The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The following topics are tasks to complete after you install Security Manager or its related applications on a server.
Make sure that you complete the following tasks immediately after installation.
You can run the pdshow command from a Windows command prompt window to verify that all required processes are running correctly for the Cisco server applications that you choose to install. Process requirements differ among the applications.
Tip To learn more about pdshow, see the Common Services documentation.
Use Table 7-1 to understand which applications require which processes.
Memory Reservation Framework (MRF), a feature introduced in Security Manager 4.1, provides Cisco Security Manager administrators the capability to modify heap sizes of key processes; doing so can enhance the performance of the server. MRF enables processes to adjust heap sizes on the basis of the RAM installed on the server.
The Security Manager processes that can be configured using MRF are listed in Table 7-2 .
|
|
|
---|---|---|
Hosts applications responsible for editing and validating policies, etc. |
||
Note There is no MRF configuration for the HPM (Health and Performance Monitor) server.
Note You can learn more about the pdshow command in the previous section, Verifying that Required Processes Are Running, and in the Common Services documentation.
The processes listed in Table 7-3 , which are the Security Manager processes that can be configured by using MRF, are pre-configured with default values for heap sizes. Table 7-3 lists the default minimum and maximum heap sizes in megabytes for different amounts of RAM available to the server for each Security Manager process that can be configured by using MRF.
|
|
|
|
|
|
---|---|---|---|---|---|
Some RAM is reserved for the operating system and for other processes and is not listed here. For example, consider the case of 16 GB RAM in Table 7-3 . The total maximum heap size for all 4 processes is (4096 + 4096 + 1024 + 4096) = 13312 Mb or 13 Gb. There is 3 GB additional RAM available for the operating system and for other processes.
MRF provides a command and a set of sub-commands to read and modify heap sizes for Security Manager server processes. Minimum and maximum heap sizes can be set for the process by using the mrf command. Information on using of this command is displayed by executing this command as follows:
Make sure that only valid process names are used while running mrf commands. No error is thrown when an invalid process name is specified. Valid process names are listed in Table 7-2 . Process names are case-sensitive.
Configuring heap sizes for Security Manager processes can be thought of as consisting of the following three major steps:
1. Save Existing Configuration
Configuring a process heap size is a critical procedure that can affect the performance of Security Manager, so Cisco recommends that it be done only under the guidance of application experts.
Also, as a precautionary measure, Cisco recommends that you save your existing memory configurations for processes before changing them, and MRF provides two methods for doing so.
1. The first method can be used if you are testing the configuration changes. In this case the old configuration can be saved, and new modifications can be reverted to old configurations, by using the two commands listed below, respectively:
2. The second method is useful if you would like to revert to old values after you have used the new configuration for a significant period. There are two ways of doing this; you can use one or the other of the following ways:
a. You can run mrf revert, provided you have not run mrf backup after you did the configuration changes.
b. You will be taking a backup of your Cisco Security Manager Server before you make configuration changes. If you want to revert the changes, then restore the backup. In this case, data changes done after backup was taken will be lost.
Now that you have saved your data, you can query existing values for the processes by using the following command:
mrf get_heap_params [process name] [memory]
If memory is not specified in this command, the current RAM size will be used. Usually you are interested in the current RAM size. The parameter [process name] has one of the values listed in Table 7-2 . Process names are case-sensitive.
The output of the command appears as shown below. Values are in MB.
After you have verified the current configuration, you can proceed to modify the configuration as described in this section.
To configure the heap sizes, use the following command:
mrf set_heap_params [process name] [X-Y] [min], [max]
The parameter [process name] can be any of the processes listed in Table 7-2 . Process names are case-sensitive.
You need to restart the Security Manager server after executing this command for the changes to take effect.
Note Changes made by using mrf set_heap_params can be lost if the backup that was taken before modifying heap parameters is restored. In this case, if you want to retain the new values, you can follow these steps:
This command uses the following syntax:
mrf set_heap_params [process name] [X-Y] [min],[max]
Sets minimum and maximum heap sizes
[X-Y[ : memory range in MB to which heap sizes apply
[min],[max]: minimum and maximum heap sizes in MB. These are optional but at least one should be specified.
The parameter [process name] has one of the values listed in Table 7-2 . Process names are case-sensitive.
The following examples illustrate how you can modify heap size configurations:
Sets minimum and maximum heap sizes to 2048 MB and 4096 MB, respectively, for the Tomcat process when the RAM size is in the range of 7372 MB to 8192 MB
Sets the minimum heap size to 2048 MB for the Tomcat process when the RAM size is in the range of 7372 MB to 8192 MB
Sets the maximum heap size to 4096 MB for the Tomcat process when the RAM size is in the range of 7372 MB to 8192 MB
Sets the minimum and maximum heap sizes to 2048 MB and 4096 MB, respectively, for the Tomcat process when the RAM size is 8080 MB. You can execute the getramsize command to get the existing RAM size in MB.
After heap parameters are set, you can verify the changes by executing the mrf get_heap_params command.
The three major steps described in this section for configuring heap sizes for Security Manager processes can be summarized by the following commands, listed in their order of execution:
A Security Manager 4.0 user potentially may be using a maximum heap size of 4 GB for the Backend Process (VmsBackendServer). This is more than the default maximum heap size of 3 GB allocated in Security Manager 4.1 for 8 GB RAM. In this scenario, the user may have to reconfigure the Backend Process heap size to 4 GB. The user can choose to do this in case Event Management, which uses the Event Server process (VmsEventServer) is not enabled.
Suppose Security Manager is being used in configuration-only mode (Event Management and reporting are disabled). In this scenario, the Backend Process and Tomcat heap sizes can be increased.
Suppose Security Manager is being used in configuration-only mode (Event Management and reporting are disabled) and Event Management needs to be enabled. In this scenario, the Backend process and Tomcat heap sizes should be decreased, before enabling Event Management, so that the total of all heap sizes of Security Manager processes does not exceed the RAM size available to the server.
Event Management and the Backend process are memory-intensive and need higher RAM allocation. (If event Management is unused, that RAM could be allocated for the Backend process by increasing its maximum heap size.)
The least secure component of a system defines how secure the system is. The steps in the following checklist can help you to secure a server and its OS after you install Security Manager:
You can use Common Services to verify that you installed or upgraded Security Manager successfully. If you are trying to verify the installation because the Security Manager interface does not appear or is not displayed correctly, see Server Problems After Installation.
Step 1 Use a browser on the client system to log in to the Security Manager server using either of the following:
To learn which browsers and browser versions are supported, see Client Requirements, page 3-11.
Step 2 From the Cisco Security Management Suite page, click the Server Administration panel to open Common Services at the Server > Admin page.
Step 3 To display the Process Management page, click Processes.
The resulting list names all the server processes and describes the operational status of each process. The following processes must be running normally:
If you are required to change the hostname of the Security Manager Server, follow the steps below:
Step 1 Change the hostname in the OS:
a. Right-click Computer and select Properties or open Control Panel and select System.
b. Under Computer Name, Domain and Workgroup Settings, click Change Settings.
c. Click Change to modify the Computer Name (hostname).
Step 2 Stop the Security Manager Daemon Manager by entering net stop crmdmgtd in the command window.
Step 3 Execute the Security Manager Server hostname change script by running the following command in a command window:
In this command, NMSROOT is the path to the Security Manager installation directory.
Tip hostnamechange.pl is a utility that updates the hostname changes in the Common Services- related directories, files, database entries and registry entries after the hostname is changed in the OS.
Note In this step, you must restart the computer. Restarting the Security Manager Daemon Manager is not sufficient.
|
|
---|---|
See the interactive JumpStart guide that opens when you start Security Manager. |
|
See the “Getting Started with Security Manager” topic in the online help, or see Chapter 1 of User Guide for Cisco Security Manager. |
|
See the “Completing the Initial Security Manager Configuration” topic in the online help, or see Chapter 1 of User Guide for Cisco Security Manager. |
|
See the “Preparing Devices for Management” topic in the online help, or see Chapter 2 of User Guide for Cisco Security Manager 4.15, available at http://www.cisco.com/c/en/us/support/security/security-manager/products-user-guide-list.html. |