R80.10 SmartEvent/Views - Blades missing

[Robert_Mueller]

Hi,

I've successsfully installed a R80.10 SmartEVent Server in dne MDM and it receives the LOGs but inthe views I can only see events from the FW blade.. not from ThreatPrevention or IPS.. is there somewhere a filter, which I haven't seen?

Edit: All Log Events (IPS; Threat Prevention, Anti-Malware....) are in the LOG of the SmartEvent Server

General View - Only Logs from FW Blade

LOG View - Entries from all blades are on the SME Server:

Br

Robert

[Robert_Mueller]

Hi - Nobody an idea what's wrong with my SmartEvent/SmartView Server??

[Maarten_Sjouw]

If you are configuring a SE server for a Multi Domain environment (MDM), you need to go to a new tab and then in the bottom left open the SmartEvent legacy application to configure the Domains it will accept and also add those to the correlation unit to have it correlate events.

[Kfir_Dadosh]

When querying for logs, regardless on what machine you're on, query goes to the log servers.

When running views and reports, queries are running against the SmartEvent server.

In order to make sure logs really got to the SmartEvent Server, open a view, and drill down by double clicking one of the widgets.

You should see the logs (if you get a view, drill down further), but you should notice also a "Session Only" tag.

This tells the SmartLog to look for logs on the SmartEvent machine.

Now you can clear the "drill down" filter, keeping the "Session Only" tag, and run custom query to see what really are the logs that indexed in SmartEvent.

[Robert_Mueller]

Hi - Thanks for your answer - it seems that the SME only receives FW Events.. but what have I to do to receive all events from all blades?? Sorry for the rookie question but IÄm new to R80.10 SME

Robert

[Robert_Mueller]

The problem is also with the OPSEC Receiver (Splunk) it receives FW Logs but no others... what have I to change that all other logs will be transmitted (as it was in R77.30)...

[Robert_Mueller]

Well.. the problem is solve... after installing "JHF 151" everything works fine.. and noone knows "why"..