topic Re: Identity Collector Syslog messages in General Topics

Identity Collector Syslog messages

Polina_1 — Sat, 16 Nov 2024 08:46:06 GMT

Hello.

We need to configure Identity Collector to receive information via syslog. We have configured Syslog Parser correctly, we checked in the Test messages field, everything works correctly.
Then we did everything as described in AdminGuide. But for some reason no events are received.

Can you please tell me where we could have made a mistake in the configuration? How can we see if the messages reach the Identity Collector? Maybe it is a cosmetic error in the status.
I would be glad to have any information on this topic, as AdminGuide doesn't really cover this in detail.

Re: Identity Collector Syslog messages

the_rock — Sat, 16 Nov 2024 12:35:50 GMT

I remember few months ago, in the summer, I was helping a customer who had this issue and TAC discovered it had something to do with the certificate on the server where IC was installed. Btw, also, can you verify all gateways show as connected?

Andy

Re: Identity Collector Syslog messages

Polina_1 — Sun, 17 Nov 2024 08:57:05 GMT

Yes, the gateway is correctly connected to the IC.

Could you please elaborate more on what the problem was with the certificate?

Actually I don't even know what to look at to identify the problem.

Re: Identity Collector Syslog messages

the_rock — Sun, 17 Nov 2024 15:02:46 GMT

I would have to check my notes, but if you are allowed to, we can do remote and happy to try assist.

Let me know.

Andy

Re: Identity Collector Syslog messages

the_rock — Sun, 17 Nov 2024 17:10:24 GMT

Just checked the notes I have and their issue was related to gateway not connecting in IC, which yours is, so not the same.

Andy

Re: Identity Collector Syslog messages

Polina_1 — Mon, 18 Nov 2024 09:22:04 GMT

Yes, in our case the gateway has correctly connected to the IC.

The status shows that the last event sent at 12:11. Can you tell me where on the gateway I can view this event? Or where should the events on the gateway be displayed?

I apologize. Perhaps I could find the answers to these questions in the documentation. But I can't do that yet.

Re: Identity Collector Syslog messages

the_rock — Mon, 18 Nov 2024 11:54:10 GMT

Dont apologize, we are here to help. Yes, thats where you see it. But, here is the question...do you have correct AD info configured under sources? I will take screenshot later and send.

Andy

Re: Identity Collector Syslog messages

Polina_1 — Mon, 18 Nov 2024 12:18:51 GMT

We configured the sources as follows. I've attached a screenshot.

Re: Identity Collector Syslog messages

the_rock — Mon, 18 Nov 2024 12:55:03 GMT

That looks right to me. At this point, if you are not seeing any events, you may need to do traffic capture to see why.

Andy

Re: Identity Collector Syslog messages

Polina_1 — Mon, 18 Nov 2024 13:05:30 GMT

We have done traffic capture on the server where IC is installed. The required events are received. I have also attached a screenshot.
We also turned off the firewall on Windows. To exclude the problem in that. But all to no success.

Re: Identity Collector Syslog messages

the_rock — Mon, 18 Nov 2024 13:08:26 GMT

I meant capture on the firewall. We need to see if fw is having problems communicating properly. Have you done zdebug to see if anything related to IC is getting dropped?

Andy

Re: Identity Collector Syslog messages

kamilazat — Wed, 04 Dec 2024 10:55:45 GMT

Hi @Polina_1 Did you manage the resolve the issue? It seems we're having exactly the same issue here.

Re: Identity Collector Syslog messages

Polina_1 — Wed, 04 Dec 2024 12:31:25 GMT

Hi,

No, we didn't succeed in solving that problem.
We used a Network Access Control (NAC) server as the source of the syslog messages.
I believe that the IC server expects to receive the following events:

Authentication events - 4624, 4768, 4769, 4770
Group update events - 4728, 4729, 4732, 4733, 4756, 4757
Group deletion events - 4730, 4734, 4758

Source: https://support.checkpoint.com/results/sk/sk108235

Our NAC server did not generate any such events. Therefore, our testing ended with a negative result.

Re: Identity Collector Syslog messages

kamilazat — Wed, 04 Dec 2024 12:39:57 GMT

I see. At this point I wonder if the events are limited to those or not. Admin Guide also mentions the exact same events.