Problems with report generation running VSM 2.1, stopped generating reports

[sguerrero]

I am using VSM 2.1 and was generating reports OK.Now when I have 46 reports stored, I generate reports and are not displayed anymore, eventhough events exists. In the mean time I discover what the problem is, I´d like to backup all events I have in my IDSs, how can I do it? When I access via https to each sensor, I notice I have events stored since the begining of this month and because I cannot create reports, want to recover this information. Therwise, since https access, how come can I generate a backup of these events.Thanks for any help!

[sguerrero]

Does somebody have a suggestion for my problem? I need to solve these issues:

1.- I need to know why I cannot generate reports any more, I am able to perform complete report generation, system never sends any error message but it never shows the reports, as if they were not performed. Have 5 sensors and any of these is generating a report.

2.- When I access each IDS via https, they have kept alarm report since August 1st, also, if I display the event monitor with old dates (august 1st form 00:00 to 11:59), I get alarms, but cannot generate report. So, what I want to do before my events are erased by the limit of logs, is to know how to store these events kept in each sensor, send them to a differen file.

3.- Also, there is another question related to this: Are sensors capable of store up to 2,000,000 log events in FIFO mode? or how many is the limit? Also, reading older posts related to this, one of them mentions VMS can keep only 30,000 events...do the problem I have with reports has something to do with this limit? And this limit is only related to VMS but sensor itself can log up to 2,000,000 ??

I got little confuse, if anyone has any answer for these topics, I would appreciate it quit a lot.

Thanks for any help

Thanks for any help.

[darin.marais]

Hi there,

I remember my days of VMS 2.1 and if I can recall I had precisely the same issues as you have experiences. IMHO, I would make the transition to VMS 2.2 and SecMon 1.2.3.

The problem is probably as a result of one of the VMS system services that have stopped unexpectedly.

The following URL will provide tips on identifying and updating to the latest CiscoWorks VMS software

http://www.cisco.com/kobayashi/sw-center/cw2000/vms-planner.shtml

If you do make the step, don’t forget to add CiscoWorks-VMS-2.2-Update-1-w2kl-k9.exe to the installation and all the necessary patches.

Things will work much better after this.