IronPort S170 Appliance

[davethomp]

Occasionally we get the message that logging can’t keep up but within seconds to a minute we get a second message stating it has “caught up”.

The Critical message is:

Reporting Client: The reporting system is unable to maintain the rate of data being generated.  Any new data generated will be lost.

Product: Cisco IronPort S170 Web Security Appliance
Model: S170
Version: 7.7.0-757
Serial Number: 503DE59CF1E5-FTX1602M08G
Timestamp: 23 Apr 2015 13:21:31 -0400

The Info message is:

Reporting Client: The reporting system is now able to handle new data.

Product: Cisco IronPort S170 Web Security Appliance
Model: S170
Version: 7.7.0-757
Serial Number: 503DE59CF1E5-FTX1602M08G
Timestamp: 23 Apr 2015 13:21:35 -0400

• Cisco recommends upgrading appliance but funds are tight! This just started happening. Any clues for resolution??

[Raul Ricano]

I am having this same issue.  Did you ever get this figured out?

Thanks,

Raul

[Raul Ricano]

Ended up resolving my issue by deleting the reporting DB and basically rebuilding it.  Hope this helps someone else. 

Instructions: Enter the following command as each page comes up.

diagnostic

reporting

deletedb

Link for more details.  I know the link is for a email gateway, but the steps are the same.

http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118394-technote-esa-00.html

-Raul