Cisco Systems DOC-78-17916 Policy Tuning and Troubleshooting

2-7

Installing Management Center for Cisco Security Agents 5.2

78-17916-01

Chapter 2 Deployment Planning

Policy Tuning and Troubleshooting

• Agent update (with CTA) (downstream): 16666.67 Kb/sec, during update

timeframe

As an example of how you could compute network load using the data points

provided here, take 100,000 agents, each generating an average of 3 events per

day, and multiply Event update size, by number of Event updates, by number of

agents, per a time frame of your choosing and average out a network load.

You can use the following data points for computing database sizing. The

following numbers average table size based on the upper limit of a 100,000 agent

deployment.

• Event table size: 11707.02 Mb

• Formatted event table: 13658.20 Mb

• Other tables: 20000 Mb

• Total database size; 45365.23 Mb

Policy Tuning and Troubleshooting

Once you have started your CSA pilot, you need to tune the policies to suit your

needs and troubleshoot any problems that occur.

This section presents some overall guidelines for tuning and troubleshooting your

CSA pilot. Please read through this section carefully and consider the specific

needs and requirements of your pilot before moving on to actually using the

techniques. Here are the most important guidelines to follow when tuning and

troubleshooting policies:

• Never directly modify one of the supplied groups, policies, or rule modules.

If you need to change a group, policy, or rule module, make sure you clone

and rename it first so you preserve it for use later. Modifying the supplied

groups, policies, and rule modules directly makes it difficult to back out of

any inadvertent mistakes.