL: Not Selected

Hi,
Firstly, you need make sure Web Service URL and Report Manager URL could be opened in both Lync FE and SQL server.
If prompt authentication chanllenges you have to change the built in account with "Network Service".
Furthermore, make sure firewall is turned off when troubleshooting to rule out ports and connection issue.
Update let us know.
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
Hi Ben,
I have a similar problem where I cant deploy reports. Also, I´m prompted when trying to access /Reports and /ReportsServer using IE on reporting services server.
What do you mean with change the built in account with "Network Service ?
Chech my thread:
http://social.technet.microsoft.com/Forums/en-US/ocsmonitoring/thread/7e213177-9e61-4859-b2a8-301813c4298d
Best regards, Daniel
www.twitter.com/danielullmark

Issue when trying to deploy Monitoring Server Reports on Deployment Wizard

Hi all.
I have to install the Monitoring Server Role on a server that already has the Lync Server 2010 up and running.
I'm new to Lync Server so my experience with the product is limited, so I need some help with an issue.
I followed the Deployment Guide and for now I managed to do the following:
- Installed an SQL Server 2008 Standard with SP1 with SSRS also;
- Updated the Topology to include a Monitoring Server, and also published the new topology;
- Installed the new components of the monitoring server.
I can also refer that the SQL Server Instances and Lync Server Front-End are in the same server h where I'm installing the monitoring server, and there is only one Front End Pool.
As far as I can tell everything was successfully done, and I couldn't find any errors until now.
And finally the issue appeared when I wanted to deploy the Monitoring Server Reports to the Reporting Services Server.
In the deployment Wizard of the Lync Server 2010 the link for that option is disabled, no further information is given.
I tried to find on the ISO and .exe or .msi files that could deploy the reports, but could not find any.
I believe it isn't a problem of permissions of the user because i followed the documentation.
I hope someone can help me find the problem, and if possible a solution for it.
Best regards.

Hi,
From your description above, it is a Lync Server 2010 Enterprise Edition and you deploy Monitoring Server in the same Server with FE Server.
If it is the case, you may meet unknown issues as you must deploy Monitoring Server on a separate Server. You can only collocate Monitoring Server with Archiving Server.
Please try to delete the Monitoring Server configuration in Lync Topology and then republish topology, and rerun Step 2. After these, please deploy Monitoring Server with a Separate Server and test if the issue happen again.
More details:
https://technet.microsoft.com/en-us/library/gg398102(v=ocs.14).aspx
Best Regards,
Eason Huang
Eason Huang
TechNet Community Support

L4 Traffic Monitor question

In the IronPort web security appliance documentation, it indicates that the L4 traffic monitor ports (T1 and/or T2) should be connected to either a network tap or switch span.
I'm a little confused as to how this is supposed to be set up.
Does it mean that you take 2 ports on a switch, one on the same subnet/vlan as the P1 interface (data) on the IronPort, and the other that is on the subnet/vlan as the firwall (outbound Internet traffic) and create 2 monitor sessions (spans)? If so, where are these sessions pointed to?
Isn't the IronPort supposed to be doing the tapping/inspection?
The whole external tap thing has me confused.

Colin,
One way to think of it is that the WSA has 2 inspection engines that don't actually talk to one another...
1. the web proxy, where you're using WCCP to send specific traffic to
2. the L4TM engine that you send a spanned port to to catch all of the other weird stuff.
The web proxy does all of the user tracking/policy stuff, etc. Watching a specific set of ports.
The L4TM is intended for malware that might be running on your net... sort of like the Botnet Traffic filter that's available on ASA.
That said, you'll use 1 port for P1 on whatever vlan, redirection to that happens via WCCP or explicit proxy.
For the L4TM tap you can use 1 or 2 ports on the swtich, or none if you use an external tap. In the Network/Interfaces page, you set whether you want L4TM to use simplex or Duplex. If you use Duplex, just do a span session off the port the firewall is plugged into to the port that you connect T1 into...
If you use Simplex, you do 2 span sessions off of the port the firewall is connected to... ingress traffic on the port (eg. out of the firewall) to the port T1 is connected to, egress traffic on the port (eg. going to the firewall) spanned to the port T2 is hooked up to.
If you use an external tap, put it inline between the firewall and the switch, set the WSA for duplex and connect the "monitor" port to T1...
Hope that helps!
Ken

Can I get from iConnect financijal and statistic report for single Newsstand application ?

I have problem to get full financial and statistic report for one single application?
Is there a posibilty thay kind of report doesn/t exist?
I can't belive...!

Welcome to AppleWorks, a discontinued application. I'll try to get you to the iPad forum.

Statistic report with figures that will not change when rerun months later

Hi,
Is there any good practices that we can follow to create statistic reports with figures that will not change even when rerun after few months later?
My scenario is my statistic report is generated based on data that is "alive" which means the record will get change after a period of time. So, if you generate the statistic report in for January 2006 in the month of January and regenerate in May for the January 2006 statistic, the figure is different. But what I want is to be able to get the same figures.
I know in this case looks like we need some sort of summary tables, so posting this to get advice on the best way to design such summary tables. Please comment if there is other ways of doing it.
Summary tables may work for statistic report, but how to support detail report listing where the records are required to be the same when it was generated few months ago.
Please advise.
Thank you.

What happens, when you execute a report today is the following: a select statement is fired at the data base and the result set is displayed in the report. The data can change after the moment you launched your report. What you could do to keep the result set the same, is implementing a user parameter that fills your date discriminator.

Need help in generating L4 Traffic monitor logs

Hi,
As a part of my project I need to study different types of logs produced by Cisco IronPort. I could generate some access and authentication logs however not sure about generating the L4 Traffic Monitor logs. Can anyone point me to right documentation that will help me generate those logs?
Thanks,
Harshad Kashikar

Harshad,
L4 Traffic Monitoring needs to be configured within the IronPort - first question is do you have a SPAN/TAP port set up on your switch to capture L4 traffic?
Second, I only use this feature to capture information on malware/spyware - I have seen P2P, IRC, and 'phone-home' traffic amongst other things. Do you have an infected host you can monitor?
BF

L4 traffic monitor - blocking traffic ?

Hello
How does L4 traffic monitor is blocking traffic if T1/T2 ports are "tap/sniffed ports" ?
For SPAN we might have "ingress vlan feature" which would allow us to send TCP RST (like IPS does),
but for hardware TAP we do not have such a feature.
So - maybe L4 traffic monitor can not block any traffic, just make a decision what to block and execution is on WebProxy and P1/2 ports ?
Thanks

Michael,
Yes, the reset is sent via P1
Ken
Sent from Cisco Technical Support iPad App

Can an Ironport work in both WCCPv2 and L4 Traffic monitoring modes at the same time?

Hello Ciscoers,
We have an ironport installed and we use WCCPv2 to redirect the traffic. And as it occurs, I have a need to forward the traffic for another network, that uses another path to the Internet.
So I was thinking using the L4 Traffic Monitoring.
To the best of your knowledge, is there a way to have the appliance use both WCCPv2 and L4 Traffic monitoring at the same time? From the configuration, it's one or the other.
Thanks,
J.

Ok. I'll try.
As a matter of fact, I plan to use policy-based routing to forward all the "interesting" traffic to the appliance.
For your TCP-Resets not seen, do you allow ingress on the span session?
J.

UCS Central - Uplink Traffic Monitoring - Statistic reporting

Similar Messages

Maybe you are looking for