Report on EPS per event source in RSA SA

[AlexColella]

Hi Everyone,

  We currently have the RSA SA logging several different sources and was hoping to run a scheduled report of the EPS by log collector and if possible even event source (cisco ASA, windows etc).  I've combed through available documents but no luck.  Any help would be greatly appreciated. Thanks.

[Anonymous]

Hi,

None of the script is working. I am getting below error while running the same on VLC.

What collection method do you want to monitor? windows

Traceback (most recent call last):

  File "eps.py", line 28, in <module>

    res = urllib2.urlopen(req)

  File "/usr/lib64/python2.6/urllib2.py", line 126, in urlopen

    return _opener.open(url, data, timeout)

  File "/usr/lib64/python2.6/urllib2.py", line 391, in open

    response = self._open(req, data)

  File "/usr/lib64/python2.6/urllib2.py", line 409, in _open

    '_open', req)

  File "/usr/lib64/python2.6/urllib2.py", line 369, in _call_chain

    result = func(*args)

  File "/usr/lib64/python2.6/urllib2.py", line 1190, in http_open

    return self.do_open(httplib.HTTPConnection, req)

  File "/usr/lib64/python2.6/urllib2.py", line 1165, in do_open

    raise URLError(err)

urllib2.URLError: <urlopen error [Errno 110] Connection timed out>

Regards

Shubham

[Anonymous]

Dear all,

We are currently running on 10.6.0.2 version. We want to gather the below details:

1. Average EPS across Decoder ( say monthly average)

2. EPS determination in VLC sites. We want to evaluate the EPS across locations where VLCs are deployed.

Can someone be kind enough to help us with the above details.

Thanks & Regards 

Naren 

[NaushadKasu1]

One way to do this is to use the reporting engine.   You can run a 24 hr report counting all events by 'did' (Decoder ID) and the lcid (Log Collector ID - VLCs) and do a calculation within the report to average your EPS over 24 hrs.  You can run lengthier reports as well.   I do not have my lab setup yet but will in a few days then I can write a report / export and provide if still needed.

[RajbirYadav1]

Narender, as Mr. Naushad said reporting engine is the best way to get all these detail in a report format, you can use did and lcid for decoder and vlc EPS and also you can use the device.class to get the EPS for one collection method. 

[AnujShrivastava]

HI Lee,

It works for me, but only for windows and syslog,  i have checkpoint, ciscoasa, chan bluecoat proxy also ,

can you let me know how i can check their EPS also, is this possible using the same script ?

[SureshThanikach]

Hi All

We are currently running on 11.0 version. We want to gather the below details:

1. Average EPS across Decoder Log/Packet ( say monthly/Daily  average)

2. If Possible EPS count per device (Like Windows/Firewall/Router)

2. EPS determination in VLC sites. We want to evaluate the EPS across locations where VLCs are deployed.

It will be great if someone be kind enough to help us with the above details.

We have tried using the above script (getting the same error as shubham87) and also via reporting engine but no luck.

regards

Suresh Thanika  

[SureshThanikach]

https://community.rsa.com/message/905167   Found the answer in this link.