What happens to ESA reporting and tracking data collected on a SMA after the ESA is replaced?

Introduction

This document describes reporting and tracking data collected on a Cisco Security Management Appliance (SMA), and what occurs post-replacement of a Cisco Email Security Appliance (ESA) in relation to using the centralized services for reporting and tracking.

What happens to ESA reporting and tracking data collected on a SMA after the ESA is replaced?

You may run into a scenario where you may have to replace an existing ESA. This could be due to a RMA, hardware upgrade, or other reasons. If you have centralized services reporting or centralized services message tracking configured on the ESA, you will then need to update the appropriate appliance configuration on the SMA.

Reporting

After you replace an ESA SN XXX (host1) with an ESA SN YYY (host2), assuming that both hosts have an identical configuration, you will not see any data on the Email > monitor > overview page of the reporting graphs if you choose to view data for 'host1'. Data associated with 'host1' is not mapped to 'host2'. If you choose to view data for all hosts, the reporting graphs will report the data for both 'host1' and 'host2'. You will need to assure that you are selecting 'All Email Appliances' when viewing the reporting data.

Essentially, the aggregated reporting data is retained. We do not delete the reporting data corresponding to an ESA that is replaced with another ESA.

Message Tracking

With regards to message tracking, if you track messages received by 'host2', it will not output messages received by 'host1'. However, if you track messages received by 'All Hosts', you will be able to find messages that were received by 'host1'. You will need to assure that you are selecting 'All Hosts' from the Advanced drop-down option when performing message tracking.

Once again, message tracking does not map messages from 'host1' to 'host2'; however aggregated tracking data is retained, allowing you to query all messages received by both 'host1' and 'host2'.

Related Information

• Cisco Email Security Appliance - End-User Guides
• Technical Support & Documentation - Cisco Systems