Following are some problems you might encounter when using the Report Manager application, and some ways to resolve the problems.
Problem: Report Manager does not open, you get the message “Not able to connect to server.”
Solution: Report Manager requires that the csmReportServer, rptDbEngine, and rptDbMonitor processes be started. Report Manager also
relies on the Event Management service VmsEventServer. Ensure that all services are started and running correctly on the Security
To view the current state of the processes, log into the Security Manager web interface using http://SecManServer :1741, where SecManServer is the DNS name of the server. From the Security Management Suite home page, click the Server Administration link to open CiscoWorks Common Services at the Admin page. Click Processes in the TOC on the left side of the window to open the list of processes that displays their current states. Select these
processes and click Start to start them. If necessary, you might want to stop them, and then restart them. Wait for the processes to fully restart,
then try again to open Report Manager.
Problem: When generating a report, you get the message “No records found.”
Solution: This message indicates that there were no event records in the event data storage location that relate to the report type
and the configured settings, or that the required Report Manager aggregation cycle has not completed. Investigate the following:
Ensure that devices of the appropriate type are selected for monitoring as described in Selecting Devices to Monitor.
Ensure that these devices are appropriately configured for sending events to Security Manager, and that events from the device
appear in Event Viewer. Ensure that the device and Security Manager are using the same syslog port. For information on configuring
the devices, see Configuring ASA and FWSM Devices for Event Management and Configuring IPS Devices for Event Management. To check the syslog port that Security Manager is using, view the setting on the Tools > Security Manager Administration > Event Management page in Configuration Manager.
For IPS devices, ensure that the certificate has not expired. Check the certificates table by selecting Manage > IPS > IPS Certificates in Configuration Manager and regenerate the certificate if necessary.
The report settings might specify a time period in which no aggregated data exists for the report. Data is aggregated every
15 minutes, 1 hour (on the hour), and 1 day (at midnight). Try changing the time parameters of the report. See Editing Report Settings. Consider the following:
To see a Last 1 Hour report, a change of hour must occur since initially starting the Event Manager service. For example,
if you start the service at 10:05, hourly reports are available only after 11:00.
To see a Last 1 Day report, a change of day must occur since initially starting the Event Manager service. For example, if
you start the service at 10:05, you must wait until after midnight to see a daily report.
To see a Last 1 Week report, at least one full day cycle must occur. Weekly reports are based on daily reports.
To see a Last 1 Month report, at least one full month must pass since starting the service.
To see a custom time period report, at least one daily cycle must occur.
If you create a new custom report, it might take up to one hour for data to become available. Also, ensure that the time
period is Last 1 Hour until the report is old enough to have data for other time periods.
Problem: You cannot get reports for a specific device.
Solution: Investigate the following:
The device must have been selected for event management during the reporting time-frame as described in Selecting Devices to Monitor. Even if a device is selected, Report Manager might not support all devices that are supported for Event Viewer. For information
on the supported device types, see Understanding Report Management.
The report settings might exclude the device. Unless the report settings indicate that All Devices are considered in the
report, check the device selection to ensure the device is included. See Editing Report Settings.
The report settings might specify a time period in which no data exists for the device. Try changing the time parameters
of the report. See Editing Report Settings.
If your organization uses Cisco Secure ACS to control access to the application, you can view reports on a device only if
you have at least View privileges to the device. Check whether you have the required permissions.
Problem: You cannot see data in certain IPS predefined reports after specifying values for each of signature, victim IP, and attacker
Solution: The top attackers, top victims, and top signatures predefined reports include criteria for signature, victim IP address,
and attacker IP address. However, you cannot configure all three criteria in a predefined report. Instead, you can configure
the criteria on which the report is based (for example, victim IP address for the top victims report) plus one, and only one,
of the remaining values. Note that this limitation does not apply to the other criteria, such as Blocked and Top.
Problem: You cannot see data in certain Firewall predefined reports after specifying values for each of service, source IP, and destination
Solution: The top destinations, top services, and top sources predefined reports include criteria for service, source IP address, and
destination IP address. However, you cannot configure all three criteria in a predefined report. Instead, you can configure
the criteria on which the report is based (for example, service for the top services report) plus one, and only one, of the
remaining values. Note that this limitation does not apply to the other criteria, such as Permit/Deny and Top.
Problem: Statistics for VPN reports are not available.
Solution: VPN statistics are partially obtained directly from the device rather than from events stored in the event data storage location.
To obtain the statistics, Report Manager must be able to log into the device and use show commands. Ensure that the device
properties for your VPN devices have the correct credentials for logging in.
Problem: Scheduled reports are not getting sent to recipients.
Solution: Ensure that the SMTP server is configured correctly and that a valid source e-mail address is configured for Security Manager.
For more information, see Configuring an SMTP Server and Default Addresses for E-Mail Notifications.
Problem:When exporting the device status report, you get the following error. "Windows cannot find 'acrord32'. Make sure you typed
the name correctly and then try again".
Solution:Execute the following:
Install Adobe Reader on the server, if it is not installed already. MS-Windows will not be able to locate the acrord32.exe
file if Adobe Reader is not installed.
Though Adobe Reader is installed, the error might be thrown if you are using Windows XP, Vista, 7,8.1 or 10. This is a known
error of Microsoft Windows. Microsoft is yet to provide patch for this error. Do the following:
Go to the location where the exported report file is saved. Right-click and choose Open with > Adobe Reader. Despite the
error, the file is created without the defined format. Hence, you can open it using a PDF reader.