Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Sensor/IDSM Statistics under Event Viewer

Tried to view the Sensor/IDSM statistics from EventViewer (View/Statistics...), and got 2 warning message - Sorry. The postofficed application on host idsm does not supply statistics. / The postofficed application on host cspm does not supply statistics.

Is this normal or configuration need to be done on IDSM/CSPM in order to view sensor statistics from Eevent Viewer.

Tried View/Connection Status..., and this worked fine.

Please advise.

1 REPLY
Cisco Employee

Re: Sensor/IDSM Statistics under Event Viewer

What you are experiencing is a side affect of where the viewer gets the information to send the queries, and there is an easy workaround for it.

Here is my understanding of how it works. It may not be completely accurate, but should get you enough information to get your statistics to work:

If no alarm is selected, but a sensor is selected in the status panel, then the selected sensor hostid, orgid, and the postofficed application id are passed to the query.

This works just fine for connection status queries because postofficed is being queried.

But won't necessarily work for statistics queries because packetd should be queried, but the query was given postofficed's information and you get the error you saw.

If an alarm is selected then the sensor hostid, orgid, and the application id for that alarm are sent to the query.

If the alarm came from postofficed (such as route up/down alarms, daemon up/down alarms, and postofficed initial notification message) then you wind up in the same situation I noted above with the error you saw when statistics is viewed.

BUT is the alarm is a packetd alarm (all alarms except those I noted above) then the packetd application id is passed to the query.

So is a packetd alarm is selected then the statistics query will work appropriately.

BUT the connection status query might not.

SO if you want to query the packet statistics for the sensor, be sure to select an alarm from packetd on that sensor before you execute the query.

85
Views
0
Helpful
1
Replies
CreatePlease login to create content