Highlighted
Absent Member.
Absent Member.
1087 views

Sourcefire Estreamer Stops Sending Events

We have a sourcefire estreamer connected to our ESM.  When the service is started, we get good events for maybe a 24 hour period, but then all of the sudden, all we receive are "Connector Raw Event Statistics."  Once we restart the connector, though, everything starts sending good again, and after an amount of time, it goes back to the raw events. Something is causing the connector to lose connection from its source (Defense Center).  Could this be an EPS issue or what?  I'm not sure what modifications can be made to the connector to fix this issue.  Any help is greatly appreciated.

Thanks,

Jeremy

Labels (2)
11 Replies
Highlighted
Established Member..
Established Member..

Make sure you are on the latest build. I've seen that behavior on older builds.

Keith

0 Likes
Highlighted
Absent Member.
Absent Member.

Hi Jeremy,

I am facing the exactly same issue. Did you get any solution for that. Can you please share?

- Amit

0 Likes
Highlighted
Acclaimed Contributor.. Acclaimed Contributor..
Acclaimed Contributor..

Hello Amit,

we had the same issue, just installed SmartConnector-5.2.4.6326 and will monitor.

Volker

0 Likes
Highlighted
Absent Member.
Absent Member.

I had the same issue when I installed DHCP connector. During the install "AUP master destination" was set to false. I changed to true and it has fixed the issue. Do you have that option?

0 Likes
Highlighted
Absent Member.
Absent Member.

Hi Amit ,

this issue Solved ????

I'm too facing same issue !!

regards

Santhosh I

0 Likes
Highlighted
Absent Member.
Absent Member.

What version of SmartConnector are you running?  Something is causing your connector to lose connection to the Sourcefire Defense Center.  When we rebuilt these connectors on a newer version, they started working correctly.

0 Likes
Highlighted
Absent Member.
Absent Member.

I left the project before it got solved 🙂

0 Likes
Highlighted
Absent Member.
Absent Member.

Nice,

Issue solved by itself!

After installing/restarting connector it takes some time to fetch the logs..........

Didn't do any changes..

0 Likes
Highlighted
New Member.

Looks like we are seeing the same problem with 7.0.5.

Did anyone did a bug ID or similar?

0 Likes
Highlighted
Super Contributor.. Super Contributor..
Super Contributor..

We are seeing the same thing with 7.5 and 7.6 SmartConnector as well. Ours is on an ArcMC and periodically, it just stops receiving events and we have to restart the container. I have tried adjusting heap memory size, # of events to batch for the destination and the cache size for the destination. Sometimes it will run for 4 hours and other times it will run for 30 mins. Does anyone have any suggestions?
Highlighted
Frequent Contributor.
Frequent Contributor.

Old thread I know, but I'm having the same issue.  I finally broke down and am just going to cron a restart script to keep an eye on Eps= and restart the connector when it's 0 again.

 

 

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.