real time ? and IDSM 2.5.1 and report of events

[p.emery]

hi

i have a powerfull server 2 penhtium with 512 ram

i have installed CSPM2.3.2 and i will make a demo for a customer and i monito a pc which is under attack but all events are coming like 2-3 minutes after have been don why `?

is it a mistake from me ?

thanks to help me

best regards

philippe

[k.poplitz]

It sounds like you meet minimum system requirements. You should talk to Cisco.

[marcabal]

I believe there may be a timer you can set for how often the viewer queries the database for events. Check the CSPM alarm viewer menu options.

Another thing to check:

Use CSPM to enable logging of the alarms on the sensor itself.

Then generate the alarm.

Wait a few seconds and check the alarm log file on the sensor

(If using IDSM use the "show event current" command under "diag" mode)

If the alarm is in the sensor log, but takes awhile to show on CSPM then it is likely a CSPM issue, but if it takes a few minutes to show up in the sensor log file then it is a sensor issue.