ESA - SMA data synchronization

[tamaszoltan]

Hello!

I have an ESA appliance and I'd like to integrate it to an SMA.
Does the ESA synchronice all of the old statistics and report data to the SMA when it connected?

Thanks!
Zoltan

[Libin Varghese · Accepted solution]

The Email Security appliance only stores data if local reporting is used.

If centralized reporting is enabled for the Email Security appliance then the Email Security appliance does NOT retain any reporting data except for System Capacity and System Status.

So once you integrate it with the SMA all existing reports on the ESA should move over to the SMA, keeping in mind that disk space for reporting should be set accordingly to prevent loss of data.

Regards,

Libin Varghese

[Jakub Bros]

Hello All,

I would like to clarify few things here, there is no technical option to merge the tracking or reporting database from a local ESA database to the SMA database.

SMA creates aggregate reports from multiple ESA's, therefore local and centralized reporting keeps data in a different way:

• local - each ESA creates reports locally with gathered data
• centralized - ESA's are aggregating data which will be downloaded by SMA in order to generate reports

Because of that, SMA cannot pull local reporting data from the ESA.

The ESA reporting behaviour is described in ESA user guide - https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_0101010.html#task_1159793 

When centralized reporting is enabled on an Email Security appliance:

• Existing data on the Email Security appliance for the monthly report is not transferred to the Security Management appliance.
• Archived reports on the Email Security appliance are not available.
• The Email Security appliance stores only a week’s worth of data.
• New data for the monthly and yearly reports is stored on the Security Management appliance.
• Scheduled reports on the Email Security appliance are suspended.
• You can no longer access the scheduled report configuration page on the Email Security appliance.

In order to clarify Libin's answer :

Spoiler

So once you integrate it with the SMA all existing reports on the ESA should move over to the SMA, keeping in mind that disk space for reporting should be set accordingly to prevent loss of data.

Those data could have been moved, IF centralized reporting would have been enabled on ESA prior to integration with SMA. If the local reporting was changed to centralized just before integration with SMA there was no old reporting data which could have been transfered.

Regards,

Jakub Bros