Release Notes for Monitoring Center for Performance 2.0.1 on Solaris

Monitoring Center for Performance 2.0.1 (Performance Monitor) is a browser-based tool that monitors and troubleshoots the health and performance of network security services. Performance Monitor replaces VPN Monitor 1.x.

Supported service types are remote-access VPN, site-to-site VPN, firewall, web server load-balancing, and proxied SSL.

New Features

Product Documentation

Note We sometimes update the printed and electronic documentation after original publication. Therefore, you should also review the documentation on Cisco.com for any updates.

Related Documentation

Table 1 Product Documentation
Document Title	Available Formats
Installing Monitoring Center for Performance 2.0.1 on Solaris	•On Cisco.com at this URL: http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/cw2000/mcp/mcp_201/iguide/index.htm •Printed document available by order (part number DOC-7816500=).¹
Using Monitoring Center for Performance 2.0.1	•On Cisco.com at this URL: http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/cw2000/mcp/mcp_201/uguide/index.htm •Printed document available by order (part number DOC-7816217=). 1
Supported Devices and Software Versions for Monitoring Center for Performance 2.0.1	On Cisco.com at this URL: http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/cw2000/mcp/mcp_201/sup_dev.htm
FAQs and Troubleshooting Guide for Monitoring Center for Performance 2.x	On Cisco.com at this URL: http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/cw2000/mcp/mcp_201/ts_guide.htm
Release Notes for Monitoring Center for Performance 2.0.1 on Solaris	On Cisco.com at this URL: http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/cw2000/mcp/mcp_201/release/index.htm
Context-sensitive online help	Click Help in the Performance Monitor GUI.

Note We sometimes update the printed and electronic documentation after original publication. Therefore, you should also review the documentation on Cisco.com for any updates.

Known Problems

Table 2 Related Documentation
Document Title	Description and Available Formats
Quick Start Guide for the VPN/Security Management Solution 2.2	Provides basic instructions and safety warnings to start using release 2.2 of the VPN/Security Management Solution. This document is available in the following formats: •Printed document that was included with the product. •On Cisco.com at this URL: http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/cw2000/cw2000_b/vpnman/vms_2_2/brvms22.htm •Printed document available by order (part number DOC-7815636=).¹
Readme for CiscoWorks VMS 2.2 Update 1	Provides basic instructions and safety warnings to start using Update 1 for VMS 2.2. This document is available on Cisco.com at this URL: http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/cw2000/cw2000_b/vpnman/vms_2_2/vmsrm.htm
Installation and Setup Guide for CiscoWorks Common Services 2.2 (Includes CiscoView 5.5) on Windows	Provides installation information about CiscoWorks Common Services. This document is available in the following formats: • On Cisco.com at this URL: http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/cw2000/cw2000_d/comser22/ig_wincv/index.htm •Printed document available by order (part number DOC-7815430=). 1
User Guide for CiscoWorks Common Services Software Release 2.2	Provides you with instructions and information to use the CiscoWorks Common Services software effectively. This document is available in the following formats: •On Cisco.com at this URL: http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/cw2000/cw2000_d/comser22/usrguide/index.htm •Printed document available by order (part number DOC-7815301=). 1

Table 3 Known Problems in Performance Monitor 2.0.1
Bug ID	Summary	Additional Information
CSCeb57907	Cannot import an SSL service module from a CSV file.	Symptom: Performance Monitor cannot validate an SSL service module for which you import attributes (such as, for example, its IP address) from a CSV file. This occurs for both SSL 1.0 and 1.1 versions. Condition: In most cases, Performance Monitor uses SNMP to communicate with a device and—based on the value of the device SysObjectId—automatically determines the device type. Because SSL 1.0 and 1.1 do not support SNMP, Performance Monitor cannot determine the device type automatically. Therefore, validation fails and the SSL service module is not imported. Workaround: Manually add the SSL service module to Performance Monitor.
CSCec05521	Notifications are sent only on default ports.	Symptom: Performance Monitor sends all trap notifications to port 162 and all Syslog notifications to port 514. Condition: If a port value other than the default is configured on a host, Performance Monitor ignores the setting and sends the trap notifications to UDP port 162 and the Syslog notifications to port 514 on that host. Workaround: There is no workaround.
CSCec17725	No interface down event for v1 trap.	Symptom: Performance Monitor does not generate an event for a monitored device on which the interface state has changed. Condition: Performance Monitor does not process SNMP v1 LinkUp and LinkDown traps. It processes only SNMP v2 LinkUp and LinkDown traps. Workaround: Do one of the following: •Configure the device to send SNMP v2 traps to Performance Monitor. •Allow enough time for a polling cycle to complete.
CSCec28656	Takes a long time to load a 32-KB row in User Session Report.	Symptom: A User Session Report takes several minutes to load. Condition: Some multiuser session queries return a high number of results. The User Session Report page loads slowly in cases where a query returns more than 10,000 results. Workaround: Select a specific device and adjust the Start and End times before you submit your query.
CSCec28918	User logged in once but two sessions are displayed in the report.	Symptom: In some cases when you select Reports > Remote Access > User Session Report, the displayed report shows two sessions for a user who logged in only once during the specified interval. The end time for one of those sessions exactly matches the start time for the other session. Condition: This error occurs only in relation to VPN 3000 concentrators when many users are logged in simultaneously. Workaround: There is no workaround. However, you can examine split reports to determine the properties of a specific user session. In cases where this error occurs, the actual start time is the displayed start time of the first session and the actual end time is the displayed end time of the second session. The duration is the sum of both sessions. You cannot get an accurate count of the number of bytes in or bytes out.
CSCec49471	User session state is marked Active instead of Completed.	Symptom: In some cases when you select Reports > Remote Access > User Session Report, you see at least two sessions that are alike in several ways: They share one username, one IP address, and one VPN device name. However, their start times differ. Condition: One session is marked Active and the other, similar session has a later start time. It appears that one user has logged-in twice from one computer to one VPN device at one time. The session state is marked Active, not Completed. The duration is wrong, as are the other statistics that are displayed in the table. Workaround: There is no workaround.
CSCec56300	User-defined groups display on every report page.	Symptom: Every device selection tree under the Reports tab lists all of your user-defined device groups, even in cases where a specific device group contains no relevant devices for the selected service type. You might see, for example, a user-defined group of the devices in a branch office (including SSL service modules, a VPN concentrator and a PIX firewall) when you plan to configure a report that describes only the SSL proxy services in your network. Condition: If you try to generate a report that does not pertain to all of the devices you select, the report contains information about only the devices that provide the specified service. For all other selected devices, an error message states that no data is available. Workaround: There is no workaround.
CSCed36700	Cannot display CPU usage statistics for some routers.	Symptom: CPU usage values are not available for a Cisco 800 Series router. A known problem in Cisco IOS prevents Performance Monitor from displaying these statistics. Condition: You validate and poll an 800 series router, then select any of these: •Monitor > Site-to-Site VPN > Devices. •Monitor > Site-to-Site VPN > Device Details. •Reports > Site-to-Site > Performance > CPU Usage. •Reports > Site-to-Site > Performance > CPU Usage Rev. Workaround: There is no workaround. Further Problem Description: The router SNMP agent returns "null" for queries to these MIB objects that are used to compute CPU usage levels: •cpmCPUTotal5sec •cpmCPUTotal5secRev See CSCed50328.
CSCed57697	Page Not Found error appears when you start Performance Monitor.	Symptom: You see a Page Not Found error when you try to start Performance Monitor from a supported browser. Although the output of the pdshow command confirms that all CiscoWorks Server daemons are running correctly, Performance Monitor does not start. Condition: You uninstalled and then reinstalled Performance Monitor on a Windows 2000 server. Workaround: Restart the Apache process and the Tomcat process. From the CLI on your CiscoWorks Server, enter the following commands in the specified sequence: 1. pdterm Apache 2. pdterm Tomcat 3. pdexec Tomcat 4. pdexec Apache Further Problem Description: Your browser does not advance beyond this URL: http://IP_address/CSCOnm/servet/com.cisco.core.mice.util.cmf.CMFLiaisonServlet?command=initializeAndValidate&url=/mcp/goHome.do&context=/mcp&port=443.
CSCed66432	Netscape shows plain text, not XML, when you export XML data.	Symptom: If you use Netscape 7.0 on Solaris, your attempts to export XML versions of Performance Monitor report data result instead in the display of plain text files that do not seem to include any XML markup. Condition: Netscape 7.0 on Solaris does not offer full XML support. Workaround: Although Netscape does not display the XML markup correctly, the exported file does contain XML markup. You can save the exported file and open it in a different application. 1. After you click Export and a new Netscape window opens, select File > Save Page As. 2. Select a directory in which to save the exported data in XML format. 3. Enter ".XML" as the filename extension, then click Save. 4. Open the saved XML file in an application other than Netscape 7.0. Alternatively, you can export any Performance Monitor report as a CSV file, then convert the CSV file to XML format offline.
CSCed68244	Cannot clear Interface State events in cases of PIX failover.	Symptom: When a PIX device is configured as part of a failover pair, Performance Monitor misinterprets some of the Syslog information it receives. Thus, Performance Monitor: •Does not clear the InterfaceDown event that occurs before a failover. •Does not process the InterfaceUp event that occurs after a failover. The GUI indicates that a serious service outage has occurred, even though failover prevented an outage. Condition: When failover occurs, the affected devices exchange their IP addresses and MAC addresses. The PIX device that sends an InterfaceDown event is not the same device that sends an InterfaceUp event. Workaround: In cases of PIX failover, the InterfaceDown events always precedes an InterfaceUp event. This sequence indicates that a failover has occurred. You can clear the InterfaceDown event manually as soon as the failover partner sends an InterfaceUp event.
CSCed74579	Find and Search do not work in the Event Browser.	Symptom: There is no effect in the Event Browser when you click Find or Search. Condition: This error occurs when you open an Event Browser in either of these ways: •You select Summary > Critical Problems, then click an event description. •You select Monitor > [Service Type], then click an Alert icon. Workaround: Select Monitor > [Service Type] > Event Browser.
CSCed78301	Event Browser does not include errors from a VPN service module.	Symptom: Events occur in the site-to-site VPN services that originate from an IPSec VPN service module that is installed in a Catalyst 6500 switch, but those events are not in the Event Browser. Condition: This problem occurs when the relevant Catalyst switch contains both an IPSec VPN service module and a CSM service module, and you do one of the following: •You select Monitor > Site-to-Site VPN > Event Browser. •You select Monitor > Site-to-Site VPN, then click an alert icon. Workaround: Do the following: 1. Select Summary > Event Browser. 2. In the object selector, expand the Site-to-Site VPN folder. 3. Select a VPN service module, then click Apply Filter.
CSCsa14572	Both MCP and McpDbEngine processes are down.	Symptom: You notice that the Current Data timestamp under the Summary tab or the Monitor tab is out of date and does not change when you refresh the relevant page in your browser. Your CiscoWorks Server uses Microsoft Windows. You enter the command pdshow MCP McpDbEngine in a DOS window and see that both processes are down. Condition: MCP and McpDbEngine are meant to shut down and restart automatically for maintenance every Monday at 3:30 a.m., but under certain conditions neither process restarts. Workaround: You must delete the Performance Monitor database transaction log file, $NMSROOT\databases\mcp\mcp.log, where $NMSROOT represents the complete path to the directory in which you installed CiscoWorks Common Services. In most cases, $NMSROOT is equivalent to C:\Program Files\CSCOpx\. You must also enter both of the following commands from a DOS prompt to restart the required processes: •pdexec McpDbEngine •pdexec MCP Further Problem Description: To confirm that CSCsa14572 is the source of outdated information in the Performance Monitor GUI, enter the pdshow McpDbEngine MCP command. The command output indicates that both processes stopped on a Monday at 3:30 a.m.
CSCsa10214	Error when using ACS for AAA but user does not exist on the ACS Server.	Symptom: When you start Performance Monitor, you get several error messages such as: `500 Error` `java exception java.lang.ArrayIndexOutOfBoundsException in the browser.` Conditions: This occurs when: 1. The CiscoWorks Server is configured to use the ACS Server for authorization and authentication. To verify this, log in to the CiscoWorks Server, then go to VPN/Security Management Solution > Administration > Configuration > AAA Server. The ACS radio button is selected in the AAA Server Information page. 2. You log in to the CiscoWorks Server with a username that exists only on the CiscoWorks Server, but is not defined on the ACS Server. Workaround: Do one of the following: •Create a user on the ACS Server with the same username as the one defined on the CiscoWorks Server. •Log in to the CiscoWorks Server with a username that exists on the ACS Server. In both cases, the ACS user must have the authorization to access Performance Monitor. Further Problem Description: This problem occurs because the user does not exist on the ACS Server. Therefore, the authentication falls back to the CiscoWorks Server but the authorization still occurs in the ACS Server. Since the user does not exist on the ACS Server, the user, by default, cannot access Performance Monitor.
CSCee39642	Authorization not enforced properly when using the ACS Server.	Symptom: When you start Performance Monitor, you can see the Summary, Monitor, and Admin tabs only. The Devices and Reports tabs, and some of the subtabs under the Admin tab are missing. Conditions: This occurs when: 1. The CiscoWorks Server is configured to use the ACS Server for authorization and authentication. To verify this, log in to the CiscoWorks Server, then go to VPN/Security Management Solution > Administration > Configuration > AAA Server. The ACS radio button is selected in the AAA Server Information page. 2. You log in to the CiscoWorks Server as an ACS user. This user is authorized to see all or some of the missing tabs or subtabs. Workaround: Restart the Apache process and the Tomcat process. From the CLI on your CiscoWorks Server, enter the following commands in the specified sequence: 1. pdterm Apache 2. pdterm Tomcat 3. pdexec Tomcat 4. pdexec Apache
CSCee54033	Cannot use ~ and ^ characters in the device read community string.	Symptom: When you select Devices > Importing Devices > Import > Manually Add New Devices, the following error message appears: `The Device <deviceIpOrDNSName> could not be imported because the SNMP request timed out.` Conditions: You are trying to import a device whose read community string contains ^ and/or ~ characters. Workaround: Assign a new read community string that does not contain ^ and/or ~ characters and import the device again.
CSCsa34283	Performance Monitor Backup and Restore on different servers fails	Symptom: Performance Monitor backup and restore fails with the following error message: Reason(s) for failure: mcp-mdc: can not start McpDbEngine Daemon Condition: This occurs when: •You back up Performance Monitor on one server and restore it on a different server. •CiscoWorks is not installed in the same location on both servers. For example, on one server it is installed in c:\CSCOpx and on another server it is installed in e:\Programs\CSCOpx. Workaround: On the server on which the restore failed, do the following: 1. Set the environment variable LD_LIBRARY_PATH to: `LD_LIBRARY_PATH=NMSROOT/objects/db/lib` 2. Enter the command (Note: this is one command): `NMSROOT/objects/db/bin/dblog -t NMSROOT/databases/mcp/mcp.db.log NMSROOT/databases/mcp/mcp.db` where NMSROOT is the root location of the CiscoWorks Common Services installation.
CSCee59388	Cannot see load balancing interface down event.	Symptom: The load balancing interface down event is not displayed in the Event Browser. Conditions: You notice that one of the interfaces under Monitor > Load Balancing > Module Details > Interfaces is down, but when you select Monitor > Load Balancing > Event Browser, the interface down information is not displayed. Workaround: There is no workaround. However, you can receive a notification when a load balancing interface down event occurs. To do so, select Admin > Notification > Load Balancing > Interface Status and configure the notifications of your choice.
CSCsa26857	No support for backup on 2.0 and restore on 2.0.1.	Symptom: Some of the Performance Monitor GUI pages do not display properly. Condition: Performance Monitor GUI will not work properly if Performance Monitor 2.0 is installed in your system and you do the following: 1. Back up VMS database by selecting VPN/Security Management Solution > Administration > Common Services > Backup Database. 2. Upgrade to Performance Monitor 2.0.1. 3. Restore VMS database by selecting VPN/Security Management Solution > Administration > Common Services > Restore Database. Workaround: Reverse steps 1 and 2. First upgrade Performance Monitor from 2.0 to 2.0.1, then back up the VMS database, and then restore the VMS database.
CSCef77126	Import of Cisco IOS router fails when using the loopback IP address	Symptom: Importing Cisco IOS router into Performance Monitor fails. Condition: This could occur if you are importing the device using the IP address of the loopback interface of the router. Workaround: Use the IP address of one of the Ethernet interfaces.
CSCsa45319	The fields are empty in the Report page.	Symptom: In the Configure <service> Report page, the fields under Select Category and Select Subcategory are empty. Conditions: This occurs rarely when the Tomcat process is not able to connect to the database. The database connection problem is an internal cause which manifests externally as missing fields in reports. Workaround: Restart the Apache process and the Tomcat process. From the CLI on your CiscoWorks Server, enter the following commands in the specified sequence: 1. pdterm Apache 2. pdterm Tomcat 3. pdexec Tomcat 4. pdexec Apache
CSCsa48691	Import operation does not seem to finish.	Symptom: After importing the device, the UI displays the status as Running and the import operation does not seem to finish. Conditions: This occurs rarely when the Tomcat process is not able to connect to the database. The database connection problem is an internal cause which manifests externally as an import failure. Workaround: Restart the Apache process and the Tomcat process. From the CLI on your CiscoWorks Server, enter the following commands in the specified sequence: 1. pdterm Apache 2. pdterm Tomcat 3. pdexec Tomcat 4. pdexec Apache

User Documentation Additions and Errata

The topics in this section are late-breaking additions to, or errata for,
Using Monitoring Center for Performance 2.0.1, and the online help for Performance Monitor 2.0.1.

Error Message When Using ACS for AAA

If you launch Performance Monitor and you get the following error message, you are probably using the Cisco Secure ACS Server (ACS) for authentication and authorization (AAA).

If you are using ACS for AAA, do the following to verify that ACS and VMS are configured correctly to work together:

Step 1

Make sure that the CiscoWorks Server is configured to use the ACS Server for AAA.

Log in to the CiscoWorks Server, then select VPN/Security Management Solution > Administration > Configuration > AAA Server. The ACS radio button should be selected in the AAA Server Information page.

From the AAA Server Information page, click Register, select and add MCP, then click OK.

Step 2

Make sure the ACS Sever is configured to work with Performance Monitor.

Make sure that the username used to log into the CiscoWorks Server desktop exists in ACS. The ACS user must belong to a group authorized to access Performance Monitor. See the Cisco Secure ACS user guide for details.

Edit the ACS group to which the user belongs. Make sure that the MCP check box and the Assign Performance Monitor for Any Network Device radio button are selected. See the Cisco Secure ACS user guide for details.

Cannot import a PIX device

When you try to import a PIX device or a Firewall Service Module from
Devices > Importing Devices > Import > Manually Add New Devices, the import fails and you get the following error message:

This could occur if you use the default PIX username, pix, during the import process. To resolve this, import the device again and leave the username field blank. Make sure that you enter the enable password.

Enable Popup Windows

Many features in Performance Monitor require your browser to open popup windows. If you disable popups generally, or disable them specifically for your CiscoWorks Server, Performance Monitor does not work.

See the documentation for your browser, or for any browser add-ons you might have installed, to learn whether and how you can enable popups that originate from your CiscoWorks Server.

If you use Netscape 7.1 on Microsoft Windows, please note that some CiscoWorks applications that spawn new browser windows might not start or operate properly if you enable the following option:
Edit > Preferences > Privacy & Security > Popup Windows > Block unrequested popup windows.

To work around the problem, leave this option disabled. Alternatively, you can enable the option so that it still allows popups that originate from your CiscoWorks Server. See the Netscape Help for details on how to do this.

Obtaining Documentation

Cisco documentation and additional literature are available on Cisco.com. Cisco also provides several ways to obtain technical assistance and other technical resources. These sections explain how to obtain technical information from Cisco Systems.

Cisco.com

You can access the most current Cisco documentation on the World Wide Web at this URL:

Ordering Documentation

•

Registered Cisco.com users (Cisco direct customers) can order Cisco product documentation from the Ordering tool:

•

Nonregistered Cisco.com users can order documentation through a local account representative by calling Cisco Systems Corporate Headquarters (California, USA) at 408 526-7208 or, elsewhere in North America, by calling 800 553-NETS (6387).

Documentation Feedback

You can submit e-mail comments about technical documentation to bug-doc@cisco.com.

You can submit comments by using the response card (if present) behind the front cover of your document or by writing to the following address:

Cisco Systems
Attn: Customer Document Ordering
170 West Tasman Drive
San Jose, CA 95134-9883

Obtaining Technical Assistance

For all customers, partners, resellers, and distributors who hold valid Cisco service contracts, the Cisco Technical Assistance Center (TAC) provides 24-hour-a-day, award-winning technical support services, online and over the phone. Cisco.com features the Cisco TAC website as an online starting point for technical assistance. If you do not hold a valid Cisco service contract, please contact your reseller.

Cisco TAC Website

The Cisco TAC website provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The Cisco TAC website is available 24 hours a day, 365 days a year. The Cisco TAC website is located at this URL:

Accessing all the tools on the Cisco TAC website requires a Cisco.com user ID and password. If you have a valid service contract but do not have a login ID or password, register at this URL:

Opening a TAC Case

Using the online TAC Case Open Tool is the fastest way to open P3 and P4 cases. (P3 and P4 cases are those in which your network is minimally impaired or for which you require product information.) After you describe your situation, the TAC Case Open Tool automatically recommends resources for an immediate solution. If your issue is not resolved using the recommended resources, your case will be assigned to a Cisco TAC engineer. The online TAC Case Open Tool is located at this URL:

For P1 or P2 cases (P1 and P2 cases are those in which your production network is down or severely degraded) or if you do not have Internet access, contact Cisco TAC by telephone. Cisco TAC engineers are assigned immediately to P1 and P2 cases to help keep your business operations running smoothly.

Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227)
EMEA: +32 2 704 55 55
USA: 1 800 553-2447

TAC Case Priority Definitions

To ensure that all cases are reported in a standard format, Cisco has established case priority definitions.

Priority 1 (P1)—Your network is "down" or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation.

Priority 2 (P2)—Operation of an existing network is severely degraded, or significant aspects of your business operation are negatively affected by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation.

Priority 3 (P3)—Operational performance of your network is impaired, but most business operations remain functional. You and Cisco will commit resources during normal business hours to restore service to satisfactory levels.

Priority 4 (P4)—You require information or assistance with Cisco product capabilities, installation, or configuration. There is little or no effect on your business operations.

Obtaining Additional Publications and Information

Information about Cisco products, technologies, and network solutions is available from various online and printed sources.

•

Cisco Marketplace provides a variety of Cisco books, reference guides, and logo merchandise. Go to this URL to visit the company store:

•

The Cisco Product Catalog describes the networking products offered by Cisco Systems, as well as ordering and customer support services. Access the Cisco Product Catalog at this URL:

•

Cisco Press publishes a wide range of general networking, training and certification titles. Both new and experienced users will benefit from these publications. For current Cisco Press titles and other information, go to Cisco Press online at this URL:

•

Packet magazine is the Cisco quarterly publication that provides the latest networking trends, technology breakthroughs, and Cisco products and solutions to help industry professionals get the most from their networking investment. Included are networking deployment and troubleshooting tips, configuration examples, customer case studies, tutorials and training, certification information, and links to numerous in-depth online resources. You can access Packet magazine at this URL:

•

iQ Magazine is the Cisco bimonthly publication that delivers the latest information about Internet business strategies for executives. You can access iQ Magazine at this URL:

•

Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering professionals involved in designing, developing, and operating public and private internets and intranets. You can access the Internet Protocol Journal at this URL:

•

Training—Cisco offers world-class networking training. Current offerings in network training are listed at this URL:

Table Of Contents