Message tracking

[Bechara.abouraha]

Hello,

when there is a cluster mode between two IronPort,

what are the things that are replicated ? and does the message tracking logs will be replicated?

[Donald Nash]

Centralized Management can share all aspects of the configuration other than items which are by necessity local (network interfaces, IP addresses, host names, quarantines, etc.) There is also a great deal of granularity over what aspects of the config get shared, it's not all or nothing. You can also view operational data (logs, stats, message tracking), across a cluster, although this data is not replicated or pooled like the config is.

++Don

[Bechara.abouraha]

Thanks Don,

I am not able to see the message tracking in a cluster mode for the other appliance,

I can only see the appliance that I am logged on to it,

Best Regards,

Bec

[Donald Nash]

My bad on the message tracking bit. I view stats remotely all the time, but message tracking is a different beast.

++Don

[shannon.hagan]

For messaging tracking to be centralized, you would need an M-Series box that would get the data from both - the M-Series also does centralized reporting as well.

[donnylee · Accepted solution]

Logs (mail logs, Anti Spam, Anti virus logs, etc.), message tracking and hardware statistics of each ESA in the cluster ONLY can be viewed from the appliance itself.

Cluster only shares policies in general and there are limited configuration options that can be accessed from cluster mode.

Regards,

Donny

[Donald Nash]

Logs (mail logs, Anti Spam, Anti virus logs, etc.), message tracking and hardware statistics of each ESA in the cluster ONLY can be viewed from the appliance itself.

I meant messaging stats (i.e. everything in the Monitor tab other than Message Tracking), not hardware stats.

Cluster only shares policies in general and there are limited configuration options that can be accessed from cluster mode.

Huh? CM shares almost everything. Our whole configuration above the interface definitions and IP routes is shared cluster wide.

Bechara: Read chapter 8 of the Advanced Config Guide. Look for the section called "Restricted Commands" to see the limits of Centralized Management. As I said, configuration items that affect the local hardware can't be shared, although they can be manipulated remotely. And only a tiny handful of things can't be done via CM at all.

++Don

[donnylee]

Don,

CM shares almost everything, including security policies and mail policies in general. There is no need to list point-by-point of what can be shared using CM. In my opinion, the main thing is users understand some main features in ESA that cannot be shared or accessed via CM, like quarantines, interface config, and mail logs.

regards,

Donny