topic Re: R80.10 - Correlation Unit not able to real logs in Firewall and Security Management

R80.10 - Correlation Unit not able to real logs

Michael_Horne — Tue, 20 Feb 2018 15:58:52 GMT

Hi,

I have newly install of a Management Server (VM on Hyper-v) running R80.10 fir all the recommended updates applied. The management server is also running the SmartEvent server / correlation unit:

The Security gateways are logging to the Management server. I am getting the following Error message:

I check online there is little information from people having a similar issue this issue. There was one SK for R77.30, that I have applied the same workaround for, but it had no effect. I have checked SPstat cpsead and things appear to be OK:

Also in the SmartEvent Client everything else appears OK:

I f anyone has any experience with this problem or can suggest some steps to aid my investigation it would be appreciated.

Many thanks,

Re: R80.10 - Correlation Unit not able to real logs

Pedro_Boavida — Tue, 20 Feb 2018 22:38:22 GMT

Did you installed event policy at least one first time?

Re: R80.10 - Correlation Unit not able to real logs

Michael_Horne — Wed, 21 Feb 2018 08:30:09 GMT

Hi Pedro,

Yes, I have managed to install the SmartEvent policy without any issues:

Re: R80.10 - Correlation Unit not able to real logs

G_W_Albrecht — Wed, 21 Feb 2018 13:25:52 GMT

> There was one SK for R77.30, that I have applied the same workaround

Which sk are you talking about ? As you are running on R80.10, we can leave out sk111631, but we also have sk109716 "Error:failed to get log information from log server." error in SmartEvent GUI and sk64661 SmartEvent Correlation Unit fails to read logs from Log Server that might be helpfull !

Re: R80.10 - Correlation Unit not able to real logs

Michael_Horne — Wed, 21 Feb 2018 19:00:33 GMT

Hi,

Thanks for this. My online search did not find the particular SK you mention. It was indeed the answer to my problem.