Categorization not Working

[ftavares]

Hi all,

I have a Regex FlexConnector that is working as expected, expect the categorization file, that seems to be not recognized and has no effect in normalized events.

I have created my categorization file under the structure:

<ARCSIGHT HOME>/current/user/agent/acp/categorizer/current/<vendor>/<product>.csv

I have create <vendor> folder and <product>.csv file with recommendations "no space" and "lowercase", so, i guess that' OK.

Event that, when I start my agent I do not see in logs any mention saying that my categorization file was loaded or not and when I go to ESM, my events are there, but with no categorization.

Looking in Connector's LOG Files I just see this mention about categorizarion (as you guys see, nothing about my file):

[2015-02-28 09:58:30,705][INFO ][default.com.arcsight.agent.ag.ob$b_][getInputStream] Resource [arcsight/arcsight.csv] found in [/arcsight/ArcSightSmartConnectors/FlexTest/current/system/agent/acp/arcsightagents_2014-08-12-19-20-32_2.9.2.0.0-7.0.6.7232.0.aup|categorizer/current/arcsight/arcsight.csv.arc]

[2015-02-28 09:58:30,708][INFO ][default.com.arcsight.common.e.a][processSingleAlert] Succesfully loaded categorization file [arcsight/arcsight.csv]

I know that this proccess is very well documented but it looks that's something missing here. I am using Linux installation and my Connector is 7.0.5 version. I have installed another connector just for test, and I have same behavior.

Any Ideas??

Regards.

[tammy.torbert@h1]

Hi,

I'm assuming your flexconnector deviceVendor and deviceProduct are the same as your values for the categorization directory, except lowercase and using underscores (_) for spaces.

Does your categorization file have event.deviceEventClassId,set.event.<fieldname>... in it?  You may want to double check there's not a typo in your categorization file that is causing it to get ignored.

Tammy

[ftavares · Accepted solution]

Hi Tammy,

thanks for your reply.

Actually, I've made it work. It was a permission problem at O.S. level. Something that I've noticed about logs and I want to share:

- If you look at agent.log, the categorization file will only be loaded when connectors get a "DeviceVendor/DeviceProduct" first event matching with its categorization files. So, you should test against real values otherwise it won't show if file was correctly loaded or not.

Thanks.

[emilian.darie1]

Hi man, I have the same problem and I don't really understand how you solve it...

My categorization file is like this:

event.destinationServiceName,event.deviceCustomNumber1,event.deviceCustomNumber2,set.event.categoryBehavior

SSH,4,3,/Execute/Stop

SSH,0,1,/Execute/Stop

SSH,1,0,/Execute/Stop

SSH,0,0,/Execute/Response

SSH,1,0,/Access/Start

SSH,2,3,/Communicate/Response

from log:

First event from [Ipswitch|WS_FTP Server||] received.

from parser:

event.deviceVendor=__stringConstant("Ipswitch")

event.deviceProduct=__stringConstant("WS_FTP Server")

unfortunately I don t have any message of loading or unloading but actually I had such messages hours before as I can see in agent.log , even before starting categorization and now there is no message even if the file is there created so somehow is not even trying to search it...but why?

[2015-08-19 15:34:05,650][INFO ][default.com.arcsight.agent.ah.qb$a_][getInputStream] Resource [ipswitch/ws_ftp_server.link.csv] not found in any of the usual places

[2015-08-19 15:34:05,650][INFO ][default.com.arcsight.agent.ah.qb$a_][getInputStream] Resource [ipswitch/ws_ftp_server.csv] not found in any of the usual places

[2015-08-19 15:34:05,653][INFO ][default.com.arcsight.agent.ah.ob$a_][getInputStream] Resource [ipswitch/ws_ftp_server.link.csv] not found

[2015-08-19 15:34:05,656][INFO ][default.com.arcsight.agent.ah.ob$a_][getInputStream] Resource [ipswitch/ws_ftp_server.csv] not found

[2015-08-19 15:34:05,656][WARN ][default.com.arcsight.common.ab.a][processSingleAlert] Unable to find categorization file [ipswitch/ws_ftp_server.csv]

---------------------------------

[2015-08-20 20:10:41,506][INFO ][default.com.arcsight.agent.ah.ob$a_][getInputStream] Resource [arcsight/arcsight.csv] found in [/opt/arcsight/development/app_sftp_windows/current/system/agent/acp/arcsightagents_2015-06-25-16-34-20_2.9.2.0.0-7.1.5.7575.0.aup|categorizer/current/arcsight/arcsight.csv.arc]

[2015-08-20 20:10:41,511][INFO ][default.com.arcsight.common.ab.a][processSingleAlert] Succesfully loaded categorization file [arcsight/arcsight.csv]

Thank you