Sourcefire Estreamer Stops Sending Events
We have a sourcefire estreamer connected to our ESM. When the service is started, we get good events for maybe a 24 hour period, but then all of the sudden, all we receive are "Connector Raw Event Statistics." Once we restart the connector, though, everything starts sending good again, and after an amount of time, it goes back to the raw events. Something is causing the connector to lose connection from its source (Defense Center). Could this be an EPS issue or what? I'm not sure what modifications can be made to the connector to fix this issue. Any help is greatly appreciated.
I had the same issue when I installed DHCP connector. During the install "AUP master destination" was set to false. I changed to true and it has fixed the issue. Do you have that option?
What version of SmartConnector are you running? Something is causing your connector to lose connection to the Sourcefire Defense Center. When we rebuilt these connectors on a newer version, they started working correctly.
Old thread I know, but I'm having the same issue. I finally broke down and am just going to cron a restart script to keep an eye on Eps= and restart the connector when it's 0 again.