SmartEvent: No Log Indexing after changing IP Address

[dj0Nz]

Hi Mates,

at one of my customers I have a R80.20 SmartCenter and a dedicated Logserver/SmartEvent machine running. Today I changed IP addresses of management server and log server. I did a SIC reset on the log server afterwards because it didn't come up properly.

Currently, there are still no logs in SmartConsole. I can see logs in Smartview Tracker, so the firewalls are sending logs and the log server is processing them.

To me it seems like the SmartEvent instance messed up its database or parts of it. The Doctor Log Script shows 2 errors:

ERROR : [27 Jun 10:28:45] - Failed to find myself sic name in the registry
ERROR : [27 Jun 10:24:22] - Could not read from remote log server:
Failed to connect to log server <Mgmt Server IP>:18184 

Install Database didn't help.

Any ideas, anyone?

Cheers,
Michael

[dj0Nz]

I solved the errors that the doctor log script showed on the log server, but still no logs in Smartconsole. If I login to the log server directly (either with Smartview Tracker, SmartConsole or SmartView), everything looks normal. Running the log analysis script on the management server shows "Found a large number of exception indicators (xxx) in smartview"...

[dj0Nz]

OK now. Jumbo Take 87 solved the problem...