Identity Collector Syslog messages

[Polina_1]

Hello.

We need to configure Identity Collector to receive information via syslog. We have configured Syslog Parser correctly, we checked in the Test messages field, everything works correctly.
Then we did everything as described in AdminGuide. But for some reason no events are received.

Can you please tell me where we could have made a mistake in the configuration? How can we see if the messages reach the Identity Collector? Maybe it is a cosmetic error in the status.
I would be glad to have any information on this topic, as AdminGuide doesn't really cover this in detail.

[the_rock]

I remember few months ago, in the summer, I was helping a customer who had this issue and TAC discovered it had something to do with the certificate on the server where IC was installed. Btw, also, can you verify all gateways show as connected?

Andy

[Polina_1]

Yes, the gateway is correctly connected to the IC.

Could you please elaborate more on what the problem was with the certificate?

Actually I don't even know what to look at to identify the problem.

[the_rock]

I would have to check my notes, but if you are allowed to, we can do remote and happy to try assist.

Let me know.

Andy

[the_rock]

Just checked the notes I have and their issue was related to gateway not connecting in IC, which yours is, so not the same.

Andy

[Polina_1]

Yes, in our case the gateway has correctly connected to the IC.

The status shows that the last event sent at 12:11. Can you tell me where on the gateway I can view this event? Or where should the events on the gateway be displayed?

I apologize. Perhaps I could find the answers to these questions in the documentation. But I can't do that yet.

[the_rock]

Dont apologize, we are here to help. Yes, thats where you see it. But, here is the question...do you have correct AD info configured under sources? I will take screenshot later and send.

Andy

[Polina_1]

We configured the sources as follows. I've attached a screenshot.

[the_rock]

That looks right to me. At this point, if you are not seeing any events, you may need to do traffic capture to see why.

Andy

[Polina_1]

We have done traffic capture on the server where IC is installed. The required events are received. I have also attached a screenshot.
We also turned off the firewall on Windows. To exclude the problem in that. But all to no success.

[the_rock]

I meant capture on the firewall. We need to see if fw is having problems communicating properly. Have you done zdebug to see if anything related to IC is getting dropped?

Andy

[kamilazat]

Hi @Polina_1 Did you manage the resolve the issue? It seems we're having exactly the same issue here.

[Polina_1]

Hi,

No, we didn't succeed in solving that problem.
We used a Network Access Control (NAC) server as the source of the syslog messages.
I believe that the IC server expects to receive the following events:

Authentication events - 4624, 4768, 4769, 4770
Group update events - 4728, 4729, 4732, 4733, 4756, 4757
Group deletion events - 4730, 4734, 4758

Source: https://support.checkpoint.com/results/sk/sk108235

Our NAC server did not generate any such events. Therefore, our testing ended with a negative result.

[kamilazat]

I see. At this point I wonder if the events are limited to those or not. Admin Guide also mentions the exact same events.