CSC-SSM : The result of the 'Summary status' does not match with the result of 'Logs'.

Unanswered Question
Aug 2nd, 2010

Hi there,

I have a proplem about CSC-SSM.
It is that the result of the 'Summary status' does not match with the result of 'Logs'.
Please see following;

************************************
Summary
> Web(HTTP) tab choice
> URL filering/Anti-Phishing
> Today

I can see '324 counts'

Vs.

Logs
> Query
Log type: URL Filtering/Anti-Phishing
Protocol:  HTTP
Time period: Today
> Display Log

I can see '1500 counts'
************************************

I did 'Refresh' one hour later.

************************************
Summary
> Web(HTTP) tab choice
> URL filering/Anti-Phishing
> Today

I can see '324 counts'
(There is no change)

Vs.

Logs
> Query 
Log type: URL Filtering/Anti-Phishing
Protocol:  HTTP
Time period: Today

I can see '1900 counts' (400 increase)
************************************

However, it does not seem that Summary does not work at all.
When I looked at summary on the next day, all value has changed because 'Last 7 days' is reflected to the yesterday's counter.
In other words,'summary' seems to work.


My question is the followings.

1. Does not the "Today" column of "Summary" work instantly?
2. Is it expected movement that both results do not match? Or are there other problems?
3. Dose this relate with that'TMCM-Agent service' stops? Or are there other problems?


I attach following;

-------------------------------------------------
net01# show module 1 detail
Getting details from the Service Module, please wait...
ASA 5500 Series Content Security Services Module-10
Model:              ASA-SSM-CSC-10
Hardware version:   1.0
Serial Number:      JAF11115354
Firmware version:   1.0(11)2
Software version:   CSC SSM 6.2.1599.2
MAC Address Range:  001a.6d7c.8e9a to 001a.6d7c.8e9a
App. name:          CSC SSM
App. Status:        Up
App. Status Desc:   CSC SSM scan services are available
App. version:       6.2.1599.2
Data plane Status:  Up
Status:             Up
HTTP Service:       Up                                                         
Mail Service:       Up                                                         
FTP  Service:       Up                                                         
Activated:          Yes                                                        
Mgmt IP addr:       192.168.10.35                                              
Mgmt web port:      8443                                                       
Peer IP addr:       <not enabled>


Enter a number from [1-10]: 4

                         Service Status
---------------------------------------------------------------------

The CSC SSM RegServer service is running
The CSC SSM URLFD service is running
The CSC SSM ScanServer service is running
The CSC SSM HTTP service is running
The CSC SSM FTP service is running
The CSC SSM Notification service is running
The CSC SSM Mail service is running
The CSC SSM GUI service is running
The CSC SSM SysMonitor service is running
The CSC SSM Failoverd service is running
The CSC SSM LogServer service is running
The CSC SSM SyslogAdaptor service is running
The CSC SSM Syslog-ng service is running
The CSC SSM TMCM-Agent service is stopped  <<<< ???

Do you want to restart all services? [y|n] n
-------------------------------------------------

Could anybody kindly point out how to troubleshoot this kind of problem?
Thanks in advance.


Regards,

Ilhong

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Panos Kampanakis Mon, 08/02/2010 - 10:36

The counters should refresh instantly. Today should reflect all the incidents from today.

Now if the logs show more, keep in mind that the logs could be spanning today as different times. Also, check what events the logs have because per page you could have 2-3 block (for different images for example) which will not count against the Today counter.

I hope it helps.

PK

Magnus Mortensen Mon, 08/02/2010 - 18:29

Ilhong,    

     The TMCM Agent is a process that runs on the CSC to allow it to connect to a TMCM server in your network (separate product sold by TrendMicro). By default it is not running.

- Magnus

Actions

This Discussion

Related Content