All the Gateways are not being shown in the Reports from SmartEvent

[Mohammed_Omin_B]

Recently we enabled SmartEvent server, SmartEvent correlation unit, logging and status on the management server. we also configured few reports but we have observed that all the gateways are not being shown in the Reports. we have only 3 HA pairs but only 1 is reflecting in the reports. 

Not sure why other two are not reflecting. Can somebody suggest on this please.

[Mohammed_Omin_B]

Dameon Welch-Abernathy‌ 

[Maarten_Sjouw]

Does the SmartEvent  server license allow for all gateways?

[PhoneBoy]

It's either a licensing issue as Maarten Sjouw‌ said (number of supported gateways is limited by license) or something else that may need a TAC case to investigate more closely.

[Mohammed_Omin_B]

Thanks Maarten Sjouw Dameon Welch-Abernathy

Have raised a case with TAC and looks even they are confused. Have also verified license and it says Quota (1/4) and i assume it as one gateway/cluster out of 4. 

TAC has suggested the following but not sure if that works.

1) Apply the latest jumbo hotfix take 169 on the mgmt server - I have checked and did not find any such issue will be covered under this hotfix.

2) They did one small change in the smartevent policies under the CONSOLIDATED SESSION--> CHECKED FIREWALL SESSION - But this did not help.

3) Disable and re- enable smartevent and correlation unit to see if that works - yet to verify

Looks like TAC is not sure about the issue. Either they have not come across any such issue earlier or it is needs to be escalated.

This might help others... 

[PhoneBoy]

Can you send me the SR number in a private message?

[PhoneBoy]

Hopefully you should see a followup shortly.

[MatsKarneman]

Hi 

did you ever get an answer to this? i got a similar situation with smartevent and qouta says 1/5. 

r80.20 and Mgmt/log/Sme on same server.  

[Mohammed_Omin_B]

Last time, TAC informed us to perform few things like upgrading CPM to its latest patch, disabling/renabling smartevent server and correlation unit, enabling log indexing. Though all these options doesn't really looks like the cause for the issue, we did all but nothing helped. 

Yesterday, we re-opened the case and now its pending with checkpoint. 

During the discussion today, he tried SK111734 and observed that these files are missing /other-smartlog*, /resources* and /files*. Even after performing the above SK, those files are not populating any data. He suspects that this could be the issue and verifying for its solution.

Ones i get the solution, ill post it here....!!