R80.40 generating too many logs

[fly1ng_circus]

When using a LEA connection in R80.40 for logging or when using smart console, I am getting too many logs. For instance I get two logs for each hit on a rule. I have tried per connection and per session. Makes no difference. for some reason every connection generates two logs.

I am sure it is something I have done, but so far I haven't figured out what. Any ideas as to what I have broken here?

[John_Fleming]

Are your LEA clients connecting to more then one device?

[fly1ng_circus]

not to more than one device that should be sending the same logs. I have tried it connect to just the one R80.40 CMA and also to my R80.30 CMA. If I connect to my R80.30 instance everything works fine. Connecting to R80.40 gives double logs. and obviously it is more than just LEA because the same thing is happening in smart console.

[PhoneBoy]

Have you compared the log cards on both logs to see if there is any difference?
This might require a TAC case.

As a separate question, why are you using LEA instead of Log Exporter?

[fly1ng_circus]

I have compared them and there is no difference. However, something I have done (I do not know what) Seems to have stopped the double logs in the Smart Console. However LEA is still producing double logs.

The reason for using LEA is that Firemon doesn't yet support Log Exporter, so in testing LEA with Firemon, I noticed the problem with double hitcounts. I started digging and noticed it in Smart console and in the LEA records that Firemon is collecting.

[PhoneBoy]

Like I said, you probably need a TAC case.