cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1388
Views
0
Helpful
2
Replies

CSC-SSM : The result of the 'Summary status' does not match with the result of 'Logs'.

ilmin
Level 1
Level 1

Hi there,

I have a proplem about CSC-SSM.
It is that the result of the 'Summary status' does not match with the result of 'Logs'.
Please see following;

************************************
Summary
> Web(HTTP) tab choice
> URL filering/Anti-Phishing
> Today

I can see '324 counts'

Vs.

Logs
> Query
Log type: URL Filtering/Anti-Phishing
Protocol:  HTTP
Time period: Today
> Display Log

I can see '1500 counts'
************************************

I did 'Refresh' one hour later.

************************************
Summary
> Web(HTTP) tab choice
> URL filering/Anti-Phishing
> Today

I can see '324 counts'
(There is no change)

Vs.

Logs
> Query 
Log type: URL Filtering/Anti-Phishing
Protocol:  HTTP
Time period: Today

I can see '1900 counts' (400 increase)
************************************

However, it does not seem that Summary does not work at all.
When I looked at summary on the next day, all value has changed because 'Last 7 days' is reflected to the yesterday's counter.
In other words,'summary' seems to work.


My question is the followings.

1. Does not the "Today" column of "Summary" work instantly?
2. Is it expected movement that both results do not match? Or are there other problems?
3. Dose this relate with that'TMCM-Agent service' stops? Or are there other problems?


I attach following;

-------------------------------------------------
net01# show module 1 detail
Getting details from the Service Module, please wait...
ASA 5500 Series Content Security Services Module-10
Model:              ASA-SSM-CSC-10
Hardware version:   1.0
Serial Number:      JAF11115354
Firmware version:   1.0(11)2
Software version:   CSC SSM 6.2.1599.2
MAC Address Range:  001a.6d7c.8e9a to 001a.6d7c.8e9a
App. name:          CSC SSM
App. Status:        Up
App. Status Desc:   CSC SSM scan services are available
App. version:       6.2.1599.2
Data plane Status:  Up
Status:             Up
HTTP Service:       Up                                                         
Mail Service:       Up                                                         
FTP  Service:       Up                                                         
Activated:          Yes                                                        
Mgmt IP addr:       192.168.10.35                                              
Mgmt web port:      8443                                                       
Peer IP addr:       <not enabled>


Enter a number from [1-10]: 4

                         Service Status
---------------------------------------------------------------------

The CSC SSM RegServer service is running
The CSC SSM URLFD service is running
The CSC SSM ScanServer service is running
The CSC SSM HTTP service is running
The CSC SSM FTP service is running
The CSC SSM Notification service is running
The CSC SSM Mail service is running
The CSC SSM GUI service is running
The CSC SSM SysMonitor service is running
The CSC SSM Failoverd service is running
The CSC SSM LogServer service is running
The CSC SSM SyslogAdaptor service is running
The CSC SSM Syslog-ng service is running
The CSC SSM TMCM-Agent service is stopped  <<<< ???

Do you want to restart all services? [y|n] n
-------------------------------------------------

Could anybody kindly point out how to troubleshoot this kind of problem?
Thanks in advance.


Regards,

Ilhong

2 Replies 2

Panos Kampanakis
Cisco Employee
Cisco Employee

The counters should refresh instantly. Today should reflect all the incidents from today.

Now if the logs show more, keep in mind that the logs could be spanning today as different times. Also, check what events the logs have because per page you could have 2-3 block (for different images for example) which will not count against the Today counter.

I hope it helps.

PK

Magnus Mortensen
Cisco Employee
Cisco Employee

Ilhong,    

     The TMCM Agent is a process that runs on the CSC to allow it to connect to a TMCM server in your network (separate product sold by TrendMicro). By default it is not running.

- Magnus

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: