cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post
Highlighted

Cannot add log server to smartevent

We have configured SmartEvent R80.10 (dedicated) and by following sk110894 gotten av few domains and logs into SmartEvent.

(We get the "Correlating logs to events. The log correlation unit is not able to read logs from Log server: . Please run 'cpstat cpsead' " but we see logs and events, so we're assuming this is cosmetic).

However, we are _only_ so far able to add logs from domains where the firewall logs to a dedicated log server. If the firewalls in the domain we add log to the management, it does not appear in "General settings -> Inital settings -> Correlation Units -> Add (select domain where firewall logs to managment (not do dedicated log server).

Anybody seen anything similar. smartevent_issue.GIF

6 Replies
Admin
Admin

Re: Cannot add log server to smartevent

This is a known limitation currently that we plan to resolve in the near future.

0 Kudos

Re: Cannot add log server to smartevent

Does anyone know if this is still a limitation ? I've just come across it in R80.30

thanks

Pete

Employee+
Employee+

Re: Cannot add log server to smartevent

Are we talking about an R80.10/R80.30 SME managed by an R77.30 MDS?

where the CMA/DMS, which is the actual log-server of the GW cannot be seen as a Log-Server to to choose from in the SmartEvent's GUI log-server list?

(while a CLM/DLS of MLM can be seen & picked)?

 

0 Kudos

Re: Cannot add log server to smartevent

I'm talking about R80.30 MDS with R80.30 SmartEvent where the CMA on the MDS is also the log server.

For some reason I cannot pull the correct domain from the R80.30 SmartEvent or the Log server (CMA)

I also tried a separate log server and several install databases but to no good outcome.

Re: Cannot add log server to smartevent

Apparently its a known issue, but no public SK available about it.

I now have a portfix to try

0 Kudos

Re: Cannot add log server to smartevent

Yes the supplied fix works. If you hit the same issue, please log a call with TAC to obtain it