Check Events Received

[eonl]

Hi Guys,

I have a connector that receives TCP data on a port lets say for this example port 514.

Now the connector is working and receiving tcp logs, now we have an outage in the network. How can we see if the connector at that time received any TCP logs? 

If I look in agent.log file I can see that the connector cant communicate with the manager because of the network outage, but how can I check that during this outage the connector received any logs, or none at all?

Surely there must be a log that will show the tcp ack as failed seeing that it is TCP data and not UDP.

[benh3103]

If I understand you correctly, you can add a new csv destination or check what is in connector's cache.

[eonl]

No, What I was trying to explain, is as follow.

Logsource -> TCPlogs -> Connector -> ESM

Now the connection Between Logsource and connector drops, how in the connector logs can you see this, is there something like tcp ack failed or ET is 0 or EPS=0 what do you check to confirm this?

[Marius2]

If the connection is lost between the connector and the ESM then you will see a growth of .queue and .cache files in your agentdata folder on the connector.

If you want to monitor the logsources, if any stops sending data to your connector due to an outage, then there is a health monitoring option.

From ESM, open up the specific connector, go to configuration, and set health checking to true (should be almost at the bottom.

That way, the connector will send a health event per interval you set, to the ESM, per logsource that has ever sent data to the connector.

You can then have rules in ESM like:

If auditid: agent:043, product is not arcsight and time since last received event is larger than X minutes/hours/days, then create an event.

If you don't want an event you can also just monitor this manually during an investigation, by creating a channel that filter out all events except agent:043 events on that connector, for that specific IP/hostname.

There is also documentation around about device monitoring setups there is even a built in one in ESM if you want to use that.