Anyone come across the following error within the NSM system logs before?
[Thread-130] iv.core.DiscoveryService - keepPolling true
Firing every few seconds.
NSM running software 220.127.116.11
I suspect it's related to communication with an IPS hanging off this NSM as opposed to a Central NSM, however all IPS are up and reporting in as expected.
It's not the same message but I see a lot of these in the ems logs on my managers
|[Thread-123] iv.core.DiscoveryService.status -||[STATE] <SensorName> ACTIVE|
It seems to be just polling the sessors to check their state.
I'm on V8.2 so they may be a bit different.
Peter, thanks for that.
Seems to make sense, I suspect the 'Thread-130' refers to the sensor. It's the fact they messages come through as Errors which is slightly worrying, suggesting that the NSM is possibly not seeing the sensor.
Can I ask whether these show up as 'errors' within your EMS log?
No, these show up as INFO in my ems logs.
I think the Thread refers to the process that generated the message and not the sensor.
Can you see all of your sensors reporting into the real time threat analyser?
If you have more than one manager are you seeing the same error on them all?
It does look like a communication error between the sensor and the manager, but it could just be checking something like the software version etc.