ALERT! The community will be read-only starting on April 19, 8am Pacific as the migration begins. Read more for important details.
ALERT! The community will be read-only starting on April 19, 8am Pacific as the migration begins.Read more for important details.
Absent Member.
Absent Member.
235 views

Error looking up the device referenced in the scanner meta-events. Skipping

Hi All

I am having issues importing devices into ArcSight using the Asset Importer Connector. We initially had issues importing assets into a non-local network (not belonging to the ArcSight local network). We resolved this and were able to import assets to a custom Zone (belonging to a custom network) with no issue after that.

The next step in our process was to create a new network for our second domain and import assets into the zones belonging to that network. This is failing with the following error. “Error looking up the device referenced in the scanner meta-events. Skipping”, I have assigned the Asset Importer Connector to the network to allow assets to be generated and have double checked that there is no overlap in my zones and that they all belong to the correct Network and Locations.

  • Network A
    • Zone 1 (10.0.1.0/24)
    • Zone 2 (10.0.2.0/24)
  • Network B
    • Zone 3 (11.0.1.0/24)
    • Zone 4 (11.0.2.0/24)

The full error message is below.


[2011-05-24 08:46:31,462][ERROR][default.com.arcsight.server.scanner.ScannerEventsHandler][doProcess] Scanner meta-event processing failed for 1 events '[com.arcsight.event.SecurityEvent@46e04c7f]' with target ip = '170263825' and target hostname 'FPN031'


[2011-05-24 08:46:31,462][ERROR][default.com.arcsight.server.scanner.ScannerEventsHandler][doProcess] Error looking up the device referenced in the scanner meta-events. Skipping.

[2011-05-24 08:46:31,462][ERROR][default.com.arcsight.server.scanner.ScannerEventsHandler][doProcess]

java.lang.NullPointerException

                at com.arcsight.server.scanner.ScannerEventsHandler.doProcess(ScannerEventsHandler.java:1963)

                at com.arcsight.server.scanner.ScannerEventsHandler.processAll(ScannerEventsHandler.java:2470)

                at com.arcsight.common.buffer.MapBuffer.run(MapBuffer.java:322)

                at java.lang.Thread.run(Thread.java:619)

As you can imagine the assets look something like this:

ASSET01,10.0.1.1

ASSET02,10.0.1.2

ASSET03,10.0.2.3

ASSET04,10.0.2.4

ASSET05,10.0.2.1

ASSET06,11.0.1.1

ASSET07, 11.0.1.2

ASSET08,11.0.2.1

ASSET09, 11.0.2.2

ASSET12, 11.0.2.23

Has anyone had this problem, and know how to overcome it.

B.T.W. I am running the latest Manager, Console, DB and Smart Connectors and still no luck.

Labels (1)
0 Likes
1 Reply
Cadet 2nd Class Cadet 2nd Class
Cadet 2nd Class

Populating the Customer URI on the connector fixes this issue.

/David

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.