Hi All
I am having issues importing devices into ArcSight using the Asset Importer Connector. We initially had issues importing assets into a non-local network (not belonging to the ArcSight local network). We resolved this and were able to import assets to a custom Zone (belonging to a custom network) with no issue after that.
The next step in our process was to create a new network for our second domain and import assets into the zones belonging to that network. This is failing with the following error. “Error looking up the device referenced in the scanner meta-events. Skipping”, I have assigned the Asset Importer Connector to the network to allow assets to be generated and have double checked that there is no overlap in my zones and that they all belong to the correct Network and Locations.
- Network A
- Zone 1 (10.0.1.0/24)
- Zone 2 (10.0.2.0/24)
- Network B
- Zone 3 (11.0.1.0/24)
- Zone 4 (11.0.2.0/24)
The full error message is below.
[2011-05-24 08:46:31,462][ERROR][default.com.arcsight.server.scanner.ScannerEventsHandler][doProcess] Scanner meta-event processing failed for 1 events '[com.arcsight.event.SecurityEvent@46e04c7f]' with target ip = '170263825' and target hostname 'FPN031'
[2011-05-24 08:46:31,462][ERROR][default.com.arcsight.server.scanner.ScannerEventsHandler][doProcess] Error looking up the device referenced in the scanner meta-events. Skipping.
[2011-05-24 08:46:31,462][ERROR][default.com.arcsight.server.scanner.ScannerEventsHandler][doProcess]
java.lang.NullPointerException
at com.arcsight.server.scanner.ScannerEventsHandler.doProcess(ScannerEventsHandler.java:1963)
at com.arcsight.server.scanner.ScannerEventsHandler.processAll(ScannerEventsHandler.java:2470)
at com.arcsight.common.buffer.MapBuffer.run(MapBuffer.java:322)
at java.lang.Thread.run(Thread.java:619)
As you can imagine the assets look something like this:
ASSET01,10.0.1.1
ASSET02,10.0.1.2
ASSET03,10.0.2.3
ASSET04,10.0.2.4
ASSET05,10.0.2.1
ASSET06,11.0.1.1
ASSET07, 11.0.1.2
ASSET08,11.0.2.1
ASSET09, 11.0.2.2
ASSET12, 11.0.2.23
Has anyone had this problem, and know how to overcome it.
B.T.W. I am running the latest Manager, Console, DB and Smart Connectors and still no luck.
