- CheckMates
- :
- Products
- :
- Quantum
- :
- Security Gateways
- :
- Re: Identity Collector - number of events
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Identity Collector - number of events
Hi,
I am setting up an Identity Collector in our CP environment. I have one question regarding the number of events. In the Identity Collector dashboard I can see the number of events being sent, and through the Gateway CLI we can see also the number of events, but these two numbers do not correlate with each other. Is this an expected behavior?
I'm sending the examples below.
Identity Collector:
Gateway CLI:
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
have you enabled the monitoring feature on IDC side? (check "Monitoring capability" section under sk108235)
Royi Priov
R&D Group manager, Infinity Identity
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @Hrvoje_Brlek,
I don't remember the calculation behind "pdp conn idc" event counter, but probably there is a logic to unify the events for same user&IP (while the UI for sure doesn't unify them).
To see the same output as the IDC UI, you can use "pdp idc status" (R80.30 and above) or "cpstat identityServer -f idc"
Royi Priov
R&D Group manager, Infinity Identity
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
When I run those commands, this is the output I get:
The same output is on a Gateway running 80.40 JHF T83 and on 80.30 JHF T219.
Am I doing something wrong?
There is no connectivity issues between Identity Collector and the Gateways (both VSX), nor are there any firewalls on the way. Identity collector version is the latest one from CP, it has configured six DCs, with all of them generating events visible through IC dashboard.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Why not have TAC resolve this ? Does not look healthy...
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Already have a few TAC cases open. Would really like not to have to open a TAC case for every minor change or implementation in a Check Point environment. 😐
But, if necessary will do so...
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
have you enabled the monitoring feature on IDC side? (check "Monitoring capability" section under sk108235)
Royi Priov
R&D Group manager, Infinity Identity
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Works like a charm, thank you very much 😊
Grateful that no TAC was necessary 😉
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @Hrvoje_Brlek ,
I have same problem in R80.30 take 255. Since I enabled IDC and removed Ad Query (wmi access denied since last patch for windows server), the "Source User Name" field is not displayed on the logs tab. As a result, some policies are not being matched. In IDC side everything seems fine:
# pdp idc status
Identity Collector IP: X.X.X.X
Identity Sources:
No information about identity sources
pdp conn idc
Number of IDCollector sessions: 1
------------------------------------------------------------------------------------------------------------
# IP Number of events Shared secret status Last Event
------------------------------------------------------------------------------------------------------------
1 x.x.x.x Valid No events received in the last hour
¿How to fix?
Regards
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @daniextremo, this was a post from a few years ago, but as I recall I followed the section "Monitoring Capability" in sk108235 and it helped -> you need to add the Registry Key on the IDC server (Windows machine).
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for reply @Hrvoje_Brlek . I could fix the problem.
Regards!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hello @daniextremo , How did you solve your problem, I have the same problem in a load sharing cluster R81.10
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hello @daniextremo , How did you solve the problem?, I have the same problem with a cluster
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @bcalderon ,
I don't remember exactly, but it's very likely that it was solved by adding the registry key that @Hrvoje_Brlek mention.
I see that registry key exists in my server.
Identity Collector - Send Monitoring Information
Regards
