topic Re: Identity Collector - number of events in Firewall and Security Management

Identity Collector - number of events

Hrvoje_Brlek — Thu, 29 Oct 2020 21:18:23 GMT

Hi,

I am setting up an Identity Collector in our CP environment. I have one question regarding the number of events. In the Identity Collector dashboard I can see the number of events being sent, and through the Gateway CLI we can see also the number of events, but these two numbers do not correlate with each other. Is this an expected behavior?

I'm sending the examples below.

Identity Collector:

Gateway CLI:

Re: Identity Collector - number of events

PhoneBoy — Sun, 01 Nov 2020 06:26:44 GMT

@Royi_Priov ?

Re: Identity Collector - number of events

Royi_Priov — Sun, 01 Nov 2020 08:03:29 GMT

Hi @Hrvoje_Brlek,

I don't remember the calculation behind "pdp conn idc" event counter, but probably there is a logic to unify the events for same user&IP (while the UI for sure doesn't unify them).

To see the same output as the IDC UI, you can use "pdp idc status" (R80.30 and above) or "cpstat identityServer -f idc"

Re: Identity Collector - number of events

Hrvoje_Brlek — Mon, 02 Nov 2020 10:24:36 GMT

Hi,

When I run those commands, this is the output I get:

The same output is on a Gateway running 80.40 JHF T83 and on 80.30 JHF T219.

Am I doing something wrong?

There is no connectivity issues between Identity Collector and the Gateways (both VSX), nor are there any firewalls on the way. Identity collector version is the latest one from CP, it has configured six DCs, with all of them generating events visible through IC dashboard.

Re: Identity Collector - number of events

G_W_Albrecht — Mon, 02 Nov 2020 11:37:19 GMT

Why not have TAC resolve this ? Does not look healthy...

Re: Identity Collector - number of events

Hrvoje_Brlek — Mon, 02 Nov 2020 20:17:37 GMT

Already have a few TAC cases open. Would really like not to have to open a TAC case for every minor change or implementation in a Check Point environment. 😐

But, if necessary will do so...

Re: Identity Collector - number of events

Royi_Priov — Tue, 03 Nov 2020 09:07:54 GMT

Hi @Hrvoje_Brlek

have you enabled the monitoring feature on IDC side? (check "Monitoring capability" section under sk108235)

Re: Identity Collector - number of events

Hrvoje_Brlek — Tue, 03 Nov 2020 23:12:18 GMT

Works like a charm, thank you very much 😊

Grateful that no TAC was necessary 😉

Re: Identity Collector - number of events

daniextremo — Fri, 24 Feb 2023 07:45:33 GMT

Hi @Hrvoje_Brlek ,

I have same problem in R80.30 take 255. Since I enabled IDC and removed Ad Query (wmi access denied since last patch for windows server), the "Source User Name" field is not displayed on the logs tab. As a result, some policies are not being matched. In IDC side everything seems fine:

# pdp idc status
Identity Collector IP: X.X.X.X
Identity Sources:
No information about identity sources

pdp conn idc

Number of IDCollector sessions: 1
------------------------------------------------------------------------------------------------------------
# IP Number of events Shared secret status Last Event
------------------------------------------------------------------------------------------------------------
1 x.x.x.x Valid No events received in the last hour

¿How to fix?

Regards

Re: Identity Collector - number of events

Hrvoje_Brlek — Fri, 24 Feb 2023 13:12:35 GMT

Hi @daniextremo, this was a post from a few years ago, but as I recall I followed the section "Monitoring Capability" in sk108235 and it helped -> you need to add the Registry Key on the IDC server (Windows machine).

Re: Identity Collector - number of events

daniextremo — Fri, 24 Feb 2023 13:32:40 GMT

Thanks for reply @Hrvoje_Brlek . I could fix the problem.

Regards!

Re: Identity Collector - number of events

bcalderon — Tue, 19 Sep 2023 21:12:20 GMT

hello @daniextremo , How did you solve your problem, I have the same problem in a load sharing cluster R81.10

Re: Identity Collector - number of events

bcalderon — Tue, 19 Sep 2023 21:47:17 GMT

hello @daniextremo , How did you solve the problem?, I have the same problem with a cluster

Re: Identity Collector - number of events

daniextremo — Wed, 20 Sep 2023 06:42:44 GMT

Hi @bcalderon ,

I don't remember exactly, but it's very likely that it was solved by adding the registry key that @Hrvoje_Brlek  mention.
I see that registry key exists in my server.

Identity Collector - Send Monitoring Information 

Regards