67-5
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter67 Managing Reports
Understanding Report Management
Report Manager aggregates this collected information at 15-minute, hourly, daily, and monthly intervals.
Fifteen-minute aggregated data is kept a day, hourly data up to five days, and the other data for 90 days.
The aggregation schedule occurs at fixed times: 15-minute aggregation occurs at 00, 15, 30, and 45
minutes past the hour; hourly aggregation occurs on the hour (00 minutes); daily aggregation occurs at
the change of day (when midnight is reached, the day is aggregated); monthly aggregation occurs at the
change of the month.
The aggregation cycle has implications in what you will see in reports:
•Report data does not cover the immediate past. Instead, it covers the most recently completed whole
time period of the selected duration. For example, a one-day report covers yesterday, it does not
include data for today. In other words, a one day report is not the previous 24 hours starting from
the time the report is generated.
•When configuring reports with a custom time period, you cannot select a time period of less than 15
minutes long. A report will always contain at least 15 minutes of aggregated data. Minute entries are
rounded to the nearest aggregation time (that is, 00, 15, 30, or 45). You can configure minutes only
for custom reports that start and end on the current day.
Also, because hourly data is kept only up to five days, you can specify hours in a custom time period
only for the past five days.
•You cannot generate a report for periods that are longer than the device has been monitored. For
example, when you start the Event Manager service for the first time, you will not be able to generate
a monthly report until after the month changes. This might be only a few days (for example, if you
start the service on the twenty-ninth day of the month), or it might be almost a full month (for
example, if you start the service on the first day of the month).
The exception to this rule is the custom time period report. Custom time period reports are generated
using daily aggregation data, so you can select any custom time period.
Note Be aware that your first month of aggregated data might be significantly less than one
month’s worth of data. If you compare monthly reports, this might appear as a significant
discrepancy when in reality you are comparing 30 days of data to 15 days (as an example).
You can configure the default time interval for predefined system reports and configure time intervals in
individual reports. The following topics explain the time controls:
•Configuring Default Settings for Reports, page 67-24
•Editing Report Settings, page 67-21
Understanding Report Manager Access Control
The user privileges assigned to your username control what you can do in Report Manager. If you use
local users, or other types of non-ACS access control, then all users have access to Report Manager and
all reports. However, the following access limits are imposed:
•You must have system administrator or network administrator privileges to configure default
settings for the predefined system reports. See Configuring Default Settings for Reports,
page 67-24.
•You must have system administrator or network administrator privileges to do the following to
another user’s schedules: see them, enable or disable them, view results generated from them, or
delete them. See the following topics:
–
Viewing Report Schedules, page67-28