Problem with Symantec Endpoint Collector distinguishing observers.

[mrosen]

Hi.

First things first, this is basically a Problem in Symantecs Product, I
wonder though if there's a workaround on the Sentinel side.

As it is, Symantec Endpoint Protection 12.1, when configured to log to
Sentinel via Syslog incorrectly (in violation of the RFC) sends
"SymantecServer" as the hostname, more precisely they send

"SymantecServer <RealHostname>"

so that if one has multiple such servers, they get lumped together in
Sentinel as one under the name "SymantecServer".

Apart from kicking Symantec in the behind, is there anything I can do in
Sentinel to distinguish the individual observers? Like some logic to
look at the <Realhostname> that it sends, aka ignore the trailing
"Symantecserver " somehow?


CU,
--
Massimo Rosen
Novell Knowledge Partner
No emails please!
http://www.cfc-it.de

[brandon-langley]

Massimo Rosen;263160 Wrote:
> Hi.
>
> First things first, this is basically a Problem in Symantecs Product, I
> wonder though if there's a workaround on the Sentinel side.
>
> As it is, Symantec Endpoint Protection 12.1, when configured to log to
> Sentinel via Syslog incorrectly (in violation of the RFC) sends
> "SymantecServer" as the hostname, more precisely they send
>
> "SymantecServer <RealHostname>"
>
> so that if one has multiple such servers, they get lumped together in
> Sentinel as one under the name "SymantecServer".
>
> Apart from kicking Symantec in the behind, is there anything I can do
> in
> Sentinel to distinguish the individual observers? Like some logic to
> look at the <Realhostname> that it sends, aka ignore the trailing
> "Symantecserver " somehow?
>
>
> CU,
> --
> Massimo Rosen
> Novell Knowledge Partner
> No emails please!
> http://www.cfc-it.de

I'm pretty sure the team just took an SR/Bug on this and addressed it.


--
brandon.langley
------------------------------------------------------------------------
brandon.langley's Profile: https://forums.netiq.com/member.php?userid=350
View this thread: https://forums.netiq.com/showthread.php?t=54834

[mrosen]

Brandon,

Am 11.12.2015 um 03:17 schrieb brandon.langley:
> I'm pretty sure the team just took an SR/Bug on this and addressed it.

Dang! I should have looked at the preview plugins first.

Thumbs up for having my problem solved proactively. 😉

CU,
--
Massimo Rosen
Novell Knowledge Partner
No emails please!
http://www.cfc-it.de

[mrosen]

Am 11.12.2015 um 10:44 schrieb Massimo Rosen:
> Brandon,
>
> Am 11.12.2015 um 03:17 schrieb brandon.langley:
>> I'm pretty sure the team just took an SR/Bug on this and addressed it.
>
> Dang! I should have looked at the preview plugins first.
>
> Thumbs up for having my problem solved proactively. 😉

Guess I spoke too soon..:( Same problem with the current preview collector.

Another issue with that collector is, that it doesn't automatically
detect the event source as Symantec Endpoint Protection, but puts it
under Universal Event by default, and has to be manually moved.

CU,
--
Massimo Rosen
Novell Knowledge Partner
No emails please!
http://www.cfc-it.de

[brandon-langley]

Massimo Rosen;263261 Wrote:
> Am 11.12.2015 um 10:44 schrieb Massimo Rosen:
> > Brandon,
> >
> > Am 11.12.2015 um 03:17 schrieb brandon.langley:
> >> I'm pretty sure the team just took an SR/Bug on this and addressed
> it.
> >
> > Dang! I should have looked at the preview plugins first.
> >
> > Thumbs up for having my problem solved proactively. 😉
>
> Guess I spoke too soon..:( Same problem with the current preview
> collector.
>
> Another issue with that collector is, that it doesn't automatically
> detect the event source as Symantec Endpoint Protection, but puts it
> under Universal Event by default, and has to be manually moved.
>
> CU,
> --
> Massimo Rosen
> Novell Knowledge Partner
> No emails please!
> http://www.cfc-it.de

Massimo,

I think at this point I'd advocate opening an SR and walking through it
with support. In particular, I think they'll be curious to see what is
afoot there, as it's not expected or normal to have that collector
pathing through the Universal collector, which suggests there is another
factor at foot here.


--
brandon.langley
------------------------------------------------------------------------
brandon.langley's Profile: https://forums.netiq.com/member.php?userid=350
View this thread: https://forums.netiq.com/showthread.php?t=54834