All the Gateways are not being shown in the Reports from SmartEvent
Recently we enabled SmartEvent server, SmartEvent correlation unit, logging and status on the management server. we also configured few reports but we have observed that all the gateways are not being shown in the Reports. we have only 3 HA pairs but only 1 is reflecting in the reports.
Not sure why other two are not reflecting. Can somebody suggest on this please.
Have raised a case with TAC and looks even they are confused. Have also verified license and it says Quota (1/4) and i assume it as one gateway/cluster out of 4.
TAC has suggested the following but not sure if that works.
1) Apply the latest jumbo hotfix take 169 on the mgmt server - I have checked and did not find any such issue will be covered under this hotfix.
2) They did one small change in the smartevent policies under the CONSOLIDATED SESSION--> CHECKED FIREWALL SESSION - But this did not help.
3) Disable and re- enable smartevent and correlation unit to see if that works - yet to verify
Looks like TAC is not sure about the issue. Either they have not come across any such issue earlier or it is needs to be escalated.
This might help others...
Last time, TAC informed us to perform few things like upgrading CPM to its latest patch, disabling/renabling smartevent server and correlation unit, enabling log indexing. Though all these options doesn't really looks like the cause for the issue, we did all but nothing helped.
Yesterday, we re-opened the case and now its pending with checkpoint.
During the discussion today, he tried SK111734 and observed that these files are missing /other-smartlog*, /resources* and /files*. Even after performing the above SK, those files are not populating any data. He suspects that this could be the issue and verifying for its solution.
Ones i get the solution, ill post it here....!!