User Guide for Cisco Performance Monitor 3.3.1
Using Trend Reports
Downloads: This chapterpdf (PDF - 178.0KB) The complete bookPDF (PDF - 1.72MB) | Feedback

Table of Contents

Using Trend Reports

Understanding Reporting Options

Understanding Failure Report Subcategories

Understanding Performance Report Subcategories

Understanding Throughput Report Subcategories

Understanding Usage Report Subcategories

Configuring and Generating Reports

Understanding Historical Reports

Viewing RAS VPN Top 10 User Reports

Viewing RAS VPN User Session Reports

Viewing Site-to-Site VPN Top 10 Tunnel Reports

Working with Scheduled Email Jobs

Using Trend Reports


Note To learn about supported services and platforms, see Supported Services and Platforms for Monitoring and Reports, page 1-5.


The following topics describe the reporting features available in Performance Monitor and explain how to use and save the historical trend reports that you generate.

Understanding Reporting Options

You can configure and generate reports for all supported service types. Reports are organized in four broad categories and more than 30 narrow subcategories.


Note Only RAS VPN and site-to-site VPN services support all four of the high-level report categories. Subcategories are service-specific in most cases.


A subcategory measures trends over time for one narrow condition on a validated device or in a supported service. Subcategories are specific to categories; for example, subcategories in the Failure category are specific kinds of failures. The number of subcategories that you can select for a report ranges from one to four, depending on the subcategories you select.

The report categories are:

 

Understanding Failure Report Subcategories

Each generated line graph in a Failure report displays results for one device or service module or virtual server, depending on the service type and subcategory you select—as described in Table 10-1 , which:

  • Lists all subcategories for configuring Failure reports.
  • Specifies which services support the subcategories.
  • Describes the graphs displayed in Failure reports.

Note When you run historical reports, you might see a dip in the graph for any period of time during which the MCP process did not run on your CiscoWorks Server. See MCP Process Maintenance.


 

Table 10-1 Failure Report Configuration Subcategories

Failure Report
Subcategory
Relevant Service(s)
Description
Note In all Failure report graphs, the horizontal axis represents time. The vertical axis represents either a percentile or a count, depending on the report.

% of Inbound Conn Failures

Remote Access VPN

Graph shows the trend of failed inbound connections over time as a percentage of all inbound connections for all remote access VPN devices.

% of Phase 1 Conn Failures

Remote Access VPN

Graph shows the trend of failed Phase-1 (IKE) connections over time as a percentage of all Phase-1 connections.

% of Phase 2 Conn Failures

Remote Access VPN

Graph shows the trend of failed Phase-2 (IPSec) connections over time as a percentage of all Phase-2 connections.

% Of Conns Dropped By All Virtual Servers

Load Balancing

Graph shows the trend of dropped virtual server connections over time as a percentage of all connections.

% Of Failed Conns Per Module

Load Balancing

Graph shows the trend of failed load-balancing connections over time as a percentage of all CSM service module connections.

% Of Inbound Conn Failures

Site-to-Site VPN

Graph shows the trend of failed inbound Phase-1 (IKE) and Phase-2 (IPSec) tunnels over time as a percentage of all inbound exchanges.

% Of Outbound Conn Failures

Site-to-Site VPN

Graph shows the trend of failed outbound Phase-1 (IKE) and Phase-2 (IPSec) tunnels over time as a percentage of all outbound exchanges.

% of Total Conn Failures

Site-to-Site VPN

Graph shows the trend of failed Phase-1 (IKE) and Phase-2 (IPSec) connections over time as a percentage of all inbound and outbound exchanges.

Note Trend reports are not usually useful when they are based on a small number of data points. The date range and trending type determine the number of data points. For example, there is only one data point if you apply the Daily trending type to less than 2 days’ worth of data. It is not possible to graph a trend from only one data point.

Understanding Performance Report Subcategories

Each generated line graph in a Performance report displays results for one device or service module or virtual server, depending on the service type and subcategory you select—as described in Table 10-2 , which:

  • Lists all subcategories for configuring Performance reports.
  • Specifies which services support the subcategories.
  • Describes the graphs displayed in Performance reports.

Note When you run historical reports, you might see a dip in the graph for any period of time during which the MCP process did not run on your CiscoWorks Server. See MCP Process Maintenance.


 

Table 10-2 Performance Report Configuration Subcategories

Performance Report
Subcategory
Relevant Service(s)
Description
Note In all Performance report graphs, the horizontal axis represents time. The vertical axis represents either a percentile value or a count, depending on the report.

Bandwidth Usage

Remote Access VPN

Graph shows trends for the average percentage of total bandwidth capacity used over time, calculated as the sum of inbound and outbound packets, factored against the interface speed.

CPU Usage

  • Firewall
  • Remote Access VPN
  • Site-to-Site VPN
  • SSL

Graph shows trends for the average percentage of total CPU capacity used over time.

CPU Usage Rev

Site-to-Site VPN

Graph shows trends for the average percentage of total CPU capacity used over time.

Note If the displayed report is empty when you select the CPU Usage Rev subcategory, use the CPU Usage subcategory instead.

FTP Fixup

Firewall

Graph shows trends for the average per-second activity and change rate over time for FTP Fixup—the PIX OS inspection function, as applied to FTP traffic.

HTTP Fixup

Firewall

Graph shows trends for the average per-second activity and change rate over time for HTTP Fixup—the PIX OS inspection function, as applied to HTTP traffic.

Memory Usage

  • Firewall
  • Site-to-Site VPN
  • SSL

Graph shows trends for the average percentage of processor memory capacity used over time.

SSL Connections

SSL

Graph shows trends for the total number of active SSL connections over time.

TCP Fixup

Firewall

Graph shows trends for the average per-second activity and change rate over time for TCP Fixup—the PIX OS inspection function, as applied to TCP traffic.

TCP Intercept

Firewall

Graph shows trends for the average per-second activity and change rate over time for TCP Intercept—a PIX OS feature that prevents denial-of-service (DOS) attacks against TCP servers.

Throughput

SSL

Graph shows trends for the sum in kbps of inbound and outbound octets through all public interfaces over time, factored against interface speed.

Total IfErrors

Firewall

Graph shows trends for the number of firewall interface errors over time.

Total Throughput

Firewall

Graph shows trends for the sum in kbps of inbound and outbound octets through all public interfaces over time, factored against interface speed.

URL Access

Firewall

Graph shows trends for the average number over time of URLs (web sites) accessed per second, based on the output of the PIX OS show perfmon command.

URL Request

Firewall

Graph shows trends for the average number over time of URLs (web sites) requested per second, based on the output of the PIX OS show perfmon command.

Xlates

Firewall

Graph shows trends for the average number over time of TCP and UDP NAT translations per second through the firewall.

Note A translation is a mapping of an internal address to an external address and can be one-to-one as with NAT, or many-to-one as with PAT. A single host can have multiple connections to various destinations, but only one translation. If you notice that the xlate count is much larger than the number of hosts on your internal network, it is possible that one of your internal hosts has been compromised.

Note Trend reports are not usually useful when they are based on a small number of data points. The date range and trending type determine the number of data points. For example, there is only one data point if you apply the Daily trending type to less than 2 days’ worth of data. It is not possible to graph a trend from only one data point.

Understanding Throughput Report Subcategories

Each generated line graph in a Throughput report displays results for one device, service module, or virtual server, depending on the service type and subcategory you select—as described in Table 10-3 , which:

  • Lists all subcategories for configuring Throughput reports.
  • Specifies which services support the subcategories.
  • Describes the graphs displayed in Throughput reports.

Note When you run historical reports, you might see a dip in the graph for any period of time in which the MCP process did not run on your CiscoWorks Server. See MCP Process Maintenance.


 

Table 10-3 Throughput Report Configuration Subcategories

Throughput Report
Subcategory
Relevant
Service(s)
Description
Note In all Throughput report graphs, the horizontal axis represents time. The vertical axis represents either a percentile value or a count, depending on the report.

Throughput

  • Remote Access VPN
  • Site-to-Site VPN

Graph shows trends for the sum in kbps of inbound and outbound octets through all public interfaces over time, factored against interface speed.

Throughput Per Accelerator

Remote Access VPN

Graph shows trends for the sum, in kbps, of inbound and outbound octets across scalable encryption processor (SEP) accelerator cards over time, factored against SEP card speed.

Note Each line in the graph represents a separate SEP card. There are no SEP cards in a VPN 3005 Concentrator or a VPN 3015 Concentrator, so these devices are excluded from the report. You cannot select any other report subcategory when you select Throughput Per Accelerator.

Throughput Per Interface

  • Remote Access VPN
  • Site-to-Site VPN

Graph shows trends for the sum, in kbps, of inbound and outbound octets through the public interfaces of one device over time, factored against interface speed.

Note Each line in the graph represents a separate interface. You cannot select any other report subcategory when you select Throughput Per Interface.

% Of Crypto Packet Drop

Site-to-Site VPN

Graph shows the trend of dropped crypto packets as a percentage of all encrypted and decrypted packets over time.

% Of Crypto Packet Errors

Remote Access VPN

Graph shows the trend of encrypted packets with errors in Phase-1 (IKE) and Phase-2 (IPSec) tunnels as a percentage of all encrypted packets over time.

% Of Packets Dropped

  • Remote Access VPN
  • Site-to-Site VPN

Graph shows the trend of dropped packets in Phase-1 (IKE) and Phase-2 (IPSec) tunnels as a percentage of all inbound and outbound packets over time.

Understanding Usage Report Subcategories

Each generated line graph in a Usage report displays results for one device, service module, or virtual server, depending on the service type and subcategory you select—as described in Table 10-4 , which:

  • Lists all subcategories for configuring Usage reports.
  • Specifies which services support the subcategories.
  • Describes the graphs displayed in Usage reports.

Note When you run historical reports, you might see a dip in the graph for any period of time in which the MCP process did not run on your CiscoWorks Server. See MCP Process Maintenance.


 

Table 10-4 Usage Report Configuration Subcategories

Usage Report
Subcategory
Relevant
Service(s)
Description
Note In all Usage report graphs, the horizontal axis represents time. The vertical axis represents either a percentile or a count, depending on the report.

Number of Tunnels

Site-to-Site VPN

Graph shows trends for the combined number of Phase-1 (IKE) and Phase-2 (IPSec) tunnels for site-to-site VPNs over time.

Number of Users

Remote Access VPN

Graph shows trends for the aggregate number of active sessions on all RAS devices over time.

# Of Conns Per Module

Load Balancing

Graph shows trends for the average number of connections over time for each CSM module in a specific chassis.

Note Each line in the graph represents a separate service module. You cannot select any other report subcategory when you select # Of Conns Per Module.

# Of Conns Per Virtual Server

Load Balancing

Graph shows trends for the number of connections over time for each virtual server associated with a specific chassis.

Note Each line in the graph represents a separate virtual server. You cannot select any other report subcategory when you select # Of Conns Per Virtual Server.

Note Trend reports are not usually useful when they are based on a small number of data points. The date range and trending type determine the number of data points. For example, there is only one data point if you apply the Daily trending type to less than 2 days’ worth of data. It is not possible to graph a trend from only one data point.

Configuring and Generating Reports

Performance Monitor enables you to configure and generate historical reports for any supported service in your network.

Procedure


Step 1 Select Reports > Service Type > Configure Report , where Service Type is the service you select in the options bar.

The Configure Report page displays an Object Selector, action buttons, lists, and reporting categories that apply to the service you select. See Using an Object Selector.

Step 2 ( Optional ) If the All tab is not active, click it to display a list of device groups and individual devices in the selection tree.

You must select at least one device from the tree before you can configure a report. These reporting subcategories require that you select no more than one device:

  • Remote Access: Throughput: Throughput Per Accelerator.
  • Remote Access: Throughput: Throughput Per Interface.
  • Site-To-Site: Throughput: Throughput Per Interface.
  • Load Balancing: Usage: # Of Conns Per Virtual Server.
  • Load Balancing: Usage: # Of Conns Per Module.
  • Load Balancing: Failure: % Of Conns Dropped By All Virtual Servers.
  • Load Balancing: Failure: % Of Failed Conns Per Module.

Step 3 Select the check box for a device or device group to select it and all of its descendants in the hierarchy.

Step 4 ( Optional ) Select additional devices.

Step 5 Select a report category, then select a subcategory.

Step 6 Click >> (Add) to confirm the subcategory you selected and display it in the Selected List. Click << (Remove) if you selected the wrong subcategory.

Step 7 ( Optional ) Select additional categories and subcategories.

  • You cannot select more than four subcategories for any report.
  • You cannot select more than two subcategories for a report unless all of the subcategories you select measure units in percentages. In such cases, you can select as many as four subcategories.
  • You cannot select more than two subcategories if either one of your selections measures units in percentages.
  • In some cases, as specified in Understanding Reporting Options and its subtopics, sometimes you can select only one subcategory.

Step 8 Select an interval from the Trending Type list. Trending options are:

 

Hourly

The report shows monitored values at intervals of 1 hour for the range of calendar dates that you specify.

Daily

The report shows monitored values at intervals of 1 day for the range of calendar dates that you specify.

Weekly

The report shows monitored values at intervals of 1 week for the range of calendar dates that you specify.

Monthly

The report shows monitored values at intervals of 1 month for the range of calendar dates that you specify.

Step 9 Select the start and end dates for data to include in the report.

    • In the From area, select the starting day, month, and year.
    • In the To area, select the ending day, month, and year.

Step 10 Do one of the following:

  • To generate the report and view it in a new browser, click View .
  • To generate the report and configure one-time or recurring email distribution options for it, click Email .
  • To generate the report and save it to a file, select a file format (CSV or XML), then click Export .


 

Understanding Historical Reports

A generated report displays graphs that show historical trends for the subcategories you select, to which Performance Monitor applies the trending type and date range you specify. To understand a specific graph, see Understanding Reporting Options and its subtopics.

The Details area in the Performance Monitor Report page lists your username, the trending type, and the range of dates for the relevant report.

Viewing RAS VPN Top 10 User Reports

Performance Monitor enables you to view a historical report of the top 10 RAS VPN users in your network, across all RAS devices.


Note Performance Monitor does not display this information for Easy VPN RAS sessions.


Procedure


Step 1 Select Reports > Remote Access > Top 10 Users .

By default, the Top 10 Users page displays the 10 RAS users whose throughput levels are highest, with hourly data points for the last 24 hours. If fewer than 10 users have connected to your RAS VPN in the last 24 hours, there are fewer than 10 results displayed.

Information in the report is based on user activity rankings from every device.

Step 2 Complete the optional tasks that meet your requirements ( Table 10-5 ).

The refreshed display shows the result of any optional task that you complete.


 

 

Table 10-5 Optional Tasks in the Top 10 Users Page

Optional Task
Procedure
Note Table 3-3 describes additional optional tasks.

Select a different trending type.

1. Select an option from the Trending Type list:

  • Hourly—Shows monitored values at 1-hour intervals.
  • Daily—Shows monitored values at 1-day intervals.
  • Weekly—Shows monitored values at 1-week intervals.
  • Monthly—Shows monitored values at 1-month intervals.

2. Click Go .

Specify a different range of reporting dates.

1. In the From area, select the starting day, month, and year for the report.

2. In the To area, select the ending day, month, and year for the report.

3. Click Go .

Viewing RAS VPN User Session Reports

Performance Monitor enables you to view reports that describe the remote access VPN sessions over time of multiple users or of one user whom you specify.


Tip Some multi-user session queries return a high number of results. In cases where a query returns more than 10,000 results, the User Session Report page takes several minutes to load in your browser. If such a delay is unacceptable to you, we recommend that you select a specific device and adjust the Start and End times before you submit your query. For more information, see http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCeb57907&Submit=Search.


Before You Begin

This feature requires that your VPN 3000 concentrators, ASA appliances, and PIX devices are configured to send Syslog messages to Performance Monitor.

• See Setting Up ASA Appliances, PIX Devices, and Firewall Services Modules, page 2-5 , for help configuring your appliances and firewalls.

• See Setting Up VPN 3000 Concentrators, page 2-7 , for help configuring your VPN concentrators.

Procedure


Step 1 Select Reports > Remote Access > User Session Report .

The User Session Report page includes an Object Selector. See Using an Object Selector.

Step 2 Decide whether to display session reports for multiple users or one user, then do one of the following:

    • To display information that includes every user session, select the Search All Users check box.
    • To limit your search to the user sessions in a single cluster, select the relevant cluster parent in the tree.
    • To limit your search to the user sessions on a single device, select the relevant device in the tree.
    • To limit your search to the sessions of one user, enter the assigned username in the User Name text box.

Step 3 To define the interval in which Performance Monitor searches for sessions, do both of the following:

    • In the Start Time area, select a calendar date and enter a time of day in HH:MM:SS format. The values in the Start Time area define the beginning of the interval in which Performance Monitor searches for session information.
    • In the End Time area, select a calendar date and enter a time of day in HH:MM:SS format. The values in the End Time area define the end of the interval in which Performance Monitor searches for session information.

Step 4 Do either or both of the following:

    • To display the report in a new browser, click View .
    • To export the report, select a file format (CSV or XML), then click Export .

If you selected CSV, Performance Monitor might prompt you to accept a CiscoWorks Server certificate if you did not previously specify the server as a trusted source. If you accept the certificate, Performance Monitor displays the exported CSV data in your default spreadsheet application—such as Microsoft Excel for Windows or StarOffice Calc for Solaris. If you decline the certificate, Performance Monitor prompts you for a filename and path to save the CSV file locally.

If you selected XML, an XML export opens a new browser from which you can save the displayed result. Select File > Save As to save a local copy of the exported report.


 

Viewing Site-to-Site VPN Top 10 Tunnel Reports

Performance Monitor enables you to view a historical report of the top 10 site-to-site VPN tunnels in your network, across all devices.

Procedure


Step 1 Select Reports > Site-to-Site > Top 10 Tunnels .

By default, the Top 10 Tunnels page displays the 10 tunnels with the highest throughput levels, applying hourly data points to the last 24 hours. If fewer than 10 tunnels have had measurable throughput in the last 24 hours, fewer than 10 results are displayed.

Step 2 Complete the optional tasks that meet your requirements ( Table 10-6 ).

The refreshed display shows the result of any optional task that you complete.


 

 

Table 10-6 Optional Tasks in the Top 10 Tunnels Page

Optional Task
Procedure
Note Table 3-3 describes additional optional tasks.

Select a different trending type.

1. Select an option from the Trending Type list:

  • Hourly—Shows monitored values at 1-hour intervals.
  • Daily—Shows monitored values at 1-day intervals.
  • Weekly—Shows monitored values at 1-week intervals.
  • Monthly—Shows monitored values at 1-month intervals.

2. Click Go .

Specify a different range of reporting dates.

1. In the From area, select the starting day, month, and year for the report.

2. In the To area, select the ending day, month, and year for the report.

3. Click Go .

Working with Scheduled Email Jobs

You can view and delete the scheduled email jobs through which Performance Monitor distributes historical reports.

Procedure


Step 1 Select Reports > Service Type > Scheduled Email Jobs , where Service Type is the service that you select in the options bar.

Step 2 Select one job from the list.


Caution There is no Undo function when you delete a scheduled email job.

Step 3 ( Optional ) Do one of the following:

    • To display the job in the Email Job Details window, click View .
    • To delete the job, click Delete . There is no Undo.

Table 3-3 describes additional optional tasks.