Installation Guide

13
Cisco Security Agent Installation/Deployment Guide for Cisco ICM/IPCC Enterprise & Hosted Editions, Release 7.0(0) July 2005
Note The following is relevant if you are uninstalling CSA 4.0.x for ICM 5.0(0) or CSA for ICM 6.0(0) in
order to upgrade to CSA for ICM 7.0(0). However, no such registry keys exist for CSA for ICM 7.0(0).
The uninstaller does not remove the registry entries where the policy version is stored. If you want them
removed, you must manually delete them—after you uninstall. The relevant registries are:
HKEY_LOCAL_MACHINE\Software\Cisco Systems, Inc.\System Info\ICM-CSA Policy\Version
HKEY_LOCAL_MACHINE\Software\Cisco Systems, Inc.\System Info\CSA Agent\Product
HKEY_LOCAL_MACHINE\Software\Cisco Systems, Inc.\System Info\CSA Agent\Version
Delete everything under, and including, ICM-CSA Policy, and everything under, and including,
CSA Agent.
Upgrading the Cisco Security Agent
To upgrade the Cisco Security Agent, perform the following tasks:
1. Uninstall the existing version that is installed on the server.
See the section Uninstalling the Cisco Security Agent, page 12.
2. Install the new version that you plan to run on the server.
See the section Installing the Cisco Security Agent, page 9.
Messages, Logs, and Caching
This section discusses additional features of the Cisco Security Agent.
Event Messages and Log Files
• If the Cisco Security Agent has a message for you, the icon (the red flag in the Windows system
tray) will wave. To read the message, double-click on the icon, then click on Messages (on the left,
under Status).
The messages that are displayed are those generated when an action either is denied or generated a
query. Only the two most recent messages are displayed.
• The log files are located in <InstallDrive>:\Program Files\Cisco Systems\CSAgent\log.
– securitylog.txt—this is the main event log; this is where rule violations and other relevant
events are logged
– csalog.txt—this provides Agent startup and shutdown history (it contains events as well; but
securitylog.txt also contains the events, and is easier to read)
– driver_install.log—this provide a record of the driver installation process
– CSAgent-Install.log—this provides a detailed record of the installation process
• You can view securitylog.txt using Notepad. The field names are given in the first line. This can be
done by:
– Double-clicking the Cisco Security Agent icon—the red flag in the Windows system tray.
– Then click on Messages (on the left, under Status).