42
2-49
Cisco IronPort AsyncOS 7.5 for Email Daily Management Guide
OL-25138-01
Chapter 2 Using Email Security Monitor
Email Security Monitor Pages
configuration changes can be applied proactively. The most effective way to
monitor system capacity is to track overall volume, messages in the work queue
and incidents of Resource Conservation Mode.
•
Volume: It is important to have an understanding of the “normal” message
volume and the “usual” spikes in your environment. Track this data over time
to measure volume growth. You can use the Incoming Mail and Outgoing
Mail pages to track volume over time. For more information, see System
Capacity- Incoming Mail, page 2-51 and System Capacity-Outgoing Mail,
page 2-52.
•
Work Queue: The work queue is designed to work as a “shock absorber”--
absorbing and filtering spam attacks and processing unusual increases in ham
messages. However, the work queue is also the best indicator of a system
under stress, prolonged and frequent work queue backups may indicate a
capacity problem. You can use the WorkQueue page to track the average time
messages spend in the work queue and the activity in your work queue. For
more information, see System Capacity- Workqueue, page 2-49.
•
Resource Conservation Mode: When a Cisco IronPort appliance becomes
overloaded, it will enter “Resource Conservation Mode” (RCM) and send a
CRITICAL system alert. This is designed to protect the device and allow it to
process any backlog of messages. Your Cisco IronPort appliance should enter
RCM infrequently and only during a very large or unusual increase in mail
volume. Frequent RCM alerts may be an indication that the system is
becoming overloaded. Resource Conservation Mode is not tracked by the
system capacity page.
System Capacity- Workqueue
The Workqueue page shows the average time a message spends in the work queue,
excluding any time spent in the IronPort Spam quarantine or in a system
quarantine. You can view time periods from an hour up to one month. This
average can help in identifying both short term events delaying mail delivery and
identify long term trends in the workload on the system.
Note
If a message is released from the quarantine into the work queue, the “average
time in work queue” metric ignores this time. This prevents double-counting and
distorted statistics due to extended time spent in a quarantine.
