Report from multiple tables

[RSAAdmin]

I'm trying to create a report on a Cisco ASA.   I need information from multiple tables to create a single report.   Is it possible to use SQL do pull information from multiple tables in the report writer?

Thanks.   Ellen.  

[RSAAdmin]

Ellen, you can choose only one table at a time for report. You should also have a look at Global table and if it has all required fields from different tables (that you want to use) in that case you can run report using Global table.

Thanks 

[RSAAdmin]

Thanks for the reply. I've looked at the Global table. All the MessageIDs that I need are in the Global table but in some cases the message field itself is not populated. Not sure if that is normal or not. I've not been able to find any documentation on when the fields in the Global table are populated and when they are not. I'm assuming this is a function of the parsing routine. Guess this is getting off topic and changing to the content of the global table. Thanks for the info. You did answer my question regarding multiple tables in a report. Would be nice to see someday. Thanks. Ellen.

[CharlesBeierle]

You are absolutely correct that the population of the message field is driven by an entry in the xml parsing file. It would not take much to 'fix' that but it may turn your otherwise supported configuration into an unsupported config. The global table is also considered a 'table of last resort' as using it is relatively expensive in terms of resources when compared to say the firewall table. Could you tell me a little more about what specifically you want to do? Maybe there is some other trick to try. 

[RSAAdmin]

I'm trying to create a single report that has messages parsed into the VPN System Table, VPN Level Table and VPN security table.  The Global table does contain the message IDs but not the message content so it has not been a good source for this report.    I could create 3 reports and then combine them in excel but would prefer not to do that.   The report is to be used to review any issues with VPN access and would be used to assist in debugging issues if they occur.    While we could go directly to the ASA for the log messages, we were hoping to use envision to help us create a report and email that report on a daily basis.  

Alternatively I could set up a filter in event explorer but that does not result in an emailed report.  

I guess another option would be make copies of the messages and have them go to an additional table.   Any ideas would be appreciated.  

Thanks.   Ellen.

[RSAAdmin]

If it's not too much trouble, please open a case with support for this.  I think we can make some small changes to the content in the short term that can provide you some relief.

Seperate question, what do you think about completely redeveloping the Cisco PIX/ASA device and putting all the messages in the new "Firewall" table?  Would this solve your reporting issues?

Thanks.

[RSAAdmin]

I'll open a case with support on this issue.  

I like the idea of putting all the Cisco PIX/ASA messages in one table.   It would make the reporting much easier.  

Thank you.   Ellen.  

[RSAAdmin]

Case opened with support.

[CharlesBeierle]

I also created a ticket with support on the ASA XML parsing a particular SSL VPN message differently than the analogous message -with the same content- for IPSec.

[RSAAdmin]

I just hope that we only have to deal with one table instead of so many. This way, the user will be presented with a unified view on all the device type data. It will save our time into researching what table to use, dealing with missing fields.....

kng